update dependencies

53ll/values.yaml.gotmpl

@@ -62,7 +62,7 @@ extraDeploy:
     spec:
       secretName: 53ll-ca-tls
       issuerRef:
-        name: letsencrypt-53ll
+        name: letsencrypt
         kind: ClusterIssuer
       dnsNames:
         - 53ll.ca

cert-manager-issuers/templates/clusterissuers.yaml

@@ -6,83 +6,25 @@ metadata:
 type: Opaque
 stringData:
   api-key: {{ .Values.hetzner.apiToken }}
+  
 ---
+
 apiVersion: cert-manager.io/v1
 kind: ClusterIssuer
 metadata:
-  name: letsencrypt-incngrnt
+  name: letsencrypt
 spec:
   acme:
     server: https://acme-v02.api.letsencrypt.org/directory
     email: {{ .Values.acme.email }}
     privateKeySecretRef:
-      name: letsencrypt-incngrnt-private-key
+      name: letsencrypt-private-key
     solvers:
       - dns01:
           webhook:
             groupName: acme.hetzner.com
             solverName: hetzner
             config:
-              secretName: hetzner-dns-credentials
-              zoneName: incngrnt.ca
-              apiUrl: https://dns.hetzner.com/api/v1
----
-apiVersion: cert-manager.io/v1
-kind: ClusterIssuer
-metadata:
-  name: letsencrypt-goatchat
-spec:
-  acme:
-    server: https://acme-v02.api.letsencrypt.org/directory
-    email: {{ .Values.acme.email }}
-    privateKeySecretRef:
-      name: letsencrypt-goatchat-private-key
-    solvers:
-      - dns01:
-          webhook:
-            groupName: acme.hetzner.com
-            solverName: hetzner
-            config:
-              secretName: hetzner-dns-credentials
-              zoneName: goatchat.ca
-              apiUrl: https://dns.hetzner.com/api/v1
----
-apiVersion: cert-manager.io/v1
-kind: ClusterIssuer
-metadata:
-  name: letsencrypt-53ll
-spec:
-  acme:
-    server: https://acme-v02.api.letsencrypt.org/directory
-    email: {{ .Values.acme.email }}
-    privateKeySecretRef:
-      name: letsencrypt-53ll-private-key
-    solvers:
-      - dns01:
-          webhook:
-            groupName: acme.hetzner.com
-            solverName: hetzner
-            config:
-              secretName: hetzner-dns-credentials
-              zoneName: 53ll.ca
-              apiUrl: https://dns.hetzner.com/api/v1
----
-apiVersion: cert-manager.io/v1
-kind: ClusterIssuer
-metadata:
-  name: letsencrypt-kgnot
-spec:
-  acme:
-    server: https://acme-v02.api.letsencrypt.org/directory
-    email: {{ .Values.acme.email }}
-    privateKeySecretRef:
-      name: letsencrypt-kgnot-private-key
-    solvers:
-      - dns01:
-          webhook:
-            groupName: acme.hetzner.com
-            solverName: hetzner
-            config:
-              secretName: hetzner-dns-credentials
-              zoneName: kgnot.ca
-              apiUrl: https://dns.hetzner.com/api/v1
+              tokenSecretKeyRef:
+                name: hetzner-dns-credentials
+                key: api-key

gitea/values.yaml.gotmpl

@@ -78,7 +78,7 @@ extraDeploy:
   spec:
     secretName: git-incngrnt-ca-tls
     issuerRef:
-      name: letsencrypt-incngrnt
+      name: letsencrypt
       kind: ClusterIssuer
     dnsNames:
       - git.incngrnt.ca

helmfile.d/01-infrastructure.lock

@@ -2,21 +2,21 @@ version: 1.2.3
 dependencies:
   - name: cert-manager
     repository: https://charts.jetstack.io
-    version: v1.19.3
+    version: v1.20.0
   - name: cert-manager-webhook-hetzner
-    repository: https://vadimkim.github.io/cert-manager-webhook-hetzner
-    version: 1.4.2
+    repository: https://charts.hetzner.cloud
+    version: 0.6.7
   - name: rook-ceph
     repository: https://charts.rook.io/release
-    version: v1.19.1
+    version: v1.19.2
   - name: rook-ceph-cluster
     repository: https://charts.rook.io/release
-    version: v1.19.1
+    version: v1.19.2
   - name: tailscale-operator
     repository: https://pkgs.tailscale.com/helmcharts
-    version: 1.94.1
+    version: 1.94.2
   - name: traefik
     repository: https://traefik.github.io/charts
-    version: 39.0.0
-digest: sha256:4f5c8a239ffdf62b0ee3c5cad93fe0a155fc9d311f2754a27f28b45d08abedfc
-generated: "2026-02-08T14:48:11.557963845-07:00"
+    version: 39.0.6
+digest: sha256:ab4571859e9f203e981e51fddd6eb64e39e327d1f469aae0aebd5f53cf0ec025
+generated: "2026-03-21T13:49:21.274234426-06:00"

helmfile.d/01-infrastructure.yaml

@@ -7,8 +7,8 @@ repositories:
     url: https://pkgs.tailscale.com/helmcharts
   - name: jetstack
     url: https://charts.jetstack.io
-  - name: cert-manager-webhook-hetzner
-    url: https://vadimkim.github.io/cert-manager-webhook-hetzner
+  - name: hcloud 
+    url: https://charts.hetzner.cloud
 
 lockFilePath: ./helmfile.d/01-infrastructure.lock
 releases:
@@ -28,9 +28,7 @@ releases:
   - name: cert-manager-webhook-hetzner
     namespace: cert-manager
     createNamespace: true
-    chart: cert-manager-webhook-hetzner/cert-manager-webhook-hetzner
-    values:
-      - ../cert-manager-hetzner-webhook/values.yaml.gotmpl
+    chart: hcloud/cert-manager-webhook-hetzner
   - name: cert-manager-issuers
     namespace: cert-manager
     createNamespace: true

helmfile.d/02-datastore.lock

@@ -2,15 +2,15 @@ version: 1.2.3
 dependencies:
   - name: k8up
     repository: https://k8up-io.github.io/k8up
-    version: 4.8.6
+    version: 4.8.7
   - name: mariadb
     repository: https://charts.bitnami.com/bitnami
-    version: 24.0.4
+    version: 25.0.5
   - name: pgo
     repository: git+https://github.com/grantdhunter/postgres-operator@helm?ref=main
     version: 5.8.1
   - name: postgrescluster
     repository: git+https://github.com/grantdhunter/postgres-operator@helm?ref=main
     version: 5.7.4
-digest: sha256:fc54869ca74c71a7cff3a47249fc1c1abad85af8b5fd46f50cc5f94e34ea196f
-generated: "2026-02-08T14:48:12.433127048-07:00"
+digest: sha256:bdd9acbcdad8b139c0e15907a8dc75b6271ccb18b38ab163d112e6499499de18
+generated: "2026-03-21T13:49:21.838610853-06:00"

helmfile.d/03-apps.lock

@@ -29,9 +29,9 @@ dependencies:
     version: 0.1.0
   - name: matrix-synapse
     repository: https://ananace.gitlab.io/charts
-    version: 3.12.19
+    version: 3.12.23
   - name: static-site
     repository: git+https://github.com/cfpb/static-site@charts?ref=main
     version: 0.1.1
-digest: sha256:c3533d8c4b01672a46feeb0bf7610dddceb4387d76ab5bf5f3edc27086747ba1
-generated: "2026-02-08T14:48:18.507177487-07:00"
+digest: sha256:e206c5e3e8104780c61d1322d1b1498907b69351dbee5d92f24f864975b1efe0
+generated: "2026-03-16T10:29:28.885610419-06:00"

immich/values.yaml.gotmpl

@@ -3,7 +3,7 @@ controllers:
     containers:
       main:
         image:
-          tag: v2.5.5
+          tag: v2.5.6
 
         env:
           DB_HOSTNAME: {{ exec "kubectl" (list "-n" "immich" "get" "secrets" "postgres-pguser-immich" "-ogo-template='{{.data.host | base64decode }}'") }}

kgnot/values.yaml.gotmpl

@@ -64,7 +64,7 @@ extraDeploy:
     spec:
       secretName: kgnot-ca-tls
       issuerRef:
-        name: letsencrypt-kgnot
+        name: letsencrypt
         kind: ClusterIssuer
       dnsNames:
         - kgnot.ca

tailscale/connector.yaml

@@ -9,3 +9,4 @@ spec:
   subnetRouter:
     advertiseRoutes:
       - "192.168.1.0/24"
+  exitNode: true

traefik/values.yaml.gotmpl

@@ -116,7 +116,7 @@ extraObjects:
     spec:
       secretName: fog-incngrnt-ca-tls
       issuerRef:
-        name: letsencrypt-incngrnt
+        name: letsencrypt
         kind: ClusterIssuer
       dnsNames:
         - fog.incngrnt.ca
@@ -130,7 +130,7 @@ extraObjects:
     spec:
       secretName: goatchat-ca-tls
       issuerRef:
-        name: letsencrypt-goatchat
+        name: letsencrypt
         kind: ClusterIssuer
       dnsNames:
         - goatchat.ca
@@ -142,7 +142,7 @@ extraObjects:
     spec:
       secretName: incngrnt-ca-tls
       issuerRef:
-        name: letsencrypt-incngrnt
+        name: letsencrypt
         kind: ClusterIssuer
       dnsNames:
         - incngrnt.ca
@@ -154,7 +154,7 @@ extraObjects:
     spec:
       secretName: photos-incngrnt-ca-tls
       issuerRef:
-        name: letsencrypt-incngrnt
+        name: letsencrypt
         kind: ClusterIssuer
       dnsNames:
         - photos.incngrnt.ca