Add just command to refresh cert

helmfile.d/01-infrastructure.lock

@@ -2,21 +2,21 @@ version: 1.2.3
 dependencies:
   - name: cert-manager
     repository: https://charts.jetstack.io
-    version: v1.19.2
+    version: v1.19.3
   - name: cert-manager-webhook-hetzner
     repository: https://vadimkim.github.io/cert-manager-webhook-hetzner
     version: 1.4.2
   - name: rook-ceph
     repository: https://charts.rook.io/release
-    version: v1.18.8
+    version: v1.19.1
   - name: rook-ceph-cluster
     repository: https://charts.rook.io/release
-    version: v1.18.8
+    version: v1.19.1
   - name: tailscale-operator
     repository: https://pkgs.tailscale.com/helmcharts
-    version: 1.92.4
+    version: 1.94.1
   - name: traefik
     repository: https://traefik.github.io/charts
-    version: 38.0.1
-digest: sha256:3297bc0c10765abe170881882f7daf441a4dd735ed0ee7d1f4233692e8888c3c
-generated: "2025-12-23T10:31:34.409765694-07:00"
+    version: 39.0.0
+digest: sha256:4f5c8a239ffdf62b0ee3c5cad93fe0a155fc9d311f2754a27f28b45d08abedfc
+generated: "2026-02-08T14:48:11.557963845-07:00"

helmfile.d/02-datastore.lock

@@ -5,12 +5,12 @@ dependencies:
     version: 4.8.6
   - name: mariadb
     repository: https://charts.bitnami.com/bitnami
-    version: 24.0.2
+    version: 24.0.4
   - name: pgo
     repository: git+https://github.com/grantdhunter/postgres-operator@helm?ref=main
     version: 5.8.1
   - name: postgrescluster
     repository: git+https://github.com/grantdhunter/postgres-operator@helm?ref=main
     version: 5.7.4
-digest: sha256:f8989df670b3574b6d87438486b66fdaf44bc1ed379d3a98e00963a27703003a
-generated: "2025-12-14T14:14:05.060998516-07:00"
+digest: sha256:fc54869ca74c71a7cff3a47249fc1c1abad85af8b5fd46f50cc5f94e34ea196f
+generated: "2026-02-08T14:48:12.433127048-07:00"

helmfile.d/03-apps.lock

@@ -8,7 +8,7 @@ dependencies:
     version: 25.0.4
   - name: gitea
     repository: https://dl.gitea.io/charts
-    version: 12.4.0
+    version: 12.5.0
   - name: immich
     repository: https://immich-app.github.io/immich-charts
     version: 0.10.3
@@ -29,9 +29,9 @@ dependencies:
     version: 0.1.0
   - name: matrix-synapse
     repository: https://ananace.gitlab.io/charts
-    version: 3.12.17
+    version: 3.12.19
   - name: static-site
     repository: git+https://github.com/cfpb/static-site@charts?ref=main
     version: 0.1.1
-digest: sha256:b44d082b71203ca6bb4fd881d8c6ce71575db556f432bbcc46078a535c8cd9c3
-generated: "2025-12-23T10:31:37.404126839-07:00"
+digest: sha256:c3533d8c4b01672a46feeb0bf7610dddceb4387d76ab5bf5f3edc27086747ba1
+generated: "2026-02-08T14:48:18.507177487-07:00"

immich/values.yaml.gotmpl

@@ -3,7 +3,7 @@ controllers:
     containers:
       main:
         image:
-          tag: v2.4.1
+          tag: v2.5.5
 
         env:
           DB_HOSTNAME: {{ exec "kubectl" (list "-n" "immich" "get" "secrets" "postgres-pguser-immich" "-ogo-template='{{.data.host | base64decode }}'") }}
@@ -44,7 +44,7 @@ server:
               memory: 256Mi
             limits:
               cpu: 1
-              memory: 700Mi
+              memory: 800Mi
   ingress:
     main:
       enabled: true

justfile

@@ -45,7 +45,7 @@ refresh-client-cert:
     yq -r .machine.ca.key controlplane.yaml | base64 -d > ca.key
     talosctl gen key --name admin           
     talosctl gen csr --key admin.key --ip 127.0.0.1 
-    talosctl gen crt --ca ca --csr admin.csr --name admin
+    talosctl gen crt --ca ca --csr admin.csr --name admin --hours  8760
     yq -i '.contexts.fog.ca = "'"$(base64 -w0 ca.crt)"\
     '" | .contexts.fog.crt = "'"$(base64 -w0 admin.crt)"\
     '" | .contexts.fog.key = "'"$(base64 -w0 admin.key)"'"' \

traefik/values.yaml.gotmpl

@@ -60,11 +60,13 @@ ingressRoute:
 
 ports:
   websecure:
-    middlewares:
-      - traefik-rate-limit@kubernetescrd
+    http:
+      middlewares:
+        - traefik-rate-limit@kubernetescrd
   web:
-    middlewares:
-      - traefik-redirectscheme@kubernetescrd      
+    http:
+      middlewares:
+        - traefik-redirectscheme@kubernetescrd      
   ssh:
     port: 2222
     expose: