Update actions/checkout action to v7

Reviewed-on: #35

.gitea/workflows/renovate.yaml

@@ -16,7 +16,7 @@ jobs:
     container: ghcr.io/renovatebot/renovate:latest
     steps:
       - name: Check out repository code
-        uses: actions/checkout@v4
+        uses: actions/checkout@v7
       - name: Run Renovate CLI
         run: |
           renovate

README.md

@@ -48,6 +48,12 @@ Retrieve public/private keys (*store these on a **secure** location!*):
 kubectl get secret -n kube-system -l sealedsecrets.bitnami.com/sealed-secrets-key -o yaml > BitnamiSealedSecrets.masterkey.yml
 ```
 
+Restoring public/private keys:
+```shell
+kubectl apply -f BitnamiSealedSecrets.masterkey.yml
+kubectl rollout restart deployment -n kube-system sealed-secrets-controller
+```
+
 ### 5) Services
 ##### 5.1) [Gitea](https://gitea.io/)    <small>(git repository)</small>
 *Required for all other workloads*  

services/BedrockServerManager/_namespace-bedrockservermanager.yml

@@ -1,4 +0,0 @@
-apiVersion: v1
-kind: Namespace
-metadata:
-  name: bedrockservermanager

services/BedrockServerManager/application-bedrockservermanager.yaml

@@ -1,18 +0,0 @@
-apiVersion: argoproj.io/v1alpha1
-kind: Application
-metadata:
-  name: bedrockservermanager
-  namespace: argo-cd
-spec:
-  destination:
-    namespace: bedrockservermanager
-    server: https://kubernetes.default.svc
-  project: default
-  syncPolicy:
-    automated: {}
-    syncOptions:
-      - CreateNamespace=true
-  sources:
-  - repoURL: https://code.spamasaurus.com/djpbessems/Kubernetes.K3s.installLog
-    path: services/BedrockServerManager
-    targetRevision: HEAD

services/BedrockServerManager/deployment-bedrockservermanager.yaml

@@ -1,42 +0,0 @@
-apiVersion: apps/v1
-kind: Deployment
-metadata:
-  name: bedrockservermanager
-  namespace: bedrockservermanager
-  labels:
-    app: bedrockservermanager
-spec:
-  replicas: 1
-  selector:
-    matchLabels:
-      app: bedrockservermanager
-  strategy:
-    type: Recreate
-  template:
-    metadata:
-      labels:
-        app: bedrockservermanager
-    spec:
-      containers:
-      - name: bedrockservermanager
-        # image: ghcr.io/dmedina559/bedrock-server-manager:stable
-        image: ghcr.io/dmedina559/bedrock-server-manager:3.7.2
-        ports:
-          - name: web
-            containerPort: 11325
-          - name: mc
-            containerPort: 19132
-          - name: mc-creative
-            containerPort: 19134
-        volumeMounts:
-        - mountPath: /root/.config/bedrock-server-manager
-          name: csismb-bedrockservermanager-config
-        - mountPath: /root/bedrock-server-manager
-          name: csismb-bedrockservermanager-data
-      volumes:
-      - name: csismb-bedrockservermanager-config
-        persistentVolumeClaim:
-          claimName: csismb-bedrockservermanager-config
-      - name: csismb-bedrockservermanager-data
-        persistentVolumeClaim:
-          claimName: csismb-bedrockservermanager-data

services/BedrockServerManager/ingressroute-bedrockservermanager.yaml

@@ -1,17 +0,0 @@
-apiVersion: traefik.io/v1alpha1
-kind: IngressRoute
-metadata:
-  name: bedrockservermanager
-  namespace: bedrockservermanager
-spec:
-  entryPoints:
-    - websecure
-  routes:
-  - match: Host(`mc.spamasaurus.com`)
-    kind: Rule
-    services:
-    - name: bedrockservermanager
-      port: 11325
-    middlewares:
-      - name: security-headers@file
-      # - name: compression@file

services/BedrockServerManager/persistentvolume-csismb-bedrockservermanager-config.yaml

@@ -1,31 +0,0 @@
-apiVersion: v1
-kind: PersistentVolume
-metadata:
-  annotations:
-    pv.kubernetes.io/provisioned-by: smb.csi.k8s.io
-  name: csismb-bedrockservermanager-config
-spec:
-  capacity:
-    storage: 1Gi
-  accessModes:
-    - ReadWriteMany
-  persistentVolumeReclaimPolicy: Retain
-  storageClassName: csismb-bedrockservermanager-config
-  mountOptions:
-    - dir_mode=0777
-    - file_mode=0777
-    - nobrl
-    - cache=strict
-    - mfsymlinks
-    - noserverino  # required to prevent data corruption
-  csi:
-    driver: smb.csi.k8s.io
-    # volumeHandle format: {smb-server-address}#{sub-dir-name}#{share-name}
-    # make sure this value is unique for every share in the cluster
-    volumeHandle: 192.168.154.195#bedrockservermanager#config
-    volumeAttributes:
-      source: //192.168.154.195/K3s.Volumes
-      subDir: bedrockservermanager/config
-    nodeStageSecretRef:
-      name: smb-credentials
-      namespace: bedrockservermanager

services/BedrockServerManager/persistentvolume-csismb-bedrockservermanager-data.yaml

@@ -1,31 +0,0 @@
-apiVersion: v1
-kind: PersistentVolume
-metadata:
-  annotations:
-    pv.kubernetes.io/provisioned-by: smb.csi.k8s.io
-  name: csismb-bedrockservermanager-data
-spec:
-  capacity:
-    storage: 1Gi
-  accessModes:
-    - ReadWriteMany
-  persistentVolumeReclaimPolicy: Retain
-  storageClassName: csismb-bedrockservermanager-data
-  mountOptions:
-    - dir_mode=0777
-    - file_mode=0777
-    - nobrl
-    - cache=strict
-    - mfsymlinks
-    - noserverino  # required to prevent data corruption
-  csi:
-    driver: smb.csi.k8s.io
-    # volumeHandle format: {smb-server-address}#{sub-dir-name}#{share-name}
-    # make sure this value is unique for every share in the cluster
-    volumeHandle: 192.168.154.195#bedrockservermanager#data
-    volumeAttributes:
-      source: //192.168.154.195/K3s.Volumes
-      subDir: bedrockservermanager/data
-    nodeStageSecretRef:
-      name: smb-credentials
-      namespace: bedrockservermanager

services/BedrockServerManager/persistentvolumeclaim-csismb-bedrockservermanager-config.yaml

@@ -1,12 +0,0 @@
-apiVersion: v1
-kind: PersistentVolumeClaim
-metadata:
-  name: csismb-bedrockservermanager-config
-  namespace: bedrockservermanager
-spec:
-  accessModes:
-    - ReadWriteMany
-  storageClassName: csismb-bedrockservermanager-config
-  resources:
-    requests:
-      storage: 1Gi

services/BedrockServerManager/persistentvolumeclaim-csismb-bedrockservermanager-data.yaml

@@ -1,12 +0,0 @@
-apiVersion: v1
-kind: PersistentVolumeClaim
-metadata:
-  name: csismb-bedrockservermanager-data
-  namespace: bedrockservermanager
-spec:
-  accessModes:
-    - ReadWriteMany
-  storageClassName: csismb-bedrockservermanager-data
-  resources:
-    requests:
-      storage: 1Gi

services/BedrockServerManager/sealedsecret-smb-credentials.yaml

@@ -1,14 +0,0 @@
-apiVersion: bitnami.com/v1alpha1
-kind: SealedSecret
-metadata:
-  name: smb-credentials
-  namespace: bedrockservermanager
-spec:
-  encryptedData:
-    password: AgAUxKVMBkGZeLu1XablLg9UuP9Jj6Od7phWEhXzyEdT5UB6ZNRlmi07k0dUrT+IgVl7OGNyP1yVJQCrbWWOlNtOIUez3SNd4XqTrXg4TM7OpgewHEHTibexSZWhQ8QCOc/jpk6bVPBjaiOq02jmBocwakOhB56drojknr8CI5nD2xSgfAc4VIj1dmpzBn8a3SG7rBep0nKVifgFLaYdVSCURW/NEyG4TKMQpbFDHDL7BzN7Zpx3+kuzlrInSMRd+XfCsGOawvnLZERz5/WS1cc7iSmU4J5gV572yPcwwlw9DN3ewsANJ5oFr6gVjrPTS33bdXY2BNDTQMziLA+GyERhbmbPrz3z3bCCeqYv3hihNS6G35Z47hN1hUETHpjrS5HbbZ0e4RwThEHbt2lzjfVBGsrRCq3qZC4DFhFc+S7PP/pBO1c2UJ3YP4+Fbha72ZtZANh8xJH0HVbzuE4Ut7Lg88Iq9fCNJ6vLVuk4kHws8cvOLEEZBWaWkJcZ1RHpw/DUblHIZlg9htzeKMHFyRyT2qrqPF3XdQAYFHRTXXtn9gUefT8DhIYufsJbahg5qICoPwnS6fIPwoGCRTq03JI8MNeB/9qjRJrZT3LdgUtD2zMKEBqzvl6kJsl81dWhQZIsAuQMsC4DlUvpHj4+XL9QGkK8spQ7sV2U6yh37yCkvG+b+lOHjIANC0iXQOYwSkxApVJLgGfrQYSMf1qVL1Qe
-    username: AgBq8d65YBkZfjT9B0vbCJWu3D0xeA7aYCU4pj329I/0elD5OuFTrY4ZOLlbTMy6+wmhKN90DjpBWgjMkpc/NcRz8lnUE81W5OBL8bzQeOmGp/gwFBhpNcI8RxCBqaoi4616VApdKpj+qjD31ik215RvaKSIgX+mWtiqYgExhrDwWlOCW93fOwXE061FdIt4noUIbhRH7IzNX6S+irxNUEcaAPPn02hTSbwXvrHcVy7PP0lEmANGAbBmNzLZCQ0nBPDOZTceWEAQECTjI7xT94miTuYKhvdJ1afdC2TOQH2Pnq6m+OqCZABdXlsb3KRej1++mKDpIPScAwY5YdmkxYHg1Dqd818z0iaL6u62rCV9pWrjZM40BGVDaXiYKqlmS+X5hMYqFCF5dpgljaM6rBlj1ad0bvPFtgzjPXdF3bgalIR0xzfuVaxcOe7FU7wG/6XICaJ3ka3fxV0EuBBJ2zA4vvElCe/LLK0YbkgdznFh4LypE0wnvqtEoE90S8i5n6UifAaHKHkAuJ0f952bqxz4FEb3CFohlrWqZnml0j+JK/UJFG3ItFtnOJEuVq7+4YBNxS6TNrdD1KyQHqT1BFC7pGCk1r+TSM7AASwa1vFnHAMv9g0vpVpDlfT20rXewZxcg/9+E4R4o29RsuNqdL/mn7a4bm9u/+ll7IQSkwpVvkbw5HBGGebCRTJkAhAYL2j6noedeoc=
-  template:
-    metadata:
-      name: smb-credentials
-      namespace: bedrockservermanager
-    type: Opaque

services/BedrockServerManager/service-bedrockservermanager-mc.yaml

@@ -1,16 +0,0 @@
-apiVersion: v1
-kind: Service
-metadata:
-  name: bedrockservermanager-mc
-  namespace: bedrockservermanager
-spec:
-  type: LoadBalancer
-  ports:
-    - protocol: UDP
-      name: mc
-      port: 19132
-    - protocol: UDP
-      name: mc-creative
-      port: 19134
-  selector:
-    app: bedrockservermanager

services/BedrockServerManager/service-bedrockservermanager.yaml

@@ -1,12 +0,0 @@
-apiVersion: v1
-kind: Service
-metadata:
-  name: bedrockservermanager
-  namespace: bedrockservermanager
-spec:
-  ports:
-    - protocol: TCP
-      name: web
-      port: 11325
-  selector:
-    app: bedrockservermanager

services/Gitea/supportingfiles/statefulset-gitea-actions-act-runner.yaml

@@ -70,12 +70,15 @@ spec:
             - mountPath: /data
               name: data-act-runner
         - name: dind
-          image: "docker:28.3.2-dind"
+          # image: "docker:28.3.2-dind"
+          image: "docker:29.7.2-dind"
           imagePullPolicy: IfNotPresent
           args:
             - dockerd
             - --host=tcp://127.0.0.1:2375
             - --host=unix:///var/run/docker.sock
+            - --mtu=1450
+            - --default-network-opt=bridge=com.docker.network.driver.mtu=1450
           env:
             - name: DOCKER_TLS_VERIFY
               value: ""

services/Vaultwarden/deployment-vaultwarden.yaml

@@ -18,8 +18,7 @@ spec:
       serviceAccountName: vaultwarden
       containers:
       - name: vaultwarden
-        # image: vaultwarden/server:1.34.3
+        image: vaultwarden/server:1.37.3
-        image: vaultwarden/server:1.35.2
         env:
         - name: ENABLE_DB_WAL
           value: "false"

storage/csi-driver-smb/application-csi-driver-smb.yaml

@@ -13,7 +13,7 @@ spec:
   sources:
   - repoURL: https://raw.githubusercontent.com/kubernetes-csi/csi-driver-smb/master/charts
     chart: csi-driver-smb
-    targetRevision: 1.20.0
+    targetRevision: 1.20.3
     helm:
       valueFiles:
       - $values/storage/csi-driver-smb/values.yaml

system/ArgoCD/application-argo-cd.yaml

@@ -14,7 +14,7 @@ spec:
     targetRevision: HEAD
   - repoURL: https://argoproj.github.io/argo-helm
     chart: argo-cd
-    targetRevision: 9.5.15
+    targetRevision: 9.7.1
     helm:
       valueFiles:
       - $values/system/ArgoCD/values.yaml

system/Harvester/ippool-vmn-lan.yaml

@@ -0,0 +1,58 @@
+apiVersion: network.harvesterhci.io/v1alpha1
+kind: IPPool
+metadata:
+  annotations:
+    kubectl.kubernetes.io/last-applied-configuration: |
+      {"apiVersion":"network.harvesterhci.io/v1alpha1","kind":"IPPool","metadata":{"annotations":{},"name":"vmn-lan","namespace":"default"},"spec":{"ipv4Config":{"cidr":"192.168.154.0/24","dns":["192.168.154.200"],"leaseTime":86400,"pool":{"end":"192.168.154.99","exclude":["192.168.154.99"],"start":"192.168.154.50"},"router":"192.168.154.1","serverIP":"192.168.154.99"},"networkName":"default/vmn-lan"}}
+  creationTimestamp: "2025-12-29T22:22:23Z"
+  generation: 1
+  name: vmn-lan
+  namespace: default
+  resourceVersion: "277614389"
+  uid: 8400a6ec-9f7a-4570-934d-1ee3299e04aa
+spec:
+  ipv4Config:
+    cidr: 192.168.154.0/24
+    dns:
+    - 192.168.154.150
+    leaseTime: 86400
+    pool:
+      end: 192.168.154.99
+      exclude:
+      - 192.168.154.99
+      start: 192.168.154.50
+    router: 192.168.154.1
+    serverIP: 192.168.154.99
+  networkName: default/vmn-lan
+status:
+  agentPodRef:
+    image: rancher/harvester-vm-dhcp-agent:v1.7.0
+    name: default-vmn-lan-agent
+    namespace: harvester-system
+    uid: fde98493-a67c-4279-b48e-f7a70ea089b7
+  conditions:
+  - lastUpdateTime: "2025-12-29T22:22:23Z"
+    status: "True"
+    type: Registered
+  - lastUpdateTime: "2025-12-29T22:23:00Z"
+    status: "True"
+    type: CacheReady
+  - lastUpdateTime: "2025-12-29T22:22:26Z"
+    status: "True"
+    type: AgentReady
+  - lastUpdateTime: "2025-12-29T22:22:23Z"
+    status: "False"
+    type: Stopped
+  ipv4:
+    allocated:
+      192.168.154.50: ce:73:61:52:b7:35
+      192.168.154.56: d2:f6:70:98:42:6e
+      192.168.154.57: ea:ad:6d:52:3e:b9
+      192.168.154.58: 9a:b4:56:2d:57:7d
+      192.168.154.66: c2:a3:f7:c4:13:95
+      192.168.154.87: 0a:59:bb:81:a7:6d
+      192.168.154.98: 0a:15:10:a2:78:22
+      192.168.154.99: EXCLUDED
+    available: 42
+    used: 7
+  lastUpdate: "2025-12-30T05:10:35Z"

system/SealedSecrets/application-sealed-secrets-controller.yaml

@@ -11,7 +11,7 @@ spec:
   syncPolicy:
     automated: {}
   sources:
-  - repoURL: https://bitnami-labs.github.io/sealed-secrets
+  - repoURL: https://bitnami.github.io/sealed-secrets
     chart: sealed-secrets
     targetRevision: 2.17.7
     helm: