feat(streaming): public routes jelly/seerr via forust.xyz

cloudflared/k8s/deployment.yaml

@@ -18,7 +18,7 @@ spec:
     spec:
       containers:
         - name: cloudflared
-          image: cloudflare/cloudflared:2026.10.0
+          image: cloudflare/cloudflared:2026.9.3
           imagePullPolicy: IfNotPresent
           args:
             - tunnel

edu_master/phpsessid-bot/Dockerfile

@@ -1,4 +1,4 @@
-FROM python:3.14-slim
+FROM python:3.11-slim
 
 WORKDIR /app
 

edu_master/webinar-checker/Dockerfile

@@ -1,4 +1,4 @@
-FROM python:3.14-slim
+FROM python:3.11-slim
 
 WORKDIR /app
 

n8n/compose.yaml

@@ -1,6 +1,6 @@
 services:
   n8n:
-    image: docker.n8n.io/n8nio/n8n:2.42.3
+    image: docker.n8n.io/n8nio/n8n:2.42.2
     container_name: n8n
     restart: unless-stopped
     environment:

n8n/k8s/n8n.yaml

@@ -29,7 +29,7 @@ spec:
     spec:
       containers:
         - name: n8n
-          image: docker.n8n.io/n8nio/n8n:2.42.3
+          image: docker.n8n.io/n8nio/n8n:2.42.2
           envFrom:
             - configMapRef:
                 name: n8n-config

netronome/compose.yaml

@@ -1,6 +1,6 @@
 services:
   netronome:
-    image: ghcr.io/autobrr/netronome:v0.16.0
+    image: ghcr.io/autobrr/netronome:v0.15.0
     restart: unless-stopped
     container_name: netronome
     ports:

netronome/k8s/netronome.yaml

@@ -32,7 +32,7 @@ spec:
     spec:
       containers:
         - name: netronome
-          image: ghcr.io/autobrr/netronome:v0.16.0
+          image: ghcr.io/autobrr/netronome:v0.15.0
           ports:
             - name: netronome-port
               protocol: TCP

renovate/k8s/configmap.yaml

@@ -218,34 +218,6 @@ data:
           "matchUpdateTypes": ["patch"],
           "groupName": "all patch updates",
           "groupSlug": "all-patch"
-        },
-        {
-          "description": "Python Y-bumps break compat (3.11->3.12->3.13->3.14) - keep the base image out of the shared minor/patch groups, review every bump separately. Placed last so its groupName wins.",
-          "matchDatasources": ["docker"],
-          "matchPackageNames": ["python"],
-          "groupName": "python base image",
-          "groupSlug": "python",
-          "automerge": false
-        },
-        {
-          "description": "Rolling/floating tags (streaming stack, nextcloud beta, kubectl latest) - never automerge, every bump is a manual review. Placed last so automerge:false wins over the shared digest/patch rule.",
-          "matchDatasources": ["docker"],
-          "matchPackageNames": [
-            "lscr.io/linuxserver/jellyfin",
-            "lscr.io/linuxserver/qbittorrent",
-            "lscr.io/linuxserver/sonarr",
-            "lscr.io/linuxserver/radarr",
-            "lscr.io/linuxserver/prowlarr",
-            "lscr.io/linuxserver/bazarr",
-            "ghcr.io/seerr-team/seerr",
-            "fallenbagel/jellyseerr",
-            "ghcr.io/lampac-nextgen/lampac",
-            "ghcr.io/nextcloud-releases/all-in-one",
-            "alpine/kubectl"
-          ],
-          "groupName": "floating images - manual",
-          "groupSlug": "floating-manual",
-          "automerge": false
         }
       ]
     }

renovate/k8s/cronjob.yaml

@@ -19,7 +19,7 @@ spec:
           restartPolicy: Never
           containers:
             - name: renovate
-              image: renovate/renovate:44.136.0
+              image: renovate/renovate:44.132.2
               env:
                 - name: RENOVATE_PLATFORM
                   value: gitea

renovate/renovate.json

@@ -207,34 +207,6 @@
       "matchUpdateTypes": ["patch"],
       "groupName": "all patch updates",
       "groupSlug": "all-patch"
-    },
-    {
-      "description": "Python Y-bumps break compat (3.11->3.12->3.13->3.14) - keep the base image out of the shared minor/patch groups, review every bump separately. Placed last so its groupName wins.",
-      "matchDatasources": ["docker"],
-      "matchPackageNames": ["python"],
-      "groupName": "python base image",
-      "groupSlug": "python",
-      "automerge": false
-    },
-    {
-      "description": "Rolling/floating tags (streaming stack, nextcloud beta, kubectl latest) - never automerge, every bump is a manual review. Placed last so automerge:false wins over the shared digest/patch rule.",
-      "matchDatasources": ["docker"],
-      "matchPackageNames": [
-        "lscr.io/linuxserver/jellyfin",
-        "lscr.io/linuxserver/qbittorrent",
-        "lscr.io/linuxserver/sonarr",
-        "lscr.io/linuxserver/radarr",
-        "lscr.io/linuxserver/prowlarr",
-        "lscr.io/linuxserver/bazarr",
-        "ghcr.io/seerr-team/seerr",
-        "fallenbagel/jellyseerr",
-        "ghcr.io/lampac-nextgen/lampac",
-        "ghcr.io/nextcloud-releases/all-in-one",
-        "alpine/kubectl"
-      ],
-      "groupName": "floating images - manual",
-      "groupSlug": "floating-manual",
-      "automerge": false
     }
   ]
 }

streaming/compose.yaml

@@ -1,6 +1,6 @@
 services:
   jellyfin:
-    image: lscr.io/linuxserver/jellyfin:version-12.1ubu2604
+    image: lscr.io/linuxserver/jellyfin:latest
     container_name: jellyfin
     restart: unless-stopped
     environment:
@@ -19,7 +19,7 @@ services:
       - streaming
 
   qbittorrent:
-    image: lscr.io/linuxserver/qbittorrent:5.2.4
+    image: lscr.io/linuxserver/qbittorrent:latest
     container_name: qbittorrent
     restart: unless-stopped
     environment:
@@ -38,7 +38,7 @@ services:
       - streaming
 
   sonarr:
-    image: lscr.io/linuxserver/sonarr:4.0.20
+    image: lscr.io/linuxserver/sonarr:latest
     container_name: sonarr
     restart: unless-stopped
     environment:
@@ -55,7 +55,7 @@ services:
       - streaming
 
   radarr:
-    image: lscr.io/linuxserver/radarr:6.4.4
+    image: lscr.io/linuxserver/radarr:latest
     container_name: radarr
     restart: unless-stopped
     environment:
@@ -72,7 +72,7 @@ services:
       - streaming
 
   prowlarr:
-    image: lscr.io/linuxserver/prowlarr:2.6.5
+    image: lscr.io/linuxserver/prowlarr:latest
     container_name: prowlarr
     restart: unless-stopped
     environment:
@@ -87,8 +87,9 @@ services:
       - streaming
 
   jellyseerr:
-    image: fallenbagel/jellyseerr:latest
+    image: ghcr.io/seerr-team/seerr:latest
     container_name: jellyseerr
+    init: true
     restart: unless-stopped
     environment:
       - TZ=${TZ:-Europe/Berlin}
@@ -100,7 +101,7 @@ services:
       - streaming
 
   bazarr:
-    image: lscr.io/linuxserver/bazarr:1.6.2
+    image: lscr.io/linuxserver/bazarr:latest
     container_name: bazarr
     restart: unless-stopped
     environment:
@@ -116,6 +117,31 @@ services:
     networks:
       - streaming
 
+  lampac:
+    image: ghcr.io/lampac-nextgen/lampac:latest
+    container_name: lampac
+    restart: unless-stopped
+    shm_size: 1024mb
+    # Restore persisted passwd/init.conf from seed volume before start,
+    # so config survives container recreation (upstream entrypoint is
+    # ENTRYPOINT ["dotnet", "Core.dll"], WORKDIR /lampac, USER lampac).
+    entrypoint:
+      [
+        "/bin/sh",
+        "-c",
+        "if [ -f /seed/passwd ] && [ ! -f /lampac/passwd ]; then cp /seed/passwd /lampac/passwd; fi; if [ -f /seed/init.conf ] && [ ! -f /lampac/init.conf ]; then cp /seed/init.conf /lampac/init.conf; fi; exec /usr/share/dotnet/dotnet Core.dll",
+      ]
+    environment:
+      - TZ=${TZ:-Europe/Berlin}
+    volumes:
+      - lampac-seed:/seed
+      - lampac-cache:/lampac/cache
+      - lampac-db:/lampac/database
+    ports:
+      - "19118:9118"
+    networks:
+      - streaming
+
 volumes:
   jellyfin-cfg:
   qbittorrent-cfg:
@@ -124,6 +150,9 @@ volumes:
   prowlarr-cfg:
   jellyseerr-cfg:
   bazarr-cfg:
+  lampac-seed:
+  lampac-cache:
+  lampac-db:
   downloads:
   movies:
   tv:

streaming/k8s/routing/certificates.yaml

@@ -13,19 +13,32 @@ spec:
   issuerRef:
     name: internal-ca
     kind: ClusterIssuer
-# ---
+---
-# apiVersion: cert-manager.io/v1
+apiVersion: cert-manager.io/v1
-# kind: Certificate
+kind: Certificate
-# metadata:
+metadata:
-#   name: jellyfin-prod-tls
+  name: jelly-prod-tls
-#   namespace: streaming
+  namespace: streaming
-# spec:
+spec:
-#   secretName: jellyfin-prod-tls
+  secretName: jelly-prod-tls
-#   dnsNames:
+  dnsNames:
-#     - jellyfin.forust.xyz
+    - jelly.forust.xyz
-#   issuerRef:
+  issuerRef:
-#     name: letsencrypt-prod
+    name: letsencrypt-prod
-#     kind: ClusterIssuer
+    kind: ClusterIssuer
+---
+apiVersion: cert-manager.io/v1
+kind: Certificate
+metadata:
+  name: seerr-prod-tls
+  namespace: streaming
+spec:
+  secretName: seerr-prod-tls
+  dnsNames:
+    - seerr.forust.xyz
+  issuerRef:
+    name: letsencrypt-prod
+    kind: ClusterIssuer
 # ---
 # apiVersion: cert-manager.io/v1
 # kind: Certificate
@@ -78,16 +91,3 @@ spec:
 #   issuerRef:
 #     name: letsencrypt-prod
 #     kind: ClusterIssuer
-# ---
-# apiVersion: cert-manager.io/v1
-# kind: Certificate
-# metadata:
-#   name: jellyseerr-prod-tls
-#   namespace: streaming
-# spec:
-#   secretName: jellyseerr-prod-tls
-#   dnsNames:
-#     - jellyseerr.forust.xyz
-#   issuerRef:
-#     name: letsencrypt-prod
-#     kind: ClusterIssuer

streaming/k8s/routing/external-service.yaml

@@ -186,3 +186,30 @@ endpoints:
       - "192.168.88.100"
     conditions:
       ready: true
+---
+apiVersion: v1
+kind: Service
+metadata:
+  name: lampac
+  namespace: streaming
+spec:
+  ports:
+    - port: 19118
+      targetPort: 19118
+---
+apiVersion: discovery.k8s.io/v1
+kind: EndpointSlice
+metadata:
+  name: lampac
+  namespace: streaming
+  labels:
+    kubernetes.io/service-name: lampac
+addressType: IPv4
+ports:
+  - port: 19118
+    protocol: TCP
+endpoints:
+  - addresses:
+      - "192.168.88.100"
+    conditions:
+      ready: true

streaming/k8s/routing/ingress.yaml

@@ -116,3 +116,54 @@ spec:
           port: 16767
   tls:
     secretName: internal-wildcard-tls
+---
+apiVersion: traefik.io/v1alpha1
+kind: IngressRoute
+metadata:
+  name: lampac-local
+  namespace: streaming
+spec:
+  entryPoints:
+    - websecure
+  routes:
+    - match: Host(`lampac.workstation.internal`)
+      kind: Rule
+      services:
+        - name: lampac
+          port: 19118
+  tls:
+    secretName: internal-wildcard-tls
+---
+apiVersion: traefik.io/v1alpha1
+kind: IngressRoute
+metadata:
+  name: jellyfin-prod
+  namespace: streaming
+spec:
+  entryPoints:
+    - websecure
+  routes:
+    - match: Host(`jelly.forust.xyz`)
+      kind: Rule
+      services:
+        - name: jellyfin
+          port: 18096
+  tls:
+    secretName: jelly-prod-tls
+---
+apiVersion: traefik.io/v1alpha1
+kind: IngressRoute
+metadata:
+  name: seerr-prod
+  namespace: streaming
+spec:
+  entryPoints:
+    - websecure
+  routes:
+    - match: Host(`seerr.forust.xyz`)
+      kind: Rule
+      services:
+        - name: jellyseerr
+          port: 15055
+  tls:
+    secretName: seerr-prod-tls

termix/compose.yaml

@@ -1,6 +1,6 @@
 services:
   termix:
-    image: ghcr.io/lukegus/termix:2.9.1
+    image: ghcr.io/lukegus/termix:2.9.0
     container_name: termix
     restart: unless-stopped
     # ports:

termix/k8s/termix.yaml

@@ -29,7 +29,7 @@ spec:
     spec:
       containers:
         - name: termix
-          image: ghcr.io/lukegus/termix:2.9.1
+          image: ghcr.io/lukegus/termix:2.9.0
           envFrom:
             - configMapRef:
                 name: termix-config

vpn/xui/k8s/xui.yaml

@@ -36,7 +36,7 @@ spec:
     spec:
       containers:
         - name: xui
-          image: ghcr.io/mhsanaei/3x-ui:v3.9.0
+          image: ghcr.io/mhsanaei/3x-ui:v3.8.5
           envFrom:
             - configMapRef:
                 name: xui-config