renovate: move cron to Sat 02:00 Europe/Budapest

Was Sun 04:00; now Sat 02:00 so Renovate's wave lands at the start of
the weekend instead of the end. If an auto-merged update breaks
something, Viktor has the full weekend to troubleshoot.

`0 2 * * 6` = Saturday 02:00 in Europe/Budapest (the CronJob already
sets timeZone, so this is wall-clock local).

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

admin-system/renovate.yaml

@@ -6,7 +6,7 @@
 #        -slim suffix was retired after v37.440.x, so we pin the plain tag)
 #
 # PILOT SCOPE (intentionally narrow):
-#   Runs weekly (Sun 04:00 Europe/Budapest) as a CronJob and opens
+#   Runs weekly (Sat 02:00 Europe/Budapest) as a CronJob and opens
 #   dependency-update PRs against admin/homelab-manifests on Gitea.
 #   Only the `kubernetes` and `helm-values` managers are enabled, and a
 #   default-deny packageRule limits updates to exactly four pilot images:
@@ -44,92 +44,63 @@ data:
       "requireConfig": "optional",
       "dependencyDashboard": true,
       "dependencyDashboardTitle": "Renovate Dependency Dashboard",
-      "prHourlyLimit": 0,
+      "prHourlyLimit": 8,
-      "prConcurrentLimit": 0,
+      "prConcurrentLimit": 8,
       "enabledManagers": ["kubernetes", "helm-values"],
       "kubernetes": {
         "managerFilePatterns": ["/.+\\.ya?ml$/"]
       },
       "packageRules": [
         {
-          "description": "Default-deny everything",
+          "description": "All apps: 3-day stability gate before any PR opens",
           "matchPackageNames": ["*"],
-          "enabled": false
-        },
-        {
-          "description": "Tier 1: enable updates for low-risk leaf apps",
-          "matchPackageNames": [
-            "ghcr.io/thomiceli/opengist",
-            "louislam/uptime-kuma",
-            "f0rc3/gokapi",
-            "docker.io/calcom/cal.com",
-            "advplyr/audiobookshelf",
-            "arcadiatechnology/crafty-4",
-            "codercom/code-server",
-            "ghcr.io/gethomepage/homepage",
-            "ghcr.io/headlamp-k8s/headlamp",
-            "prom/node-exporter",
-            "rommapp/romm",
-            "ghcr.io/stakater/reloader",
-            "privatebin/nginx-fpm-alpine",
-            "flomp/wanderer-db",
-            "flomp/wanderer-web",
-            "registry.k8s.io/kube-state-metrics/kube-state-metrics",
-            "ghcr.io/lukegus/termix"
-          ],
-          "enabled": true
-        },
-        {
-          "description": "Tier 1: automerge minor/patch after 3-day stability window",
-          "matchPackageNames": [
-            "ghcr.io/thomiceli/opengist",
-            "louislam/uptime-kuma",
-            "f0rc3/gokapi",
-            "docker.io/calcom/cal.com",
-            "advplyr/audiobookshelf",
-            "arcadiatechnology/crafty-4",
-            "codercom/code-server",
-            "ghcr.io/gethomepage/homepage",
-            "ghcr.io/headlamp-k8s/headlamp",
-            "prom/node-exporter",
-            "rommapp/romm",
-            "ghcr.io/stakater/reloader",
-            "privatebin/nginx-fpm-alpine",
-            "flomp/wanderer-db",
-            "flomp/wanderer-web",
-            "registry.k8s.io/kube-state-metrics/kube-state-metrics",
-            "ghcr.io/lukegus/termix"
-          ],
-          "matchUpdateTypes": ["minor", "patch"],
-          "automerge": true,
-          "automergeType": "pr",
-          "platformAutomerge": true,
           "minimumReleaseAge": "3 days"
         },
         {
-          "description": "Tier 1: major bumps require dashboard approval (no automerge)",
+          "description": "Auto-merge minor/patch after the stability window",
-          "matchPackageNames": [
+          "matchUpdateTypes": ["minor", "patch"],
-            "ghcr.io/thomiceli/opengist",
+          "automerge": true,
-            "louislam/uptime-kuma",
+          "automergeType": "pr",
-            "f0rc3/gokapi",
+          "platformAutomerge": true
-            "docker.io/calcom/cal.com",
+        },
-            "advplyr/audiobookshelf",
+        {
-            "arcadiatechnology/crafty-4",
+          "description": "Major bumps wait for dashboard approval (catches breaking/schema migrations)",
-            "codercom/code-server",
-            "ghcr.io/gethomepage/homepage",
-            "ghcr.io/headlamp-k8s/headlamp",
-            "prom/node-exporter",
-            "rommapp/romm",
-            "ghcr.io/stakater/reloader",
-            "privatebin/nginx-fpm-alpine",
-            "flomp/wanderer-db",
-            "flomp/wanderer-web",
-            "registry.k8s.io/kube-state-metrics/kube-state-metrics",
-            "ghcr.io/lukegus/termix"
-          ],
           "matchUpdateTypes": ["major"],
           "automerge": false,
           "dependencyDashboardApproval": true
+        },
+        {
+          "description": "k3s-bundled components: never touch, they ride k3s upgrades",
+          "matchPackageNames": [
+            "rancher/local-path-provisioner",
+            "rancher/mirrored-coredns/coredns",
+            "rancher/mirrored-metrics-server"
+          ],
+          "enabled": false
+        },
+        {
+          "description": "Critical core: PR opens with changelog but Viktor merges manually (deploy pipeline + SSO + DB operator). Some entries are no-ops if the image isn't pinned in this repo (ArgoCD bootstrap, authentik outpost images inherit chart defaults).",
+          "matchPackageNames": [
+            "gitea/gitea",
+            "quay.io/argoproj/argocd",
+            "ghcr.io/goauthentik/server",
+            "ghcr.io/goauthentik/ldap",
+            "ghcr.io/goauthentik/proxy",
+            "ghcr.io/cloudnative-pg/cloudnative-pg"
+          ],
+          "automerge": false
+        },
+        {
+          "description": "termix: use github-releases as datasource (ghcr.io OCI manifest for this image lacks the release timestamp Renovate needs for the stability gate; GitHub Releases at Termix-SSH/Termix expose proper timestamps so the 3-day gate works as intended). regex versioning parses the release-X.Y.Z prefix. Renovate still writes the new tag to the same ghcr.io/lukegus/termix image (the registry hosts every release).",
+          "matchPackageNames": ["ghcr.io/lukegus/termix"],
+          "datasource": "github-releases",
+          "packageName": "Termix-SSH/Termix",
+          "versioning": "regex:^release-(?<major>\\d+)\\.(?<minor>\\d+)\\.(?<patch>\\d+)$"
+        },
+        {
+          "description": "wanderer: db + web update together in one PR",
+          "matchPackageNames": ["flomp/wanderer-db", "flomp/wanderer-web"],
+          "groupName": "wanderer"
         }
       ],
       "labels": ["renovate"]
@@ -145,7 +116,9 @@ metadata:
     app.kubernetes.io/name: renovate
     app.kubernetes.io/version: "43.197.0"
 spec:
-  schedule: "0 4 * * 0"
+  # Sat 02:00 Europe/Budapest — leaves the full weekend for troubleshooting
+  # if a Renovate-merged update breaks something.
+  schedule: "0 2 * * 6"
   timeZone: "Europe/Budapest"
   concurrencyPolicy: Forbid
   successfulJobsHistoryLimit: 3

arcade-system/romm.yaml

@@ -117,7 +117,7 @@ spec:
               mountPath: /romm/config
       containers:
         - name: romm
-          image: rommapp/romm:4.6.1
+          image: rommapp/romm:4.8.1
           env:
             # Database
             - name: DB_HOST

argocd-apps/homelab.yaml

@@ -47,6 +47,8 @@ spec:
     server: https://kubernetes.default.svc
     namespace: servarr-system
   syncPolicy:
+    automated:
+      enabled: true
     # Start with manual sync until you're comfortable
     # automated:
     #   prune: true
@@ -82,6 +84,8 @@ spec:
     server: https://kubernetes.default.svc
     namespace: paperless-system
   syncPolicy:
+    automated:
+      enabled: true
     syncOptions:
     - CreateNamespace=true
     - PruneLast=true
@@ -104,6 +108,8 @@ spec:
     server: https://kubernetes.default.svc
     namespace: actualbudget-system
   syncPolicy:
+    automated:
+      enabled: true
     syncOptions:
     - CreateNamespace=true
     - PruneLast=true
@@ -126,6 +132,8 @@ spec:
     server: https://kubernetes.default.svc
     namespace: audiobookshelf-system
   syncPolicy:
+    automated:
+      enabled: true
     syncOptions:
     - CreateNamespace=true
     - PruneLast=true
@@ -148,6 +156,8 @@ spec:
     server: https://kubernetes.default.svc
     namespace: bookstack-system
   syncPolicy:
+    automated:
+      enabled: true
     syncOptions:
     - CreateNamespace=true
     - PruneLast=true
@@ -170,6 +180,8 @@ spec:
     server: https://kubernetes.default.svc
     namespace: immich-system
   syncPolicy:
+    automated:
+      enabled: true
     syncOptions:
     - CreateNamespace=true
     - PruneLast=true
@@ -214,6 +226,8 @@ spec:
     server: https://kubernetes.default.svc
     namespace: nextcloud-system
   syncPolicy:
+    automated:
+      enabled: true
     syncOptions:
     - CreateNamespace=true
     - PruneLast=true
@@ -236,6 +250,8 @@ spec:
     server: https://kubernetes.default.svc
     namespace: outline-system
   syncPolicy:
+    automated:
+      enabled: true
     syncOptions:
     - CreateNamespace=true
     - PruneLast=true
@@ -258,6 +274,8 @@ spec:
     server: https://kubernetes.default.svc
     namespace: tandoor-system
   syncPolicy:
+    automated:
+      enabled: true
     syncOptions:
     - CreateNamespace=true
     - PruneLast=true
@@ -280,6 +298,8 @@ spec:
     server: https://kubernetes.default.svc
     namespace: uptimekuma-system
   syncPolicy:
+    automated:
+      enabled: true
     syncOptions:
     - CreateNamespace=true
     - PruneLast=true
@@ -302,6 +322,8 @@ spec:
     server: https://kubernetes.default.svc
     namespace: vaultwarden-system
   syncPolicy:
+    automated:
+      enabled: true
     syncOptions:
     - CreateNamespace=true
     - PruneLast=true
@@ -369,6 +391,8 @@ spec:
     server: https://kubernetes.default.svc
     namespace: pihole-system
   syncPolicy:
+    automated:
+      enabled: true
     syncOptions:
     - CreateNamespace=true
 
@@ -397,6 +421,8 @@ spec:
     server: https://kubernetes.default.svc
     namespace: mediaserver-system
   syncPolicy:
+    automated:
+      enabled: true
     syncOptions:
     - CreateNamespace=true
 ---
@@ -418,6 +444,8 @@ spec:
     server: https://kubernetes.default.svc
     namespace: calibre-system
   syncPolicy:
+    automated:
+      enabled: true
     syncOptions:
     - CreateNamespace=true
     - PruneLast=true
@@ -440,6 +468,8 @@ spec:
     server: https://kubernetes.default.svc
     namespace: adventurelog-system
   syncPolicy:
+    automated:
+      enabled: true
     syncOptions:
     - CreateNamespace=true
     - PruneLast=true
@@ -592,6 +622,8 @@ spec:
     server: https://kubernetes.default.svc
     namespace: termix-system
   syncPolicy:
+    automated:
+      enabled: true
     syncOptions:
     - CreateNamespace=true
     - PruneLast=true
@@ -614,6 +646,8 @@ spec:
     server: https://kubernetes.default.svc
     namespace: privatebin-system
   syncPolicy:
+    automated:
+      enabled: true
     syncOptions:
     - CreateNamespace=true
     - PruneLast=true
@@ -636,6 +670,8 @@ spec:
     server: https://kubernetes.default.svc
     namespace: headlamp-system
   syncPolicy:
+    automated:
+      enabled: true
     syncOptions:
     - CreateNamespace=true
     - PruneLast=true
@@ -658,6 +694,8 @@ spec:
     server: https://kubernetes.default.svc
     namespace: homepage-system
   syncPolicy:
+    automated:
+      enabled: true
     syncOptions:
     - CreateNamespace=true
     - PruneLast=true
@@ -680,6 +718,8 @@ spec:
     server: https://kubernetes.default.svc
     namespace: code-system
   syncPolicy:
+    automated:
+      enabled: true
     syncOptions:
     - CreateNamespace=true
     - PruneLast=true
@@ -702,6 +742,8 @@ spec:
     server: https://kubernetes.default.svc
     namespace: plantit-system
   syncPolicy:
+    automated:
+      enabled: true
     syncOptions:
     - CreateNamespace=true
     - PruneLast=true
@@ -724,6 +766,8 @@ spec:
     server: https://kubernetes.default.svc
     namespace: fileshare-system
   syncPolicy:
+    automated:
+      enabled: true
     syncOptions:
     - CreateNamespace=true
     - PruneLast=true
@@ -746,6 +790,8 @@ spec:
     server: https://kubernetes.default.svc
     namespace: arcade-system
   syncPolicy:
+    automated:
+      enabled: true
     syncOptions:
     - CreateNamespace=true
     - PruneLast=true
@@ -768,6 +814,8 @@ spec:
     server: https://kubernetes.default.svc
     namespace: workout-system
   syncPolicy:
+    automated:
+      enabled: true
     syncOptions:
     - CreateNamespace=true
     - PruneLast=true
@@ -790,6 +838,8 @@ spec:
     server: https://kubernetes.default.svc
     namespace: wanderer-system
   syncPolicy:
+    automated:
+      enabled: true
     syncOptions:
     - CreateNamespace=true
     - PruneLast=true
@@ -812,6 +862,8 @@ spec:
     server: https://kubernetes.default.svc
     namespace: opengist-system
   syncPolicy:
+    automated:
+      enabled: true
     syncOptions:
     - CreateNamespace=true
     - PruneLast=true
@@ -834,6 +886,8 @@ spec:
     server: https://kubernetes.default.svc
     namespace: zipline-system
   syncPolicy:
+    automated:
+      enabled: true
     syncOptions:
     - CreateNamespace=true
     - PruneLast=true
@@ -856,6 +910,8 @@ spec:
     server: https://kubernetes.default.svc
     namespace: crafty-system
   syncPolicy:
+    automated:
+      enabled: true
     syncOptions:
     - CreateNamespace=true
     - PruneLast=true
@@ -878,6 +934,8 @@ spec:
     server: https://kubernetes.default.svc
     namespace: booking-system
   syncPolicy:
+    automated:
+      enabled: true
     syncOptions:
     - CreateNamespace=true
     - PruneLast=true
@@ -900,6 +958,8 @@ spec:
     server: https://kubernetes.default.svc
     namespace: web-system
   syncPolicy:
+    automated:
+      enabled: true
     syncOptions:
     - CreateNamespace=true
     - PruneLast=true
@@ -922,6 +982,8 @@ spec:
     server: https://kubernetes.default.svc
     namespace: control-system
   syncPolicy:
+    automated:
+      enabled: true
     syncOptions:
     - CreateNamespace=true
     - PruneLast=true
@@ -944,6 +1006,8 @@ spec:
     server: https://kubernetes.default.svc
     namespace: glance-system
   syncPolicy:
+    automated:
+      enabled: true
     syncOptions:
     - CreateNamespace=true
     - PruneLast=true
@@ -967,6 +1031,10 @@ spec:
     server: https://kubernetes.default.svc
     namespace: version-checker-system
   syncPolicy:
+    automated:
+      enabled: true
+      prune: true
+      selfHeal: true
     syncOptions:
       - CreateNamespace=true
       - ServerSideApply=true
@@ -1033,6 +1101,8 @@ spec:
     server: https://kubernetes.default.svc
     namespace: orsi-system
   syncPolicy:
+    automated:
+      enabled: true
     syncOptions:
       - CreateNamespace=true
       - ServerSideApply=true
@@ -1075,6 +1145,8 @@ spec:
     server: https://kubernetes.default.svc
     namespace: kisfenyo-system
   syncPolicy:
+    automated:
+      enabled: true
     syncOptions:
       - CreateNamespace=true
       - ServerSideApply=true
@@ -1096,6 +1168,8 @@ spec:
     server: https://kubernetes.default.svc
     namespace: office-system
   syncPolicy:
+    automated:
+      enabled: true
     syncOptions:
       - CreateNamespace=true
       - ServerSideApply=true
@@ -1118,6 +1192,10 @@ spec:
     server: https://kubernetes.default.svc
     namespace: jarrs-system
   syncPolicy:
+    automated:
+      enabled: true
+      prune: true
+      selfHeal: true
     syncOptions:
     - CreateNamespace=true
     - PruneLast=true

audiobookshelf-system/audiobookshelf.yaml

@@ -54,7 +54,7 @@ spec:
     spec:
       containers:
         - name: audiobookshelf
-          image: advplyr/audiobookshelf:2.32.1
+          image: advplyr/audiobookshelf:2.35.0
           imagePullPolicy: IfNotPresent
           env:
             - name: TZ

code-system/code.yaml

@@ -50,7 +50,7 @@ spec:
         fsGroup: 1000
       containers:
         - name: code-server
-          image: codercom/code-server:4.108.2
+          image: codercom/code-server:4.121.0
           args:
             - --bind-addr=0.0.0.0:8080
             - --auth=none

crafty-system/crafty.yaml

@@ -223,7 +223,7 @@ spec:
         fsGroup: 0
       containers:
         - name: craftycontroller
-          image: arcadiatechnology/crafty-4:4.9.0
+          image: arcadiatechnology/crafty-4:4.10.4
           imagePullPolicy: IfNotPresent
           securityContext:
             runAsNonRoot: true

gitea-system/gitea.yaml

@@ -218,6 +218,7 @@ metadata:
       if ($remote_addr ~ "^10\.") { set $geo_allowed 1; }
       if ($geoip2_country_code = "HU") { set $geo_allowed 1; }
       if ($geoip2_country_code = "DE") { set $geo_allowed 1; }
+      if ($geoip2_country_code = "US") { set $geo_allowed 1; }
       if ($geo_allowed = 0) {
         return 403 "Access restricted to Hungary";
       }

jarrs-system/jarr-dev.yaml

@@ -532,7 +532,7 @@ spec:
                   number: 3000
   tls:
     - hosts:
-        - dev-local.jarrs.eu
+        - dev.jarrs.eu
       secretName: dev-jarr-tls
 ---
 # =============================================================================

mon-system/monitoring.yaml

@@ -730,7 +730,7 @@ spec:
       hostPID: true
       containers:
         - name: node-exporter
-          image: prom/node-exporter:v1.10.2
+          image: prom/node-exporter:v1.11.1
           args:
             - "--path.procfs=/host/proc"
             - "--path.sysfs=/host/sys"

privatebin-system/privatebin.yaml

@@ -169,7 +169,7 @@ spec:
         fsGroup: 82
       containers:
         - name: privatebin
-          image: privatebin/nginx-fpm-alpine:2.0.3
+          image: privatebin/nginx-fpm-alpine:2.0.4
           imagePullPolicy: IfNotPresent
           ports:
             - name: http

wanderer-system/wanderer.yaml

@@ -122,7 +122,7 @@ spec:
     spec:
       containers:
         - name: pocketbase
-          image: flomp/wanderer-db:v0.18.4
+          image: flomp/wanderer-db:v0.19.1
           env:
             - name: ORIGIN
               value: "https://wanderer.dooplex.hu"
@@ -192,7 +192,7 @@ spec:
     spec:
       containers:
         - name: wanderer-web
-          image: flomp/wanderer-web:v0.18.4
+          image: flomp/wanderer-web:v0.19.1
           env:
             - name: NODE_TLS_REJECT_UNAUTHORIZED
               value: "0"

workout-system/sparkyfitness.yaml

@@ -34,6 +34,14 @@
 # table ownership, and installs uuid-ossp/pgcrypto/pg_stat_statements on its
 # own — no init SQL or shared_preload_libraries tinkering needed.
 # ----------------------------------------------------------------------------
+---
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: workout-system
+  labels:
+    app.kubernetes.io/name: sparkyfitness
+---
 apiVersion: apps/v1
 kind: Deployment
 metadata:

workout-system/workout.yaml

@@ -1,556 +0,0 @@
-# ============================================================================
-# *** PARKED 2026-05-27 *** — wger has been REPLACED by SparkyFitness.
-# SparkyFitness now owns workout.dooplex.hu / workout.home (see sparkyfitness.yaml).
-# All wger Deployments are scaled to 0 and both wger Ingresses were removed
-# (ArgoCD prune deletes them, freeing the hostnames). The wger Services,
-# ConfigMap, PVCs (wger-media / wger-static) and the wger DB in the shared CNPG
-# cluster are KEPT, untouched, for rollback.
-# To revive wger: restore the two Ingress resources from git history and scale
-# the wger / wger-redis / wger-celery-* Deployments back to 1.
-# ============================================================================
-# wger - Workout Manager
-# https://github.com/wger-project/wger
-# Version: 2.5 (official image, no custom fork)
-# Domain: workout.dooplex.hu
-# Auth: Authentik Forward Auth (domain mode) + native wger AUTH_PROXY middleware
-#
-# ============================================================================
-# MIGRATION NOTES (from 2.3 + custom OIDC fork):
-# - Image switched from ghcr.io/kisfenyo/wger-oidc:latest -> wger/server:2.5
-# - All OIDC_* / ENABLE_OIDC env vars removed
-# - Native AUTH_PROXY_* env vars added (wger 2.4+ feature, PR #1859)
-# - Ingress split into two resources:
-#     * wger        -> path /       -> protected by Authentik forward-auth
-#     * wger-api    -> path /api/   -> unprotected (JWT auth for mobile app)
-# - nginx sidecar: strips client-supplied X-Authentik-* on /api/ (defense in depth)
-# - Authentik: create a new Proxy Provider (Forward auth, single application)
-#     External Host: https://workout.dooplex.hu
-#     Attach to existing outpost. The old OIDC provider can be deleted.
-#
-# POST-UPGRADE COMMANDS (run once after rollout stabilises):
-#   kubectl exec -n workout-system deploy/wger -c wger -- \
-#     python manage.py recalculate_statistics --all --active-only
-#   kubectl exec -n workout-system deploy/wger -c wger -- \
-#     python manage.py evaluate_trophies --all
-# ============================================================================
----
-apiVersion: v1
-kind: Namespace
-metadata:
-  name: workout-system
-  labels:
-    app.kubernetes.io/name: wger
----
-apiVersion: apps/v1
-kind: Deployment
-metadata:
-  name: wger-redis
-  namespace: workout-system
-  labels:
-    app.kubernetes.io/instance: wger
-    app.kubernetes.io/name: wger-redis
-spec:
-  replicas: 0  # parked 2026-05-27 (replaced by SparkyFitness)
-  selector:
-    matchLabels:
-      app.kubernetes.io/instance: wger
-      app.kubernetes.io/name: wger-redis
-  template:
-    metadata:
-      labels:
-        app.kubernetes.io/instance: wger
-        app.kubernetes.io/name: wger-redis
-    spec:
-      containers:
-        - name: redis
-          image: redis:7.2-alpine
-          ports:
-            - containerPort: 6379
-              name: redis
-          resources:
-            requests:
-              cpu: 50m
-              memory: 64Mi
-            limits:
-              cpu: 200m
-              memory: 128Mi
----
-apiVersion: apps/v1
-kind: Deployment
-metadata:
-  name: wger
-  namespace: workout-system
-  labels:
-    app.kubernetes.io/instance: wger
-    app.kubernetes.io/name: wger
-  annotations:
-    # Track upstream wger releases
-    extensions.v1alpha1.version-checker.io/wger: "true"
-    extensions.v1alpha1.version-checker.io/wger.match-regex: "^\\d+\\.\\d+$"
-spec:
-  replicas: 0  # parked 2026-05-27 (replaced by SparkyFitness)
-  selector:
-    matchLabels:
-      app.kubernetes.io/instance: wger
-      app.kubernetes.io/name: wger
-  strategy:
-    type: Recreate
-  template:
-    metadata:
-      labels:
-        app.kubernetes.io/instance: wger
-        app.kubernetes.io/name: wger
-    spec:
-      # Prevent k8s from injecting WGER_PORT / WGER_SERVICE_* env vars
-      # from the wger Service — they collide with wger's own $WGER_PORT
-      # config and break the startup script (URI instead of port number).
-      enableServiceLinks: false
-      securityContext:
-        fsGroup: 1000
-      containers:
-        - name: nginx
-          image: nginx:alpine
-          ports:
-            - containerPort: 80
-              name: http
-          volumeMounts:
-            - name: static
-              mountPath: /home/wger/static
-              readOnly: true
-            - name: media
-              mountPath: /home/wger/media
-              readOnly: true
-            - name: nginx-config
-              mountPath: /etc/nginx/conf.d/default.conf
-              subPath: nginx.conf
-        - name: wger
-          image: wger/server:2.5
-          imagePullPolicy: IfNotPresent
-          env:
-            # Django settings
-            - name: SECRET_KEY
-              valueFrom:
-                secretKeyRef:
-                  name: wger-app
-                  key: secret-key
-            - name: SIGNING_KEY
-              valueFrom:
-                secretKeyRef:
-                  name: wger-app
-                  key: signing-key
-            - name: DJANGO_DEBUG
-              value: "False"
-            - name: WGER_INSTANCE
-              value: "https://workout.dooplex.hu"
-            - name: TIME_ZONE
-              value: "Europe/Budapest"
-            - name: DJANGO_CACHE_TIMEOUT
-              value: "120"
-            - name: CSRF_TRUSTED_ORIGINS
-              value: "https://workout.dooplex.hu"
-            # Database (shared CNPG)
-            - name: DJANGO_DB_ENGINE
-              value: "django.db.backends.postgresql"
-            - name: DJANGO_DB_HOST
-              value: "postgresql-rw.database-system.svc.cluster.local"
-            - name: DJANGO_DB_PORT
-              value: "5432"
-            - name: DJANGO_DB_DATABASE
-              value: "wger"
-            - name: DJANGO_DB_USER
-              valueFrom:
-                secretKeyRef:
-                  name: wger-db
-                  key: username
-            - name: DJANGO_DB_PASSWORD
-              valueFrom:
-                secretKeyRef:
-                  name: wger-db
-                  key: password
-            # Cache
-            - name: DJANGO_CACHE_BACKEND
-              value: "django_redis.cache.RedisCache"
-            - name: DJANGO_CACHE_LOCATION
-              value: "redis://wger-redis:6379/1"
-            - name: DJANGO_CACHE_CLIENT_CLASS
-              value: "django_redis.client.DefaultClient"
-            # Celery
-            - name: CELERY_BROKER
-              value: "redis://wger-redis:6379/2"
-            - name: CELERY_BACKEND
-              value: "redis://wger-redis:6379/2"
-            # ----------------------------------------------------------------
-            # Native Authentication Proxy (wger 2.4+) - replaces OIDC fork
-            # ----------------------------------------------------------------
-            - name: AUTH_PROXY_ENABLED
-              value: "True"
-            # Django META key format: HTTP_ + uppercase header with - replaced by _
-            # So X-Authentik-Username => HTTP_X_AUTHENTIK_USERNAME
-            - name: AUTH_PROXY_HEADER
-              value: "HTTP_X_AUTHENTIK_USERNAME"
-            - name: AUTH_PROXY_CREATE_UNKNOWN_USER
-              value: "True"
-            - name: AUTH_PROXY_EMAIL_HEADER
-              value: "HTTP_X_AUTHENTIK_EMAIL"
-            - name: AUTH_PROXY_NAME_HEADER
-              value: "HTTP_X_AUTHENTIK_NAME"
-            # Only trust the auth header when coming from the nginx sidecar
-            # (same pod, proxies from 127.0.0.1 to Django on :8000).
-            # This prevents header-spoofing attacks from anywhere else.
-            - name: AUTH_PROXY_TRUSTED_IPS
-              value: "127.0.0.1/32"
-            # Email (disabled - no email sending)
-            - name: ENABLE_EMAIL
-              value: "False"
-            # Media settings
-            - name: DJANGO_MEDIA_ROOT
-              value: "/home/wger/media"
-            - name: DJANGO_STATIC_ROOT
-              value: "/home/wger/static"
-            # Features
-            - name: ALLOW_REGISTRATION
-              value: "False"
-            - name: ALLOW_GUEST_USERS
-              value: "False"
-            - name: ALLOW_UPLOAD_VIDEOS
-              value: "True"
-            - name: USE_RECAPTCHA
-              value: "False"
-            - name: DOWNLOAD_EXERCISE_IMAGES_ON_STARTUP
-              value: "True"
-          ports:
-            - containerPort: 8000
-              name: http
-          resources:
-            requests:
-              cpu: 100m
-              memory: 256Mi
-            limits:
-              cpu: 1000m
-              memory: 1Gi
-          volumeMounts:
-            - name: media
-              mountPath: /home/wger/media
-            - name: static
-              mountPath: /home/wger/static
-          livenessProbe:
-            httpGet:
-              path: /
-              port: http
-            initialDelaySeconds: 120
-            periodSeconds: 30
-          readinessProbe:
-            httpGet:
-              path: /
-              port: http
-            initialDelaySeconds: 60
-            periodSeconds: 10
-      volumes:
-        - name: nginx-config
-          configMap:
-            name: wger-nginx-config
-        - name: media
-          persistentVolumeClaim:
-            claimName: wger-media
-        - name: static
-          persistentVolumeClaim:
-            claimName: wger-static
----
-# Celery worker for background tasks
-apiVersion: apps/v1
-kind: Deployment
-metadata:
-  name: wger-celery-worker
-  namespace: workout-system
-  labels:
-    app.kubernetes.io/instance: wger
-    app.kubernetes.io/name: wger-celery-worker
-spec:
-  replicas: 0  # parked 2026-05-27 (replaced by SparkyFitness)
-  selector:
-    matchLabels:
-      app.kubernetes.io/instance: wger
-      app.kubernetes.io/name: wger-celery-worker
-  template:
-    metadata:
-      labels:
-        app.kubernetes.io/instance: wger
-        app.kubernetes.io/name: wger-celery-worker
-    spec:
-      enableServiceLinks: false
-      securityContext:
-        fsGroup: 1000
-      containers:
-        - name: celery-worker
-          image: wger/server:2.5
-          imagePullPolicy: IfNotPresent
-          command: ["/start-worker"]
-          env:
-            - name: SECRET_KEY
-              valueFrom:
-                secretKeyRef:
-                  name: wger-app
-                  key: secret-key
-            - name: SIGNING_KEY
-              valueFrom:
-                secretKeyRef:
-                  name: wger-app
-                  key: signing-key
-            - name: TIME_ZONE
-              value: "Europe/Budapest"
-            - name: DJANGO_DB_ENGINE
-              value: "django.db.backends.postgresql"
-            - name: DJANGO_DB_HOST
-              value: "postgresql-rw.database-system.svc.cluster.local"
-            - name: DJANGO_DB_PORT
-              value: "5432"
-            - name: DJANGO_DB_DATABASE
-              value: "wger"
-            - name: DJANGO_DB_USER
-              valueFrom:
-                secretKeyRef:
-                  name: wger-db
-                  key: username
-            - name: DJANGO_DB_PASSWORD
-              valueFrom:
-                secretKeyRef:
-                  name: wger-db
-                  key: password
-            - name: DJANGO_CACHE_TIMEOUT
-              value: "120"
-            - name: DJANGO_CACHE_CLIENT_CLASS
-              value: "django_redis.client.DefaultClient"
-            - name: CELERY_BROKER
-              value: "redis://wger-redis:6379/2"
-            - name: CELERY_BACKEND
-              value: "redis://wger-redis:6379/2"
-            - name: DJANGO_CACHE_BACKEND
-              value: "django_redis.cache.RedisCache"
-            - name: DJANGO_CACHE_LOCATION
-              value: "redis://wger-redis:6379/1"
-          resources:
-            requests:
-              cpu: 50m
-              memory: 128Mi
-            limits:
-              cpu: 500m
-              memory: 512Mi
----
-# Celery beat for scheduled tasks
-apiVersion: apps/v1
-kind: Deployment
-metadata:
-  name: wger-celery-beat
-  namespace: workout-system
-  labels:
-    app.kubernetes.io/instance: wger
-    app.kubernetes.io/name: wger-celery-beat
-spec:
-  replicas: 0  # parked 2026-05-27 (replaced by SparkyFitness)
-  selector:
-    matchLabels:
-      app.kubernetes.io/instance: wger
-      app.kubernetes.io/name: wger-celery-beat
-  template:
-    metadata:
-      labels:
-        app.kubernetes.io/instance: wger
-        app.kubernetes.io/name: wger-celery-beat
-    spec:
-      enableServiceLinks: false
-      securityContext:
-        fsGroup: 1000
-      containers:
-        - name: celery-beat
-          image: wger/server:2.5
-          imagePullPolicy: IfNotPresent
-          command: ["/start-beat"]
-          env:
-            - name: SECRET_KEY
-              valueFrom:
-                secretKeyRef:
-                  name: wger-app
-                  key: secret-key
-            - name: SIGNING_KEY
-              valueFrom:
-                secretKeyRef:
-                  name: wger-app
-                  key: signing-key
-            - name: TIME_ZONE
-              value: "Europe/Budapest"
-            - name: DJANGO_CACHE_TIMEOUT
-              value: "120"
-            - name: DJANGO_CACHE_CLIENT_CLASS
-              value: "django_redis.client.DefaultClient"
-            - name: DJANGO_DB_ENGINE
-              value: "django.db.backends.postgresql"
-            - name: DJANGO_DB_HOST
-              value: "postgresql-rw.database-system.svc.cluster.local"
-            - name: DJANGO_DB_PORT
-              value: "5432"
-            - name: DJANGO_DB_DATABASE
-              value: "wger"
-            - name: DJANGO_DB_USER
-              valueFrom:
-                secretKeyRef:
-                  name: wger-db
-                  key: username
-            - name: DJANGO_DB_PASSWORD
-              valueFrom:
-                secretKeyRef:
-                  name: wger-db
-                  key: password
-            - name: CELERY_BROKER
-              value: "redis://wger-redis:6379/2"
-            - name: CELERY_BACKEND
-              value: "redis://wger-redis:6379/2"
-          resources:
-            requests:
-              cpu: 50m
-              memory: 64Mi
-            limits:
-              cpu: 200m
-              memory: 256Mi
----
-apiVersion: v1
-kind: Service
-metadata:
-  name: wger-redis
-  namespace: workout-system
-  labels:
-    app.kubernetes.io/instance: wger
-    app.kubernetes.io/name: wger-redis
-spec:
-  type: ClusterIP
-  ports:
-    - name: redis
-      port: 6379
-      targetPort: redis
-  selector:
-    app.kubernetes.io/instance: wger
-    app.kubernetes.io/name: wger-redis
----
-apiVersion: v1
-kind: Service
-metadata:
-  name: wger
-  namespace: workout-system
-  labels:
-    app.kubernetes.io/instance: wger
-    app.kubernetes.io/name: wger
-spec:
-  type: ClusterIP
-  ports:
-    - name: http
-      port: 80
-      targetPort: 80
-  selector:
-    app.kubernetes.io/instance: wger
-    app.kubernetes.io/name: wger
----
-# ============================================================================
-# wger Ingresses (wger + wger-api) REMOVED 2026-05-27 — see PARKED note at top.
-# SparkyFitness's ingress (sparkyfitness.yaml) now serves workout.dooplex.hu /
-# workout.home. ArgoCD prune deletes the old Ingress objects from the cluster,
-# releasing the hostnames + the wger-tls certificate's hosts.
-# To revive wger: restore these two Ingress resources from git history.
-# ============================================================================
----
-apiVersion: v1
-kind: PersistentVolumeClaim
-metadata:
-  name: wger-media
-  namespace: workout-system
-  labels:
-    app.kubernetes.io/instance: wger
-    app.kubernetes.io/name: wger-media
-    recurring-job-group.longhorn.io/needbackup: enabled
-    recurring-job.longhorn.io/source: enabled
-spec:
-  accessModes:
-    - ReadWriteOnce
-  storageClassName: longhorn
-  resources:
-    requests:
-      storage: 5Gi
----
-apiVersion: v1
-kind: PersistentVolumeClaim
-metadata:
-  name: wger-static
-  namespace: workout-system
-  labels:
-    app.kubernetes.io/instance: wger
-    app.kubernetes.io/name: wger-static
-spec:
-  accessModes:
-    - ReadWriteOnce
-  storageClassName: longhorn
-  resources:
-    requests:
-      storage: 2Gi
----
-apiVersion: v1
-kind: ConfigMap
-metadata:
-  name: wger-nginx-config
-  namespace: workout-system
-data:
-  nginx.conf: |
-    server {
-      listen 80;
-      server_name _;
-      client_max_body_size 4G;
-
-      # Official Wger Logic
-      root /var/www/html/; # This is just a dummy root, aliases do the work
-
-      location /static/ {
-        alias /home/wger/static/;
-        expires 30d;
-        access_log off;
-      }
-
-      location /media/ {
-        alias /home/wger/media/;
-        expires 30d;
-        access_log off;
-      }
-
-      # API path: strip any client-supplied auth headers before proxying.
-      # Mobile app + API clients authenticate via JWT (/api/v2/token), not
-      # proxy auth. This is a defense-in-depth measure so that even if traffic
-      # somehow reaches this sidecar without going through the forward-auth
-      # ingress, it cannot forge an AUTH_PROXY login via a spoofed header.
-      # Nginx treats "" as "do not forward this header."
-      location /api/ {
-        proxy_pass http://localhost:8000;
-        proxy_set_header Host $http_host;
-        proxy_set_header X-Real-IP $remote_addr;
-        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
-        proxy_set_header X-Forwarded-Proto $http_x_forwarded_proto;
-        proxy_set_header X-Authentik-Username "";
-        proxy_set_header X-Authentik-Email "";
-        proxy_set_header X-Authentik-Name "";
-        proxy_set_header X-Authentik-Groups "";
-        proxy_set_header X-Authentik-Uid "";
-      }
-
-      # Everything else: pass through the auth headers set by the
-      # forward-auth ingress so wger's AUTH_PROXY middleware can log the
-      # user in. $http_x_authentik_username expands to empty if the header
-      # isn't present (e.g. Tailscale admin access bypassing the ingress).
-      location / {
-        proxy_pass http://localhost:8000;
-        proxy_set_header Host $http_host;
-        proxy_set_header X-Real-IP $remote_addr;
-        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
-        proxy_set_header X-Forwarded-Proto $http_x_forwarded_proto;
-        proxy_set_header X-Authentik-Username $http_x_authentik_username;
-        proxy_set_header X-Authentik-Email $http_x_authentik_email;
-        proxy_set_header X-Authentik-Name $http_x_authentik_name;
-        proxy_set_header X-Authentik-Groups $http_x_authentik_groups;
-        proxy_set_header X-Authentik-Uid $http_x_authentik_uid;
-      }
-    }
----