wip

2026-06-12 17:21:31 +02:00
27 changed files with 213 additions and 127 deletions
--- a/.forgejo/workflows/ci.yaml
+++ b/.forgejo/workflows/ci.yaml
@ -7,7 +7,7 @@ jobs:
  pre-commit:
    runs-on: ubuntu-22.04
    steps:
-      - uses: https://code.forgejo.org/actions/checkout@v7
+      - uses: https://code.forgejo.org/actions/checkout@v6
      - uses: https://code.forgejo.org/actions/setup-python@v6
        with:
          python-version: '3.10'
@ -19,7 +19,7 @@ jobs:
  k8s:
    runs-on: ubuntu-22.04
    steps:
-      - uses: https://code.forgejo.org/actions/checkout@v7
+      - uses: https://code.forgejo.org/actions/checkout@v6
      - name: Set up Kubeconform
        uses: bmuschko/setup-kubeconform@v1

@ -30,7 +30,7 @@ jobs:
  tflint:
    runs-on: ubuntu-22.04
    steps:
-      - uses: https://code.forgejo.org/actions/checkout@v7
+      - uses: https://code.forgejo.org/actions/checkout@v6
      - uses: terraform-linters/setup-tflint@v6
        name: Setup TFLint
        with:
--- a/.forgejo/workflows/deploy-tofu.yaml
+++ b/.forgejo/workflows/deploy-tofu.yaml
@ -10,7 +10,7 @@ jobs:
  authentik:
    runs-on: ubuntu-22.04
    steps:
-      - uses: https://code.forgejo.org/actions/checkout@v7
+      - uses: https://code.forgejo.org/actions/checkout@v6
      - uses: opentofu/setup-opentofu@v2
        with:
          tofu_version: 1.8.1
@ -40,7 +40,7 @@ jobs:
  adguard:
    runs-on: ubuntu-22.04
    steps:
-      - uses: https://code.forgejo.org/actions/checkout@v7
+      - uses: https://code.forgejo.org/actions/checkout@v6
      - uses: opentofu/setup-opentofu@v2
        with:
          tofu_version: 1.7.0
--- a/.gitignore
+++ b/.gitignore
@ -15,3 +15,4 @@ terraform.rc
 secrets.yaml
 .env
 *~
+data/
--- a/docker/ganymede/docker-compose.yml
+++ b/docker/ganymede/docker-compose.yml
@ -0,0 +1,48 @@
+---
+services:
+  ganymede:
+    container_name: ganymede
+    image: ghcr.io/zibbp/ganymede:4.17.0
+    restart: unless-stopped
+    environment:
+      DEBUG: ${GANYMEDE_DEBUG:-false}
+      TZ: ${GANYMEDE_TZ:-Europe/Madrid}
+      VIDEOS_DIR: ${GANYMEDE_VIDEOS_DIR:-/data/videos}
+      TEMP_DIR: ${GANYMEDE_TEMP_DIR:-/data/temp}
+      LOGS_DIR: ${GANYMEDE_LOGS_DIR:-/data/logs}
+      CONFIG_DIR: ${GANYMEDE_CONFIG_DIR:-/data/config}
+      DB_HOST: ${GANYMEDE_DB_HOST:-192.168.1.3}
+      DB_PORT: ${GANYMEDE_DB_PORT:-5432}
+      DB_USER: ${GANYMEDE_DB_USER:-ganymede}
+      DB_PASS: ${GANYMEDE_DB_PASS}
+      DB_NAME: ${GANYMEDE_DB_NAME:-ganymede}
+      DB_SSL: ${GANYMEDE_DB_SSL:-disable}
+      TWITCH_CLIENT_ID: ${GANYMEDE_TWITCH_CLIENT_ID}
+      TWITCH_CLIENT_SECRET: ${GANYMEDE_TWITCH_CLIENT_SECRET}
+      MAX_CHAT_DOWNLOAD_EXECUTIONS: ${GANYMEDE_MAX_CHAT_DOWNLOAD_EXECUTIONS:-3}
+      MAX_CHAT_RENDER_EXECUTIONS: ${GANYMEDE_MAX_CHAT_RENDER_EXECUTIONS:-2}
+      MAX_VIDEO_DOWNLOAD_EXECUTIONS: ${GANYMEDE_MAX_VIDEO_DOWNLOAD_EXECUTIONS:-2}
+      MAX_VIDEO_CONVERT_EXECUTIONS: ${GANYMEDE_MAX_VIDEO_CONVERT_EXECUTIONS:-3}
+      MAX_VIDEO_SPRITE_THUMBNAIL_EXECUTIONS: ${GANYMEDE_MAX_VIDEO_SPRITE_THUMBNAIL_EXECUTIONS:-2}
+      OAUTH_ENABLED: ${GANYMEDE_OAUTH_ENABLED:-true}
+      OAUTH_PROVIDER_URL: ${GANYMEDE_OAUTH_PROVIDER_URL:-https://auth.fukurokuju.dev/application/o/ganymede/}
+      OAUTH_CLIENT_ID: ${GANYMEDE_OAUTH_CLIENT_ID}
+      OAUTH_CLIENT_SECRET: ${GANYMEDE_OAUTH_CLIENT_SECRET}
+      OAUTH_REDIRECT_URL: ${GANYMEDE_OAUTH_REDIRECT_URL:-https://vods.roboces.dev/api/v1/auth/oauth/callback}
+      SHOW_SSO_LOGIN_BUTTON: ${GANYMEDE_SHOW_SSO_LOGIN_BUTTON:-true}
+      FORCE_SSO_AUTH: ${GANYMEDE_FORCE_SSO_AUTH:-true}
+      REQUIRE_LOGIN: ${GANYMEDE_REQUIRE_LOGIN:-true}
+    volumes:
+      - ${GANYMEDE_VIDEOS:-/mnt/vods/ganymede/videos}:/data/videos
+      - ${GANYMEDE_TEMP:-/mnt/vods/ganymede/temp}:/data/temp
+      - ${GANYMEDE_CACHE:-/mnt/vods/ganymede/cache}:/data/.cache
+      - ${GANYMEDE_LOGS:-/mnt/vods/ganymede/logs}:/data/logs
+      - ${GANYMEDE_CONFIG:-/mnt/vods/ganymede/config}:/data/config
+    ports:
+      - "4800:4000"
+    healthcheck:
+      test: curl --fail http://localhost:4000/health || exit 1
+      interval: 60s
+      retries: 5
+      start_period: 60s
+      timeout: 10s
--- a/docker/ganymede/sample.env
+++ b/docker/ganymede/sample.env
@ -0,0 +1,27 @@
+GANYMEDE_DEBUG=false
+GANYMEDE_TZ=Europe/Madrid
+GANYMEDE_VIDEOS_DIR=/data/videos
+GANYMEDE_TEMP_DIR=/data/temp
+GANYMEDE_LOGS_DIR=/data/logs
+GANYMEDE_CONFIG_DIR=/data/config
+GANYMEDE_DB_HOST=192.168.1.3
+GANYMEDE_DB_PORT=5432
+GANYMEDE_DB_USER=ganymede
+GANYMEDE_DB_PASS=
+GANYMEDE_DB_NAME=ganymede
+GANYMEDE_DB_SSL=disable
+GANYMEDE_TWITCH_CLIENT_ID=
+GANYMEDE_TWITCH_CLIENT_SECRET=
+GANYMEDE_MAX_CHAT_DOWNLOAD_EXECUTIONS=3
+GANYMEDE_MAX_CHAT_RENDER_EXECUTIONS=2
+GANYMEDE_MAX_VIDEO_DOWNLOAD_EXECUTIONS=2
+GANYMEDE_MAX_VIDEO_CONVERT_EXECUTIONS=3
+GANYMEDE_MAX_VIDEO_SPRITE_THUMBNAIL_EXECUTIONS=2
+GANYMEDE_OAUTH_ENABLED=true
+GANYMEDE_OAUTH_PROVIDER_URL=https://auth.fukurokuju.dev/application/o/ganymede/
+GANYMEDE_OAUTH_CLIENT_ID=
+GANYMEDE_OAUTH_CLIENT_SECRET=
+GANYMEDE_OAUTH_REDIRECT_URL=https://vods.roboces.dev/api/v1/auth/oauth/callback
+GANYMEDE_SHOW_SSO_LOGIN_BUTTON=true
+GANYMEDE_FORCE_SSO_AUTH=false
+GANYMEDE_REQUIRE_LOGIN=false
--- a/docker/immich/docker-compose.yml
+++ b/docker/immich/docker-compose.yml
@ -1,34 +0,0 @@
---
-
-name: immich
-
-services:
-  immich-server:
-    container_name: immich_server
-    image: ghcr.io/immich-app/immich-server:v3.0.1
-    restart: unless-stopped
-    volumes:
-      - ${IMMICH_UPLOAD_LOCATION:-/mnt/nas1/shared/immich}:/data
-    environment:
-      TZ: ${IMMICH_TZ:-Europe/Madrid}
-      DB_HOSTNAME: ${IMMICH_DB_HOSTNAME}
-      DB_PORT: ${IMMICH_DB_PORT}
-      DB_USERNAME: ${IMMICH_DB_USERNAME}
-      DB_PASSWORD: ${IMMICH_DB_PASSWORD}
-      DB_DATABASE_NAME: ${IMMICH_DB_DATABASE_NAME}
-      REDIS_HOSTNAME: ${IMMICH_REDIS_HOSTNAME}
-      REDIS_PORT: ${IMMICH_REDIS_PORT}
-      REDIS_USERNAME: ${IMMICH_REDIS_USERNAME}
-      REDIS_PASSWORD: ${IMMICH_REDIS_PASSWORD}
-      REDIS_DBINDEX: ${IMMICH_REDIS_DBINDEX}
-    ports:
-      - '2283:2283'
-
-  immich-machine-learning:
-    container_name: immich_machine_learning
-    image: ghcr.io/immich-app/immich-machine-learning:v3.0.1
-    ports:
-      - "3003:3003"
-    volumes:
-      - ${IMMICH_ML_MODEL_CACHE_LOCATION:-/mnt/nas1/shared/immich-model-cache}:/cache
-    restart: unless-stopped
--- a/docker/immich/sample.env
+++ b/docker/immich/sample.env
@ -1,16 +0,0 @@
-IMMICH_UPLOAD_LOCATION=/mnt/nas1/shared/immich
-IMMICH_TZ=Europe/Madrid
-
-IMMICH_DB_HOSTNAME=192.168.1.3
-IMMICH_DB_PORT=55432
-IMMICH_DB_USERNAME=
-IMMICH_DB_PASSWORD=
-IMMICH_DB_DATABASE_NAME=
-
-IMMICH_REDIS_HOSTNAME=192.168.1.3
-IMMICH_REDIS_PORT=300036
-IMMICH_REDIS_USERNAME=
-IMMICH_REDIS_PASSWORD=
-IMMICH_REDIS_DBINDEX=
-
-IMMICH_ML_MODEL_CACHE_LOCATION=/mnt/nas1/shared/immich-model-cache
--- a/docker/pgproxy/README.md
+++ b/docker/pgproxy/README.md
@ -0,0 +1,3 @@
+# pgproxy
+
+- [stolen from here](https://github.com/rafitox/pgproxy_tailscale)
--- a/docker/pgproxy/docker-compose.yml
+++ b/docker/pgproxy/docker-compose.yml
@ -0,0 +1,56 @@
+---
+services:
+  postgres:
+    image: postgres:18.0-alpine
+    container_name: postgres
+    environment:
+      POSTGRES_USER: ${PGPROXY_POSTGRES_USER}
+      POSTGRES_PASSWORD: ${PGPROXY_POSTGRES_PASSWORD}
+    networks:
+      - pgnet
+    dns:
+      - 9.9.9.9
+    volumes:
+      - ./data/pgdata:/var/lib/postgresql/data
+      - ./data/certs/server.crt:/var/lib/postgresql/server.crt:ro
+      - ./data/certs/server.key:/var/lib/postgresql/server.key:ro
+    command:
+      [
+        "-c", "ssl=off",
+        "-c", "ssl_cert_file=/var/lib/postgresql/server.crt",
+        "-c", "ssl_key_file=/var/lib/postgresql/server.key"
+      ]
+
+  pgproxy:
+    image: rafaelribeiro96/pgproxy:1.82.5
+    command:
+      [
+        "--hostname", "pgproxy-node",
+        "--upstream-addr", "postgres:5432",
+        "--port", "5432",
+        "--upstream-ca-file", "/certs/ca.pem",
+        "--state-dir", "/var/lib/pgproxy",
+      ]
+    container_name: pgproxy
+    restart: unless-stopped
+    environment:
+      PGHOST: postgres
+      PGPORT: "5432"
+      PGUSER: ${PGPROXY_POSTGRES_USER}
+      PGPASSWORD: ${PGPROXY_POSTGRES_PASSWORD}
+      TSKEY: ${PGPROXY_TSKEY_API}
+      TS_AUTHKEY: ${PGPROXY_TSKEY_API}
+    ports:
+      - "5432:5432"
+    networks:
+      - pgnet
+    dns:
+      - 9.9.9.9
+    depends_on:
+      - postgres
+    volumes:
+      - ./data/pgproxy-state:/var/lib/pgproxy
+      - ./data/certs/ca.pem:/certs/ca.pem:ro
+networks:
+  pgnet:
+    driver: bridge
--- a/docker/pgproxy/sample.env
+++ b/docker/pgproxy/sample.env
@ -0,0 +1,3 @@
+PGPROXY_POSTGRES_USER=
+PGPROXY_POSTGRES_PASSWORD=
+PGPROXY_TSKEY_API=
--- a/docker/pluton/docker-compose.yml
+++ b/docker/pluton/docker-compose.yml
@ -1,7 +1,7 @@
 ---
 services:
  pluton:
-    image: plutonhq/pluton:0.17.1
+    image: plutonhq/pluton:0.16.6
    container_name: pluton-backup
    restart: always
    ports:
--- a/docker/tailscale/docker-compose.yml
+++ b/docker/tailscale/docker-compose.yml
@ -1,7 +1,7 @@
 ---
 services:
  tailscale:
-    image: tailscale/tailscale:v1.98.8
+    image: tailscale/tailscale:v1.98.4
    hostname: tailscale
    environment:
      TS_AUTHKEY: ${TS_AUTHKEY}
--- a/k8s/argo-apps/forgejo.yaml
+++ b/k8s/argo-apps/forgejo.yaml
@ -14,7 +14,7 @@ spec:
  sources:
    - chart: forgejo
      repoURL: code.forgejo.org/forgejo-helm
-      targetRevision: 17.1.1
+      targetRevision: 17.1.0
      helm:
        valuesObject:
          replicaCount: 1
--- a/k8s/argo-apps/huesporro.yaml
+++ b/k8s/argo-apps/huesporro.yaml
@ -15,8 +15,6 @@ spec:
      targetRevision: v0.3.7
      helm:
        valuesObject:
-          image:
-            pullPolicy: IfNotPresent
          secret:
            existingSecretName: huesoporro-secrets
          ingress:
--- a/k8s/argo-apps/kured.yaml
+++ b/k8s/argo-apps/kured.yaml
@ -13,7 +13,7 @@ spec:
    source:
        chart: kured
        repoURL: https://kubereboot.github.io/charts
-        targetRevision: 6.1.*
+        targetRevision: 5.12.*
        helm:
            valuesObject:
                configuration.rebootDays:
--- a/k8s/argo-apps/meili.yaml
+++ b/k8s/argo-apps/meili.yaml
@ -18,7 +18,7 @@ spec:
      targetRevision: main
    - chart: meilisearch
      repoURL: https://meilisearch.github.io/meilisearch-kubernetes
-      targetRevision: 0.33.*
+      targetRevision: 0.32.*
      helm:
        valuesObject:
          environment:
--- a/k8s/argo-apps/portainer.yaml
+++ b/k8s/argo-apps/portainer.yaml
@ -15,7 +15,7 @@ spec:
  sources:
    - repoURL: https://portainer.github.io/k8s/
      chart: portainer
-      targetRevision: 239.4.*
+      targetRevision: 239.3.*
      helm:
        valuesObject:
          service:
--- a/k8s/argo-apps/renovate.yaml
+++ b/k8s/argo-apps/renovate.yaml
@ -13,7 +13,7 @@ spec:
  sources:
    - chart: renovate
      repoURL: https://docs.renovatebot.com/helm-charts
-      targetRevision: 46.217.*
+      targetRevision: 46.181.*
      helm:
        valuesObject:
          renovate:
--- a/k8s/argo-apps/woodpecker.yaml
+++ b/k8s/argo-apps/woodpecker.yaml
@ -14,7 +14,7 @@ spec:
  sources:
    - chart: woodpecker
      repoURL: ghcr.io/woodpecker-ci/helm
-      targetRevision: 3.6.5
+      targetRevision: 3.6.4
      helm:
        valuesObject:
          agent:
--- a/k8s/charts/oxicloud/Chart.yaml
+++ b/k8s/charts/oxicloud/Chart.yaml
@ -5,4 +5,4 @@ description: |
  Ultra-fast, secure & lightweight self-hosted cloud storage — your files, photos, calendars & contacts, all in one place. Built in Rust.
 type: application
 version: 0.1.0
-appVersion: "0.8.2"
+appVersion: "0.6.0"
--- a/tofu/authentik/.terraform.lock.hcl
+++ b/tofu/authentik/.terraform.lock.hcl
@ -2,34 +2,34 @@
 # Manual edits may be lost in future updates.

 provider "registry.opentofu.org/goauthentik/authentik" {
-  version     = "2026.5.0"
-  constraints = "2026.5.0"
+  version     = "2026.2.0"
+  constraints = "2026.2.0"
  hashes = [
-    "h1:0uyEY3Pv2BwFGTKmKmzYjZJTNWgqR2zK9INfGh4z14U=",
-    "h1:42thcpGwbL/R3NCSQ4kCpTrACT/TkrX/RR19aTE1jNI=",
-    "h1:KeTxGgORC8K5bDyhLoQv60bV89WJhYPIoQey+BE3jCs=",
-    "h1:Rqfb/iEWvuaBai5EGcsfpkoo5cWiwfT2+uS2jq53K4A=",
-    "h1:SeznjPKBzSrgo8WasRnuxiGMDSeQHEKsv3U/xw8bhQE=",
-    "h1:V8nQUa7FpHo5eNJmt5OLfFmfEyzEbKtQJVhgQ9Hdwoc=",
-    "h1:ZxTA6F65lOQwHRUv6aGmjpMjU2nWeiZml3jlGaMYhUQ=",
-    "h1:aUAK4ogW16tyIv+CLUyIkuXMOTQXENd4DQT1COyu5o8=",
-    "h1:cyP/vmLA2galua5ItpdS+rTFpNIewwCgZGYxy0HZ5nA=",
-    "h1:db5oMNuPhgNOYZH8HgMGGJmoqaqKYkPgl4gkx4OlgSc=",
-    "h1:eKMsm5T+A4ADNRGzpcOvd78grn6VegXwSL0gIPOJ6oI=",
-    "h1:qb+bDi9md5ucsjz6UFsPBoT1Xa901ymztij6HRNoKag=",
-    "h1:ugLfV0/T5lyTCDR6NanKa42Pwrlug06QuIuWbn8KVFU=",
-    "zh:0dc1706f6fbff866f4a96de56a4934b9a277954bcdd0713549a29a9b8ec85153",
-    "zh:218417ec4e864f2d7e585d6c08d39bccb96d8f3bca16c6f762be15365e434234",
-    "zh:24f9afa7a1174316da3478811848cd76ef348d8a983310b8d75ed6f45abe1a92",
-    "zh:560092e47cb8a72b890b3eeafe1803202cd25cf27f5f5a6e2c370f645f5d86ae",
-    "zh:5bc69d8de198007ad1587e146f98cffacf0d1a571800da549b308ff5f4541474",
-    "zh:65248dce941472ad2a30d0754d2f3c2db6bb6fe5080946316fb097d6ba7cc79f",
-    "zh:79c9a59a8d3c60280e27a064668889594da44c60f940b046b7c8e63be01067d0",
-    "zh:87f26cadcd842d6e6d0af94ef0e56860557f5d07f487b10d69d38b63af68bea5",
-    "zh:8e42c9d0e77d61cc2e5f8c8b761f6e484774d93771927b4cb5fbdae41209dd33",
-    "zh:94ff632b9b4841527c6b652d51a850a8a47c84c0308a3efc189e0ff7e2558f87",
-    "zh:b8d32d9f17a905b63c87a23306c02c295b7c8b70f72950071aa3086396932816",
-    "zh:c91982af99474fc2e4e69be36ed3a68847f261963ed79f6a546fc75703992f99",
-    "zh:eb9c1fd3020cf61e9b7a6a38d2965f4b521495a9928705e963459a4af857f97d",
+    "h1:/y7//ItB3vYvtDzSgrd7eY4QHGQ7b2G/rF/rtXdvUiY=",
+    "h1:2MTCDpaUJ9AAckFf+lfhq5VNkl4/e1is7XIHfjFX20U=",
+    "h1:EECfgcbT6h+ppgQ3x06iQZSheZ4vJ6NVwXGYGzyuQQ4=",
+    "h1:Hg5gBZc/mPbMwH3r5AVbDycUFoeh1LlHtAvVKsnruTY=",
+    "h1:J9+XlKbvc8x99ZV779XH0swZhsJo+Zcrh7UCK5pKQKY=",
+    "h1:On3/Zzv3W72aGsJ4AhW/tnpi4hvq9cxwgf7tF6Tg+a4=",
+    "h1:imSeB1o2GiuyBKsK6prOkOT7dQVDK42TaxGWAb+wEvg=",
+    "h1:jpOkyfrzbb/LBCdW/0R2Ag+X9bRw6X1/2BRMoImfgQ8=",
+    "h1:pT8YP3VDxKxhT1X+UXmjN78C+8NNb3fIANWNjR0xRX4=",
+    "h1:pum2uBRNDUjPeP9aYszm+6GU+K7tZIpbbLrsN39l8iw=",
+    "h1:qYcmNSTHIU6XefHE11SmywKqgp84B6n2Fzwdj/8dRN8=",
+    "h1:zH1hHNBUvxXZBzxyQa6OPjDAlZyr3rA7LqwTVVZDW9s=",
+    "h1:zacZCsqLyCstv+qE+VhFvwCIGLQEdNBsMIM7r9umUSQ=",
+    "zh:00c44e8ee842e75de9cc4fd6193b10258d1dc840e5be4aaaf118ffc180dceee0",
+    "zh:13057f08bce3b63613e1be3997dd454ff9568c569dd983987b1550280fbe3d01",
+    "zh:410a1ff2ae4647cc0ab37894f81e4d474b588a0a7f005d05d55e8c3a40978dd2",
+    "zh:43830834d12b3c0eeabe397842f82ca3a6b58a5bc8dd837d55b821419b55ed61",
+    "zh:56eaedd196ed7c4003cee0434b891b38242b4fde2031978d0ddcfdf6e16ee5ad",
+    "zh:5b3c10bb63c3c215ed9e0918e5808b240e3f2ee8248d10cd4d824a4998a213c5",
+    "zh:99c14891bcb92a6b21ef4c0e60f6c0df23e3452808f3eefd67cde78d132c80d9",
+    "zh:9a32cdda9f939f8484e27d4200d004c44f016fe97579a111201083f4beea78e8",
+    "zh:ae5086816144f68de9a0002e7696321169a71473f9d161793f4ae996388f56de",
+    "zh:bd09409dd34608a4ef3ea80cfc5e397268e7872f2e84c1ccdc9b5698e36ddad5",
+    "zh:be7af8b9eb61b0eb5053f14360e5a68caeb32c115efe8e1b583f2e7c91352a2a",
+    "zh:e11726812a1b2caf6b6784a3d074d1f50e3d406e9629c02096a001e5a5979331",
+    "zh:e39183d10d8158ccab51208f4f727c7419b1b1e596f4feb23dc42aebb36d01e3",
  ]
 }
--- a/tofu/authentik/main.tf
+++ b/tofu/authentik/main.tf
@ -8,7 +8,7 @@ terraform {
  required_providers {
    authentik = {
      source  = "goauthentik/authentik"
-      version = "2026.5.0"
+      version = "2026.2.0"
    }
  }
 }
--- a/tofu/modules/authentik-app/main.tf
+++ b/tofu/modules/authentik-app/main.tf
@ -3,7 +3,7 @@ terraform {
  required_providers {
    authentik = {
      source  = "goauthentik/authentik"
-      version = "2026.5.0"
+      version = "2026.2.0"
    }
  }
 }
--- a/tofu/modules/authentik-ldap/.terraform.lock.hcl
+++ b/tofu/modules/authentik-ldap/.terraform.lock.hcl
@ -2,34 +2,34 @@
 # Manual edits may be lost in future updates.

 provider "registry.opentofu.org/goauthentik/authentik" {
-  version     = "2026.5.0"
-  constraints = "2026.5.0"
+  version     = "2026.2.0"
+  constraints = "2026.2.0"
  hashes = [
-    "h1:0uyEY3Pv2BwFGTKmKmzYjZJTNWgqR2zK9INfGh4z14U=",
-    "h1:42thcpGwbL/R3NCSQ4kCpTrACT/TkrX/RR19aTE1jNI=",
-    "h1:KeTxGgORC8K5bDyhLoQv60bV89WJhYPIoQey+BE3jCs=",
-    "h1:Rqfb/iEWvuaBai5EGcsfpkoo5cWiwfT2+uS2jq53K4A=",
-    "h1:SeznjPKBzSrgo8WasRnuxiGMDSeQHEKsv3U/xw8bhQE=",
-    "h1:V8nQUa7FpHo5eNJmt5OLfFmfEyzEbKtQJVhgQ9Hdwoc=",
-    "h1:ZxTA6F65lOQwHRUv6aGmjpMjU2nWeiZml3jlGaMYhUQ=",
-    "h1:aUAK4ogW16tyIv+CLUyIkuXMOTQXENd4DQT1COyu5o8=",
-    "h1:cyP/vmLA2galua5ItpdS+rTFpNIewwCgZGYxy0HZ5nA=",
-    "h1:db5oMNuPhgNOYZH8HgMGGJmoqaqKYkPgl4gkx4OlgSc=",
-    "h1:eKMsm5T+A4ADNRGzpcOvd78grn6VegXwSL0gIPOJ6oI=",
-    "h1:qb+bDi9md5ucsjz6UFsPBoT1Xa901ymztij6HRNoKag=",
-    "h1:ugLfV0/T5lyTCDR6NanKa42Pwrlug06QuIuWbn8KVFU=",
-    "zh:0dc1706f6fbff866f4a96de56a4934b9a277954bcdd0713549a29a9b8ec85153",
-    "zh:218417ec4e864f2d7e585d6c08d39bccb96d8f3bca16c6f762be15365e434234",
-    "zh:24f9afa7a1174316da3478811848cd76ef348d8a983310b8d75ed6f45abe1a92",
-    "zh:560092e47cb8a72b890b3eeafe1803202cd25cf27f5f5a6e2c370f645f5d86ae",
-    "zh:5bc69d8de198007ad1587e146f98cffacf0d1a571800da549b308ff5f4541474",
-    "zh:65248dce941472ad2a30d0754d2f3c2db6bb6fe5080946316fb097d6ba7cc79f",
-    "zh:79c9a59a8d3c60280e27a064668889594da44c60f940b046b7c8e63be01067d0",
-    "zh:87f26cadcd842d6e6d0af94ef0e56860557f5d07f487b10d69d38b63af68bea5",
-    "zh:8e42c9d0e77d61cc2e5f8c8b761f6e484774d93771927b4cb5fbdae41209dd33",
-    "zh:94ff632b9b4841527c6b652d51a850a8a47c84c0308a3efc189e0ff7e2558f87",
-    "zh:b8d32d9f17a905b63c87a23306c02c295b7c8b70f72950071aa3086396932816",
-    "zh:c91982af99474fc2e4e69be36ed3a68847f261963ed79f6a546fc75703992f99",
-    "zh:eb9c1fd3020cf61e9b7a6a38d2965f4b521495a9928705e963459a4af857f97d",
+    "h1:/y7//ItB3vYvtDzSgrd7eY4QHGQ7b2G/rF/rtXdvUiY=",
+    "h1:2MTCDpaUJ9AAckFf+lfhq5VNkl4/e1is7XIHfjFX20U=",
+    "h1:EECfgcbT6h+ppgQ3x06iQZSheZ4vJ6NVwXGYGzyuQQ4=",
+    "h1:Hg5gBZc/mPbMwH3r5AVbDycUFoeh1LlHtAvVKsnruTY=",
+    "h1:J9+XlKbvc8x99ZV779XH0swZhsJo+Zcrh7UCK5pKQKY=",
+    "h1:On3/Zzv3W72aGsJ4AhW/tnpi4hvq9cxwgf7tF6Tg+a4=",
+    "h1:imSeB1o2GiuyBKsK6prOkOT7dQVDK42TaxGWAb+wEvg=",
+    "h1:jpOkyfrzbb/LBCdW/0R2Ag+X9bRw6X1/2BRMoImfgQ8=",
+    "h1:pT8YP3VDxKxhT1X+UXmjN78C+8NNb3fIANWNjR0xRX4=",
+    "h1:pum2uBRNDUjPeP9aYszm+6GU+K7tZIpbbLrsN39l8iw=",
+    "h1:qYcmNSTHIU6XefHE11SmywKqgp84B6n2Fzwdj/8dRN8=",
+    "h1:zH1hHNBUvxXZBzxyQa6OPjDAlZyr3rA7LqwTVVZDW9s=",
+    "h1:zacZCsqLyCstv+qE+VhFvwCIGLQEdNBsMIM7r9umUSQ=",
+    "zh:00c44e8ee842e75de9cc4fd6193b10258d1dc840e5be4aaaf118ffc180dceee0",
+    "zh:13057f08bce3b63613e1be3997dd454ff9568c569dd983987b1550280fbe3d01",
+    "zh:410a1ff2ae4647cc0ab37894f81e4d474b588a0a7f005d05d55e8c3a40978dd2",
+    "zh:43830834d12b3c0eeabe397842f82ca3a6b58a5bc8dd837d55b821419b55ed61",
+    "zh:56eaedd196ed7c4003cee0434b891b38242b4fde2031978d0ddcfdf6e16ee5ad",
+    "zh:5b3c10bb63c3c215ed9e0918e5808b240e3f2ee8248d10cd4d824a4998a213c5",
+    "zh:99c14891bcb92a6b21ef4c0e60f6c0df23e3452808f3eefd67cde78d132c80d9",
+    "zh:9a32cdda9f939f8484e27d4200d004c44f016fe97579a111201083f4beea78e8",
+    "zh:ae5086816144f68de9a0002e7696321169a71473f9d161793f4ae996388f56de",
+    "zh:bd09409dd34608a4ef3ea80cfc5e397268e7872f2e84c1ccdc9b5698e36ddad5",
+    "zh:be7af8b9eb61b0eb5053f14360e5a68caeb32c115efe8e1b583f2e7c91352a2a",
+    "zh:e11726812a1b2caf6b6784a3d074d1f50e3d406e9629c02096a001e5a5979331",
+    "zh:e39183d10d8158ccab51208f4f727c7419b1b1e596f4feb23dc42aebb36d01e3",
  ]
 }
--- a/tofu/modules/authentik-ldap/main.tf
+++ b/tofu/modules/authentik-ldap/main.tf
@ -3,7 +3,7 @@ terraform {
  required_providers {
    authentik = {
      source  = "goauthentik/authentik"
-      version = "2026.5.0"
+      version = "2026.2.0"
    }
  }
 }
--- a/tofu/modules/authentik-oidc/main.tf
+++ b/tofu/modules/authentik-oidc/main.tf
@ -3,7 +3,7 @@ terraform {
  required_providers {
    authentik = {
      source  = "goauthentik/authentik"
-      version = "2026.5.0"
+      version = "2026.2.0"
    }
  }
 }
--- a/tofu/modules/authentik-proxy/main.tf
+++ b/tofu/modules/authentik-proxy/main.tf
@ -3,7 +3,7 @@ terraform {
  required_providers {
    authentik = {
      source  = "goauthentik/authentik"
-      version = "2026.5.0"
+      version = "2026.2.0"
    }
  }
 }