Fix immich fsGroup, keila tz autoupdate, revert open-webui

- immich: add fsGroup: 1000 so init container can write to PVC
- keila: set TZ_AUTOUPDATE=disabled to prevent tz library crash
  on read-only /opt/app/lib path in v0.30.3
- open-webui: revert to v0.9.5 — v0.12.x migration crashes on
  existing DB (duplicate column name: info_json)

discourse/app.yaml

@@ -3,4 +3,4 @@ is: discourse
 description: Discourse is a modern, open-source discussion platform designed for online communities and forums.
 category: community
 icon: https://cdn.jsdelivr.net/gh/homarr-labs/dashboard-icons/svg/discourse.svg
-latest: "2026"
+latest: "3"

gitea/versions/28/deployment.yaml

@@ -27,7 +27,7 @@ spec:
       terminationGracePeriodSeconds: 60
       containers:
         - name: gitea
-          image: "gitea/gitea:28.2.0"
+          image: "gitea/gitea:28.2.0-rootless"
           imagePullPolicy: IfNotPresent
           envFrom:
             - configMapRef:

immich/versions/3/deployment-microservices.yaml

@@ -19,8 +19,21 @@ spec:
       securityContext:
         runAsNonRoot: true
         runAsUser: 1000
+        fsGroup: 1000
         seccompProfile:
           type: RuntimeDefault
+      initContainers:
+        - name: init-dirs
+          image: "ghcr.io/immich-app/immich-server:v3.3.5"
+          command: ["sh", "-c", "mkdir -p /usr/src/app/upload/thumbs /usr/src/app/upload/upload /usr/src/app/upload/backups /usr/src/app/upload/library /usr/src/app/upload/profile /usr/src/app/upload/encoded-video"]
+          securityContext:
+            allowPrivilegeEscalation: false
+            capabilities:
+              drop: [ALL]
+            readOnlyRootFilesystem: false
+          volumeMounts:
+            - mountPath: /usr/src/app/upload
+              name: immich-storage
       containers:
         - image: "ghcr.io/immich-app/immich-server:v3.3.5"
           name: immich-microservices

immich/versions/3/deployment-server.yaml

@@ -19,8 +19,21 @@ spec:
       securityContext:
         runAsNonRoot: true
         runAsUser: 1000
+        fsGroup: 1000
         seccompProfile:
           type: RuntimeDefault
+      initContainers:
+        - name: init-dirs
+          image: "ghcr.io/immich-app/immich-server:v3.3.5"
+          command: ["sh", "-c", "mkdir -p /usr/src/app/upload/thumbs /usr/src/app/upload/upload /usr/src/app/upload/backups /usr/src/app/upload/library /usr/src/app/upload/profile /usr/src/app/upload/encoded-video"]
+          securityContext:
+            allowPrivilegeEscalation: false
+            capabilities:
+              drop: [ALL]
+            readOnlyRootFilesystem: false
+          volumeMounts:
+            - mountPath: /usr/src/app/upload
+              name: immich-storage
       containers:
         - image: "ghcr.io/immich-app/immich-server:v3.3.5"
           name: immich-server

keila/versions/0/deployment.yaml

@@ -58,6 +58,8 @@ spec:
               key: smtpPassword
         - name: MAILER_SMTP_FROM_EMAIL
           value: "{{ .smtp.from }}"
+        - name: TZ_AUTOUPDATE
+          value: "disabled"
         - name: DISABLE_REGISTRATION
           value: "{{ .disableRegistration }}"
         - name: KEILA_USER

open-webui/versions/0/deployment.yaml

@@ -19,7 +19,7 @@ spec:
           type: RuntimeDefault
       containers:
       - name: open-webui
-        image: ghcr.io/open-webui/open-webui:v0.12.4
+        image: ghcr.io/open-webui/open-webui:v0.9.5
         imagePullPolicy: IfNotPresent
         securityContext:
           allowPrivilegeEscalation: false

open-webui/versions/0/manifest.yaml

@@ -1,4 +1,4 @@
-version: 0.12.4
+version: 0.9.5-5
 defaultConfig:
   namespace: open-webui
   storage: 2Gi

openproject/versions/17/manifest.yaml

@@ -17,6 +17,7 @@ defaultConfig:
     host: '{{ .apps.memcached.host }}'
     port: '{{ .apps.memcached.port }}'
 defaultSecrets:
+- key: secretKeyBase
 - key: dbPassword
 - key: adminPassword
 requiredSecrets:

openproject/versions/17/seeder-job.yaml

@@ -58,6 +58,11 @@ spec:
             - configMapRef:
                 name: openproject-memcached
           env:
+            - name: SECRET_KEY_BASE
+              valueFrom:
+                secretKeyRef:
+                  name: openproject-secrets
+                  key: secretKeyBase
             - name: OPENPROJECT_DB_PASSWORD
               valueFrom:
                 secretKeyRef:
@@ -102,6 +107,11 @@ spec:
             - configMapRef:
                 name: openproject-memcached
           env:
+            - name: SECRET_KEY_BASE
+              valueFrom:
+                secretKeyRef:
+                  name: openproject-secrets
+                  key: secretKeyBase
             - name: OPENPROJECT_DB_PASSWORD
               valueFrom:
                 secretKeyRef:

openproject/versions/17/web-deployment.yaml

@@ -126,6 +126,11 @@ spec:
             - configMapRef:
                 name: openproject-memcached
           env:
+            - name: SECRET_KEY_BASE
+              valueFrom:
+                secretKeyRef:
+                  name: openproject-secrets
+                  key: secretKeyBase
             - name: OPENPROJECT_DB_PASSWORD
               valueFrom:
                 secretKeyRef:

openproject/versions/17/worker-deployment.yaml

@@ -129,7 +129,11 @@ spec:
             - bash
             - /app/docker/prod/worker
           env:
-            
+            - name: SECRET_KEY_BASE
+              valueFrom:
+                secretKeyRef:
+                  name: openproject-secrets
+                  key: secretKeyBase
             - name: OPENPROJECT_DB_PASSWORD
               valueFrom:
                 secretKeyRef:

zulip/app.yaml

@@ -3,4 +3,4 @@ is: zulip
 description: Zulip is an open-source team chat application with threaded conversations, making it easy to catch up on important discussions without information overload.
 category: communication
 icon: https://cdn.jsdelivr.net/gh/homarr-labs/dashboard-icons/svg/zulip.svg
-latest: "12"
+latest: "9"