Fix immich fsGroup, keila tz autoupdate, revert open-webui

- immich: add fsGroup: 1000 so init container can write to PVC - keila: set TZ_AUTOUPDATE=disabled to prevent tz library crash on read-only /opt/app/lib path in v0.30.3 - open-webui: revert to v0.9.5 — v0.12.x migration crashes on existing DB (duplicate column name: info_json)
Fix immich v3 storage dirs, revert discourse and zulip to previous slots
2026-10-26 16:20:23 +00:00 · 2026-10-26 16:18:39 +00:00 · 2026-10-26 16:16:34 +00:00
12 changed files with 54 additions and 6 deletions
--- a/discourse/app.yaml
+++ b/discourse/app.yaml
@@ -3,4 +3,4 @@ is: discourse
 description: Discourse is a modern, open-source discussion platform designed for online communities and forums.
 category: community
 icon: https://cdn.jsdelivr.net/gh/homarr-labs/dashboard-icons/svg/discourse.svg
-latest: "2026"
+latest: "3"
--- a/gitea/versions/28/deployment.yaml
+++ b/gitea/versions/28/deployment.yaml
@@ -27,7 +27,7 @@ spec:
      terminationGracePeriodSeconds: 60
      containers:
        - name: gitea
-          image: "gitea/gitea:28.2.0"
+          image: "gitea/gitea:28.2.0-rootless"
          imagePullPolicy: IfNotPresent
          envFrom:
            - configMapRef:
--- a/immich/versions/3/deployment-microservices.yaml
+++ b/immich/versions/3/deployment-microservices.yaml
@@ -19,8 +19,21 @@ spec:
      securityContext:
        runAsNonRoot: true
        runAsUser: 1000
+        fsGroup: 1000
        seccompProfile:
          type: RuntimeDefault
+      initContainers:
+        - name: init-dirs
+          image: "ghcr.io/immich-app/immich-server:v3.3.5"
+          command: ["sh", "-c", "mkdir -p /usr/src/app/upload/thumbs /usr/src/app/upload/upload /usr/src/app/upload/backups /usr/src/app/upload/library /usr/src/app/upload/profile /usr/src/app/upload/encoded-video"]
+          securityContext:
+            allowPrivilegeEscalation: false
+            capabilities:
+              drop: [ALL]
+            readOnlyRootFilesystem: false
+          volumeMounts:
+            - mountPath: /usr/src/app/upload
+              name: immich-storage
      containers:
        - image: "ghcr.io/immich-app/immich-server:v3.3.5"
          name: immich-microservices
--- a/immich/versions/3/deployment-server.yaml
+++ b/immich/versions/3/deployment-server.yaml
@@ -19,8 +19,21 @@ spec:
      securityContext:
        runAsNonRoot: true
        runAsUser: 1000
+        fsGroup: 1000
        seccompProfile:
          type: RuntimeDefault
+      initContainers:
+        - name: init-dirs
+          image: "ghcr.io/immich-app/immich-server:v3.3.5"
+          command: ["sh", "-c", "mkdir -p /usr/src/app/upload/thumbs /usr/src/app/upload/upload /usr/src/app/upload/backups /usr/src/app/upload/library /usr/src/app/upload/profile /usr/src/app/upload/encoded-video"]
+          securityContext:
+            allowPrivilegeEscalation: false
+            capabilities:
+              drop: [ALL]
+            readOnlyRootFilesystem: false
+          volumeMounts:
+            - mountPath: /usr/src/app/upload
+              name: immich-storage
      containers:
        - image: "ghcr.io/immich-app/immich-server:v3.3.5"
          name: immich-server
--- a/keila/versions/0/deployment.yaml
+++ b/keila/versions/0/deployment.yaml
@@ -58,6 +58,8 @@ spec:
              key: smtpPassword
        - name: MAILER_SMTP_FROM_EMAIL
          value: "{{ .smtp.from }}"
+        - name: TZ_AUTOUPDATE
+          value: "disabled"
        - name: DISABLE_REGISTRATION
          value: "{{ .disableRegistration }}"
        - name: KEILA_USER
--- a/open-webui/versions/0/deployment.yaml
+++ b/open-webui/versions/0/deployment.yaml
@@ -19,7 +19,7 @@ spec:
          type: RuntimeDefault
      containers:
      - name: open-webui
-        image: ghcr.io/open-webui/open-webui:v0.12.4
+        image: ghcr.io/open-webui/open-webui:v0.9.5
        imagePullPolicy: IfNotPresent
        securityContext:
          allowPrivilegeEscalation: false
--- a/open-webui/versions/0/manifest.yaml
+++ b/open-webui/versions/0/manifest.yaml
@@ -1,4 +1,4 @@
-version: 0.12.4
+version: 0.9.5-5
 defaultConfig:
  namespace: open-webui
  storage: 2Gi
--- a/openproject/versions/17/manifest.yaml
+++ b/openproject/versions/17/manifest.yaml
@@ -17,6 +17,7 @@ defaultConfig:
    host: '{{ .apps.memcached.host }}'
    port: '{{ .apps.memcached.port }}'
 defaultSecrets:
+- key: secretKeyBase
 - key: dbPassword
 - key: adminPassword
 requiredSecrets:
--- a/openproject/versions/17/seeder-job.yaml
+++ b/openproject/versions/17/seeder-job.yaml
@@ -58,6 +58,11 @@ spec:
            - configMapRef:
                name: openproject-memcached
          env:
+            - name: SECRET_KEY_BASE
+              valueFrom:
+                secretKeyRef:
+                  name: openproject-secrets
+                  key: secretKeyBase
            - name: OPENPROJECT_DB_PASSWORD
              valueFrom:
                secretKeyRef:
@@ -102,6 +107,11 @@ spec:
            - configMapRef:
                name: openproject-memcached
          env:
+            - name: SECRET_KEY_BASE
+              valueFrom:
+                secretKeyRef:
+                  name: openproject-secrets
+                  key: secretKeyBase
            - name: OPENPROJECT_DB_PASSWORD
              valueFrom:
                secretKeyRef:
--- a/openproject/versions/17/web-deployment.yaml
+++ b/openproject/versions/17/web-deployment.yaml
@@ -126,6 +126,11 @@ spec:
            - configMapRef:
                name: openproject-memcached
          env:
+            - name: SECRET_KEY_BASE
+              valueFrom:
+                secretKeyRef:
+                  name: openproject-secrets
+                  key: secretKeyBase
            - name: OPENPROJECT_DB_PASSWORD
              valueFrom:
                secretKeyRef:
--- a/openproject/versions/17/worker-deployment.yaml
+++ b/openproject/versions/17/worker-deployment.yaml
@@ -129,7 +129,11 @@ spec:
            - bash
            - /app/docker/prod/worker
          env:
-            
+            - name: SECRET_KEY_BASE
+              valueFrom:
+                secretKeyRef:
+                  name: openproject-secrets
+                  key: secretKeyBase
            - name: OPENPROJECT_DB_PASSWORD
              valueFrom:
                secretKeyRef:
--- a/zulip/app.yaml
+++ b/zulip/app.yaml
@@ -3,4 +3,4 @@ is: zulip
 description: Zulip is an open-source team chat application with threaded conversations, making it easy to catch up on important discussions without information overload.
 category: communication
 icon: https://cdn.jsdelivr.net/gh/homarr-labs/dashboard-icons/svg/zulip.svg
-latest: "12"
+latest: "9"