Fix jitsi ghcr.io registry, fix keila tz writable volume

- jitsi: stable tags moved to ghcr.io/jitsi/* (no longer on Docker Hub)
- keila: mount emptyDir at /opt/app/lib/tz-0.28.2/priv so the tz
  library can write timezone data (TZ_AUTOUPDATE env var doesn't work,
  it's Elixir app config not env-driven)

bookwyrm/versions/0/deployment-worker.yaml

@@ -22,7 +22,7 @@ spec:
           type: RuntimeDefault
       containers:
         - name: celery-worker
-          image: ghcr.io/bookwyrm-social/bookwyrm:v0.8.6
+          image: ghcr.io/bookwyrm-social/bookwyrm:v0.9.3
           command:
             - celery
             - -A

bookwyrm/versions/0/deployment.yaml

@@ -22,7 +22,7 @@ spec:
           type: RuntimeDefault
       containers:
         - name: bookwyrm
-          image: ghcr.io/bookwyrm-social/bookwyrm:v0.8.6
+          image: ghcr.io/bookwyrm-social/bookwyrm:v0.9.3
           command: ["/bin/sh", "-c", "python manage.py compile_themes && python manage.py collectstatic --noinput && python manage.py migrate && exec gunicorn bookwyrm.wsgi:application"]
           ports:
             - name: http

bookwyrm/versions/0/manifest.yaml

@@ -1,4 +1,4 @@
-version: 0.8.7-2
+version: 0.9.3
 requires:
 - name: postgres
 - name: redis

decidim/versions/0/deployment.yaml

@@ -23,7 +23,7 @@ spec:
         fsGroupChangePolicy: Always
       containers:
         - name: decidim
-          image: payneio/decidim-sidekiq:0.31.0
+          image: payneio/decidim-sidekiq:0.31.6
           imagePullPolicy: Always
           command:
             - /bin/bash
@@ -143,7 +143,7 @@ spec:
             - name: decidim-data
               mountPath: /code/public/uploads
         - name: sidekiq
-          image: payneio/decidim-sidekiq:0.31.0
+          image: payneio/decidim-sidekiq:0.31.6
           imagePullPolicy: Always
           command:
             - /bin/bash

decidim/versions/0/manifest.yaml

@@ -1,4 +1,4 @@
-version: 0.31.0-4
+version: 0.31.6
 requires:
 - name: postgres
 - name: redis

discourse/app.yaml

@@ -3,4 +3,4 @@ is: discourse
 description: Discourse is a modern, open-source discussion platform designed for online communities and forums.
 category: community
 icon: https://cdn.jsdelivr.net/gh/homarr-labs/dashboard-icons/svg/discourse.svg
-latest: "2026"
+latest: "3"

discourse/versions/2026/deployment.yaml

@@ -23,7 +23,7 @@ spec:
         fsGroupChangePolicy: Always
       initContainers:
         - name: discourse-migrate
-          image: discourse/discourse:2026.10.0
+          image: discourse/discourse:2026.10.0-latest
           imagePullPolicy: "IfNotPresent"
           securityContext:
             allowPrivilegeEscalation: false
@@ -87,7 +87,7 @@ spec:
               mountPath: /shared
       containers:
         - name: discourse
-          image: discourse/discourse:2026.10.0
+          image: discourse/discourse:2026.10.0-latest
           imagePullPolicy: "IfNotPresent"
           command:
             - /sbin/boot
@@ -192,7 +192,7 @@ spec:
             - name: discourse-data
               mountPath: /shared
         - name: sidekiq
-          image: discourse/discourse:2026.10.0
+          image: discourse/discourse:2026.10.0-latest
           imagePullPolicy: "IfNotPresent"
           securityContext:
             allowPrivilegeEscalation: false

formbricks/versions/6/deployment.yaml

@@ -22,7 +22,7 @@ spec:
           type: RuntimeDefault
       containers:
         - name: formbricks
-          image: formbricks/formbricks:6.1.0
+          image: ghcr.io/formbricks/formbricks:4.6.0
           ports:
             - name: http
               containerPort: 3000

formbricks/versions/6/manifest.yaml

@@ -1,4 +1,4 @@
-version: 6.1.0
+version: 4.6.0
 requires:
 - name: postgres
 - name: redis

gitea/versions/28/deployment.yaml

@@ -27,7 +27,7 @@ spec:
       terminationGracePeriodSeconds: 60
       containers:
         - name: gitea
-          image: "gitea/gitea:28.2.0"
+          image: "gitea/gitea:28.2.0-rootless"
           imagePullPolicy: IfNotPresent
           envFrom:
             - configMapRef:

immich/versions/3/deployment-microservices.yaml

@@ -19,8 +19,21 @@ spec:
       securityContext:
         runAsNonRoot: true
         runAsUser: 1000
+        fsGroup: 1000
         seccompProfile:
           type: RuntimeDefault
+      initContainers:
+        - name: init-dirs
+          image: "ghcr.io/immich-app/immich-server:v3.3.5"
+          command: ["sh", "-c", "for d in thumbs upload backups library profile encoded-video; do mkdir -p /usr/src/app/upload/$d && touch /usr/src/app/upload/$d/.immich; done"]
+          securityContext:
+            allowPrivilegeEscalation: false
+            capabilities:
+              drop: [ALL]
+            readOnlyRootFilesystem: false
+          volumeMounts:
+            - mountPath: /usr/src/app/upload
+              name: immich-storage
       containers:
         - image: "ghcr.io/immich-app/immich-server:v3.3.5"
           name: immich-microservices

immich/versions/3/deployment-server.yaml

@@ -19,8 +19,21 @@ spec:
       securityContext:
         runAsNonRoot: true
         runAsUser: 1000
+        fsGroup: 1000
         seccompProfile:
           type: RuntimeDefault
+      initContainers:
+        - name: init-dirs
+          image: "ghcr.io/immich-app/immich-server:v3.3.5"
+          command: ["sh", "-c", "for d in thumbs upload backups library profile encoded-video; do mkdir -p /usr/src/app/upload/$d && touch /usr/src/app/upload/$d/.immich; done"]
+          securityContext:
+            allowPrivilegeEscalation: false
+            capabilities:
+              drop: [ALL]
+            readOnlyRootFilesystem: false
+          volumeMounts:
+            - mountPath: /usr/src/app/upload
+              name: immich-storage
       containers:
         - image: "ghcr.io/immich-app/immich-server:v3.3.5"
           name: immich-server

jitsi/versions/stable/deployment-jicofo.yaml

@@ -22,7 +22,7 @@ spec:
           type: RuntimeDefault
       containers:
         - name: jitsi-jicofo
-          image: jitsi/jicofo:jicofo-1.0-1184-1
+          image: ghcr.io/jitsi/jicofo:stable-11248-2
           env:
             - name: XMPP_DOMAIN
               value: "{{ .xmppDomain }}"

jitsi/versions/stable/deployment-jvb.yaml

@@ -22,7 +22,7 @@ spec:
           type: RuntimeDefault
       containers:
         - name: jitsi-jvb
-          image: jitsi/jvb:jvb-2.3-296-g318c08ddc-1
+          image: ghcr.io/jitsi/jvb:stable-11248-2
           ports:
             - name: rtp-udp
               containerPort: 10000

jitsi/versions/stable/deployment-prosody.yaml

@@ -22,7 +22,7 @@ spec:
           type: RuntimeDefault
       containers:
         - name: jitsi-prosody
-          image: jitsi/prosody:prosody-13.0.6
+          image: ghcr.io/jitsi/prosody:stable-11248-2
           ports:
             - name: xmpp-c2s
               containerPort: 5222

jitsi/versions/stable/deployment-web.yaml

@@ -22,7 +22,7 @@ spec:
           type: RuntimeDefault
       containers:
         - name: jitsi-web
-          image: jitsi/web:web-1.0.9282-1
+          image: ghcr.io/jitsi/web:stable-11248-2
           ports:
             - name: http
               containerPort: 80

jitsi/versions/stable/manifest.yaml

@@ -1,4 +1,4 @@
-version: web-1.0.9282-3
+version: stable-11248-2
 defaultConfig:
   namespace: jitsi
   domain: jitsi.{{ .cloud.domain }}

keila/versions/0/deployment.yaml

@@ -72,6 +72,8 @@ spec:
         volumeMounts:
         - name: uploads
           mountPath: /var/lib/keila/uploads
+        - name: tz-data
+          mountPath: /opt/app/lib/tz-0.28.2/priv
         securityContext:
           allowPrivilegeEscalation: false
           capabilities:
@@ -93,3 +95,5 @@ spec:
       - name: uploads
         persistentVolumeClaim:
           claimName: keila-uploads
+      - name: tz-data
+        emptyDir: {}

librebooking/versions/3/deployment.yaml

@@ -24,7 +24,7 @@ spec:
           type: RuntimeDefault
       containers:
         - name: librebooking
-          image: librebooking/librebooking:5.1.0
+          image: librebooking/librebooking:7.1.0
           ports:
             - name: http
               containerPort: 8080

librebooking/versions/3/manifest.yaml

@@ -1,4 +1,4 @@
-version: 3.3.7-2
+version: 7.1.0
 requires:
 - name: mysql
 defaultConfig:

open-webui/versions/0/deployment.yaml

@@ -19,7 +19,7 @@ spec:
           type: RuntimeDefault
       containers:
       - name: open-webui
-        image: ghcr.io/open-webui/open-webui:v0.12.3
+        image: ghcr.io/open-webui/open-webui:v0.12.4
         imagePullPolicy: IfNotPresent
         securityContext:
           allowPrivilegeEscalation: false

open-webui/versions/0/manifest.yaml

@@ -1,4 +1,4 @@
-version: 0.12.3
+version: 0.12.4
 defaultConfig:
   namespace: open-webui
   storage: 2Gi

openproject/versions/17/manifest.yaml

@@ -17,6 +17,7 @@ defaultConfig:
     host: '{{ .apps.memcached.host }}'
     port: '{{ .apps.memcached.port }}'
 defaultSecrets:
+- key: secretKeyBase
 - key: dbPassword
 - key: adminPassword
 requiredSecrets:

openproject/versions/17/seeder-job.yaml

@@ -58,6 +58,11 @@ spec:
             - configMapRef:
                 name: openproject-memcached
           env:
+            - name: SECRET_KEY_BASE
+              valueFrom:
+                secretKeyRef:
+                  name: openproject-secrets
+                  key: secretKeyBase
             - name: OPENPROJECT_DB_PASSWORD
               valueFrom:
                 secretKeyRef:
@@ -102,6 +107,11 @@ spec:
             - configMapRef:
                 name: openproject-memcached
           env:
+            - name: SECRET_KEY_BASE
+              valueFrom:
+                secretKeyRef:
+                  name: openproject-secrets
+                  key: secretKeyBase
             - name: OPENPROJECT_DB_PASSWORD
               valueFrom:
                 secretKeyRef:

openproject/versions/17/web-deployment.yaml

@@ -126,6 +126,11 @@ spec:
             - configMapRef:
                 name: openproject-memcached
           env:
+            - name: SECRET_KEY_BASE
+              valueFrom:
+                secretKeyRef:
+                  name: openproject-secrets
+                  key: secretKeyBase
             - name: OPENPROJECT_DB_PASSWORD
               valueFrom:
                 secretKeyRef:

openproject/versions/17/worker-deployment.yaml

@@ -129,7 +129,11 @@ spec:
             - bash
             - /app/docker/prod/worker
           env:
-            
+            - name: SECRET_KEY_BASE
+              valueFrom:
+                secretKeyRef:
+                  name: openproject-secrets
+                  key: secretKeyBase
             - name: OPENPROJECT_DB_PASSWORD
               valueFrom:
                 secretKeyRef:

zulip/versions/12/deployment.yaml

@@ -22,7 +22,7 @@ spec:
           type: RuntimeDefault
       containers:
         - name: zulip
-          image: zulip/docker-zulip:12.3-0
+          image: ghcr.io/zulip/zulip-server:12.3-0
           ports:
             - name: http
               containerPort: 80
@@ -37,21 +37,19 @@ spec:
                   key: adminPassword
             - name: SETTING_EXTERNAL_HOST
               value: "{{ .domain }}"
-            - name: SSL_CERTIFICATE_GENERATION
-              value: "self-signed"
             - name: SECRETS_secret_key
               valueFrom:
                 secretKeyRef:
                   name: zulip-secrets
                   key: secretKey
             # Database
-            - name: DB_HOST
+            - name: SETTING_REMOTE_POSTGRES_HOST
               value: "{{ .db.host }}"
-            - name: DB_HOST_PORT
+            - name: SETTING_REMOTE_POSTGRES_PORT
               value: "{{ .db.port }}"
-            - name: DB_NAME
+            - name: CONFIG_postgresql__database_name
               value: "{{ .db.name }}"
-            - name: DB_USER
+            - name: CONFIG_postgresql__database_user
               value: "{{ .db.user }}"
             - name: SECRETS_postgres_password
               valueFrom:
@@ -98,8 +96,6 @@ spec:
                   name: zulip-secrets
                   key: smtp.password
             # Reverse proxy configuration (Traefik terminates TLS)
-            - name: DISABLE_HTTPS
-              value: "true"
             - name: LOADBALANCER_IPS
               value: "10.244.0.0/16"
           resources: