From e0910bcbfc9b6df3cd5c3deb95ed9a83c7624297 Mon Sep 17 00:00:00 2001
From: Rich Braun <richb@instantlinux.net>
Date: Tue, 8 Sep 2026 22:43:40 -0700
Subject: [PATCH] SYS-673 bump a couple helm charts, stabilize ingress for http
 streaming

---
 ansible/roles/users/tasks/packages.yml | 1 +
 k8s/Makefile                           | 2 +-
 k8s/Makefile.versions                  | 6 +++---
 k8s/helm/headscale/Chart.yaml          | 2 +-
 k8s/helm/headscale/values.yaml         | 1 +
 k8s/helm/immich/Chart.yaml             | 2 +-
 k8s/helm/immich/values.yaml            | 4 +++-
 7 files changed, 11 insertions(+), 7 deletions(-)

diff --git a/ansible/roles/users/tasks/packages.yml b/ansible/roles/users/tasks/packages.yml
index ecb00c7d..f89d9387 100644
--- a/ansible/roles/users/tasks/packages.yml
+++ b/ansible/roles/users/tasks/packages.yml
@@ -18,6 +18,7 @@
     uris: "{{ ubuntu_repo_uri }}"
     suites: [ "{{ ansible_facts['distribution_release'] }}" ]
     components: [ main, restricted, universe, multiverse ]
+    install_python_debian: true
   when: ansible_facts['os_family'] == 'Debian'
 
 - name: Install PAM module for google-authenticator
diff --git a/k8s/Makefile b/k8s/Makefile
index 596ea11c..83ea9dc3 100644
--- a/k8s/Makefile
+++ b/k8s/Makefile
@@ -183,7 +183,7 @@ include Makefile.sops
 imports/cert-manager.yaml: imports/cert-manager-$(VERSION_CERT_MANAGER).yaml
 	ln -s $(notdir $<) $@
 imports/cert-manager-$(VERSION_CERT_MANAGER).yaml:
-	curl -sLo $@ https://github.com/jetstack/cert-manager/releases/download/v$(VERSION_CERT_MANAGER)/cert-manager.yaml
+	curl -sLo $@ https://github.com/cert-manager/cert-manager/releases/download/v$(VERSION_CERT_MANAGER)/cert-manager.yaml
 
 ##########
 # node-local-dns
diff --git a/k8s/Makefile.versions b/k8s/Makefile.versions
index 3e728d0b..ba9f8467 100644
--- a/k8s/Makefile.versions
+++ b/k8s/Makefile.versions
@@ -1,11 +1,11 @@
 # Third-party versions
-export VERSION_CERT_MANAGER   ?= 1.19.2
+export VERSION_CERT_MANAGER   ?= 1.21.1
 export VERSION_DEFAULTBACKEND ?= 1.5
-export VERSION_FLANNEL        ?= 0.28.4
+export VERSION_FLANNEL        ?= 0.28.9
 export VERSION_HELM           ?= 4.1.0
 export VERSION_INGRESS_NGINX  ?= 1.15.1
 export VERSION_METRICS        ?= 2.18.0
-export VERSION_NODE_LOCAL_DNS ?= 1.35.4
+export VERSION_NODE_LOCAL_DNS ?= 1.36.4
 VERSION_SOPS                  ?= 3.13.0
 SOPS_SHA                      ?= f2e5ed5e57376789b0e12793adc848e54c2338906e51392246dd03461b320157
 
diff --git a/k8s/helm/headscale/Chart.yaml b/k8s/helm/headscale/Chart.yaml
index 2955cbff..088cdbb5 100644
--- a/k8s/helm/headscale/Chart.yaml
+++ b/k8s/helm/headscale/Chart.yaml
@@ -6,7 +6,7 @@ sources:
 - https://github.com/instantlinux/docker-tools
 - https://github.com/juanfont/headscale
 type: application
-version: 0.1.0
+version: 0.1.1
 appVersion: "0.29.3"
 dependencies:
 - name: chartlib
diff --git a/k8s/helm/headscale/values.yaml b/k8s/helm/headscale/values.yaml
index e29048cc..b6a4c1fe 100644
--- a/k8s/helm/headscale/values.yaml
+++ b/k8s/helm/headscale/values.yaml
@@ -66,6 +66,7 @@ ingress:
     cert-manager.io/cluster-issuer: letsencrypt-prod
     kubernetes.io/ingress.class: nginx
     nginx.ingress.kubernetes.io/enable-access-log: "false"
+    nginx.ingress.kubernetes.io/proxy-buffering: "off"
     nginx.ingress.kubernetes.io/proxy-read-timeout: "3600"
     nginx.ingress.kubernetes.io/proxy-send-timeout: "3600"
     nginx.ingress.kubernetes.io/configuration-snippet: |
diff --git a/k8s/helm/immich/Chart.yaml b/k8s/helm/immich/Chart.yaml
index 5ea3c024..a1461fae 100644
--- a/k8s/helm/immich/Chart.yaml
+++ b/k8s/helm/immich/Chart.yaml
@@ -6,7 +6,7 @@ sources:
 - https://github.com/immich-app/immich
 - https://github.com/instantlinux/docker-tools
 type: application
-version: 0.1.2
+version: 0.1.3
 # Reminder, update tag for ml instance in values.yaml
 appVersion: v3.0.1
 dependencies:
diff --git a/k8s/helm/immich/values.yaml b/k8s/helm/immich/values.yaml
index 68578e5e..3e4bfbd9 100644
--- a/k8s/helm/immich/values.yaml
+++ b/k8s/helm/immich/values.yaml
@@ -141,9 +141,11 @@ ingress:
   annotations:
     cert-manager.io/cluster-issuer: letsencrypt-prod
     kubernetes.io/ingress.class: nginx
-    nginx.ingress.kubernetes.io/client-body-buffer-size: "0"
+    nginx.ingress.kubernetes.io/client-body-buffer-size: "1024k"
+    nginx.ingress.kubernetes.io/client-max-body-size: "50000M"
     nginx.ingress.kubernetes.io/enable-access-log: "false"
     nginx.ingress.kubernetes.io/proxy-body-size: "0"
+    nginx.ingress.kubernetes.io/proxy-buffering: "off"
     nginx.ingress.kubernetes.io/proxy-read-timeout: "600"
     nginx.ingress.kubernetes.io/proxy-request-buffering: "off"
     nginx.ingress.kubernetes.io/proxy-send-timeout: "600"