apps pinned to exact version numbers

clusters/base/apps/immich/helmrelease-redis.yaml

@@ -17,7 +17,7 @@ spec:
           app:
             image:
               repository: docker.io/valkey/valkey
-              tag: "9"
+              tag: "9.1.1"
             resources:
               requests:
                 cpu: 20m

clusters/base/apps/immich/helmrelease-server.yaml

@@ -21,6 +21,8 @@ spec:
             image:
               repository: hectorm/nfs-ganesha
               tag: v10
+              # hectorm does not publish exact versions, v10.0 digest is 93df70b78...
+              digest: sha256:93df70b78aae56957f4a4f5c606c4250d84b729435f76132dca07b7290f5bfce
             command:
               - sh
               - -c

clusters/base/apps/immich/secret.enc.yaml

@@ -4,19 +4,19 @@ metadata:
     name: immich-secrets
     namespace: photo
 stringData:
-    DB_PASSWORD: ENC[AES256_GCM,data:AdaIt9jXHlasJeZwWqXoXoVpDwWQ3vkfJ0ZR4vOWpHg=,iv:zsMLi3PbTpkxKAwBiMO8WjIvTz0DjyedXFg7I3dGFuU=,tag:CkBDuNzK24Adv+IzTP0j5Q==,type:str]
+    DB_PASSWORD: ENC[AES256_GCM,data:OumSCUdG9NT5FNCApJ9D04VIXgRf2X/ieCjJbWqGsc0=,iv:IAC9IXiVeOqFngqOqxReBPYNwPg3p/e4auHeUCudcS0=,tag:uhg56rWb5IzJApJm3tqDHA==,type:str]
 sops:
     age:
         - recipient: age1wmm8qrqnjzvd5nkraed6ylrsxlpn3ru7d7zettdudj7y9sg9dd2su0u3mr
           enc: |
             -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSB4VDZJVzRPWFdYdDYwMStN
-            d3hvQVdJOFhacTk1SjZ2T09DSXZQOXJKUHd3CmJaMWNNcTFBakdnV3VZM1cvZHU5
-            OWJzNldLanVna0dPZkt3WVlaOHYwOWMKLS0tIEJubCs3TWlJQTRiREgwVTBlT3pj
-            ODlhdDJyWDAyeUJGeFBwMFJCaEhTQ0EKqNHwTTT6zYBU/xV2K3fiiOlCEt06qJAq
-            5dnwxqyyycgzXlLXWk0d0yx+yQ1NgFUmFXg2Fsph4qHYyonlf3Lb2g==
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBqTnlDR1dRUDNaTlQ2RHpM
+            OFArT3BjOEhleXhVaTRlVDRPcFF1ZFpyakR3Ck1BUHhYQXdsTXMveGs2OG9mbzFQ
+            QWR6dW4zL2VsQWtDNWgrVVBDeWd4L1kKLS0tIDY3WHo1MEl4SzJKM0ROalBKNERa
+            SlQwMEdnZmhSWUdYUnBGRk9MdjV0cGMKxhON65iPrpNMnqBYYUN6rQfhAo3EhhE4
+            Vun3sqVBk1OH8aekutrYSOj/RhrIbzYlbFXTY+pDnp3U3o1+xrknig==
             -----END AGE ENCRYPTED FILE-----
-    lastmodified: "2026-08-26T10:29:36Z"
-    mac: ENC[AES256_GCM,data:d/cw0pi/GmcQYtkRn06RcvGBmKoO12ycjK/SHAIsxR3UBs1gpoPBYznVBRDE7PHJi9NoobAykWj03cDrDrzXqBHq/xflKYOzmqRpf2bOSOtzfnLaDBmEI+lFjhyZ9b2z1+lKBDY9r4JvevEyOxZ/1t9hDgLt8gEXc01kJY9a2cQ=,iv:ATqxpr2FtVf8vddG6FhkNgPGKWyzGn7C2CsTb5qawiw=,tag:57tJqNMkuPfdEulmdEaQ4A==,type:str]
+    lastmodified: "2026-08-26T10:29:46Z"
+    mac: ENC[AES256_GCM,data:/CgR0m+7TJh2hHQ+pee5bP1lbJhWMrJiPjTrS8pP05z4OobLXxScEzPKtuO8+0Ru0eyjg/i1eAk5tzDMzDPwW3/JiU9elQKeFYxzGn6LmT17KIf+ofPP9vuVFP93FW4vqYNZIO4qUtF/RUfZBRgPlf6rokUMRLILTRGI00lvfR4=,iv:z9xX6wGL7I+NZzybQd0j4+rkU+Xb2JKO2sedrrGUss4=,tag:P5E3e/s8bXJBDUhxTqaf8g==,type:str]
     encrypted_regex: ^(data|stringData)$
     version: 3.11.0