Update siderolabs/talos to v1.8.3

Reviewed-on: #884

.vscode/settings.json

@@ -1,32 +1,41 @@
 {
   "ansible.validation.lint.arguments": "-c .ansible-lint",
   "files.associations": {
-      "*.json5": "jsonc",
+    "*.json5": "jsonc",
-      "**/ansible/**/*.yaml": "ansible",
+    "**/ansible/**/*.yaml": "ansible",
-      "**/ansible/**/*.sops.yaml": "yaml",
+    "**/ansible/**/*.sops.yaml": "yaml",
-      "**/ansible/**/inventory/**/*.yaml": "yaml",
+    "**/ansible/**/inventory/**/*.yaml": "yaml",
-      "**/kubernetes/**/*.sops.toml": "plaintext"
+    "**/kubernetes/**/*.sops.toml": "plaintext",
+    "*.hujson": "jsonc"
   },
   "material-icon-theme.folders.associations": {
-      ".taskfiles": "utils",
+    ".taskfiles": "utils",
-      "bootstrap": "import",
+    "bootstrap": "import",
-      "charts": "kubernetes",
+    "charts": "kubernetes",
-      "hack": "scripts",
+    "hack": "scripts",
-      "repositories": "database",
+    "repositories": "database",
-      "vars": "other",
+    "vars": "other",
-      // namespaces
+    // namespaces
-      "cert-manager": "guard",
+    "cert-manager": "guard",
-      "external-secrets": "keys",
+    "external-secrets": "keys",
-      "kube-system": "kubernetes",
+    "kube-system": "kubernetes",
-      "monitoring": "event",
+    "monitoring": "event",
-      "networking": "connection",
+    "networking": "connection",
-      "rook-ceph": "dump",
+    "rook-ceph": "dump"
   },
   "yaml.schemaStore.enable": true,
   "yaml.schemas": {
     "ansible": "ansible/**/*.yaml",
     "kubernetes": "kubernetes/**/*.yaml"
   },
+  "json.schemas": [
+    {
+      "fileMatch": ["*.hujson"],
+      "schema": {
+        "allowTrailingCommas": true
+      }
+    }
+  ],
   "editor.fontFamily": "FiraCode Nerd Font",
   "editor.fontLigatures": true,
   "editor.bracketPairColorization.enabled": true,
@@ -35,9 +44,7 @@
   "editor.guides.highlightActiveBracketPair": true,
   "editor.hover.delay": 1500,
   "editor.stickyScroll.enabled": false,
-  "editor.rulers": [
+  "editor.rulers": [100],
-    100
-  ],
   "explorer.autoReveal": false,
   "files.trimTrailingWhitespace": true,
   "ansible.python.interpreterPath": "/usr/bin/python3",
@@ -46,5 +53,5 @@
   "prettier.quoteProps": "preserve",
   "[jsonc]": {
     "editor.defaultFormatter": "esbenp.prettier-vscode"
-  },
+  }
 }

kubernetes/apps/ai/ollama/app/helmrelease.yaml

@@ -35,7 +35,7 @@ spec:
           app:
             image:
               repository: docker.io/ollama/ollama
-              tag: 0.4.1
+              tag: 0.4.2
             env:
               - name: OLLAMA_HOST
                 value: 0.0.0.0

kubernetes/apps/ai/open-webui/app/helmrelease.yaml

@@ -33,7 +33,7 @@ spec:
           app:
             image:
               repository: ghcr.io/open-webui/open-webui
-              tag: 0.3.35
+              tag: v0.4.0
             env:
               - name: OLLAMA_BASE_URL
                 value: http://ollama.ai.svc.cluster.local:11434

kubernetes/apps/anime/jellyfin/app/helmrelease.yaml

@@ -40,7 +40,7 @@ spec:
           app:
             image:
               repository: ghcr.io/jellyfin/jellyfin
-              tag: 10.10.1@sha256:12b7aa2c8086e5566badc35370fab41b8cc8774dc3a80b07a1d6eb14f282b816
+              tag: 10.10.3@sha256:17c3a8d9dddb97789b5f37112840ebf96566442c14d4754193a6c2eb154bc221
             env:
               DOTNET_SYSTEM_IO_DISABLEFILELOCKING: "true"
               JELLYFIN_FFmpeg__probesize: 50000000

kubernetes/apps/anime/jellyseerr/app/helmrelease.yaml

@@ -36,7 +36,7 @@ spec:
           app:
             image:
               repository: fallenbagel/jellyseerr
-              tag: 2.0.1
+              tag: 2.1.0
             env:
               TZ: America/Chicago
               LOG_LEVEL: "info"

kubernetes/apps/anime/radarr/app/helmrelease.yaml

@@ -31,7 +31,7 @@ spec:
           app:
             image:
               repository: ghcr.io/onedr0p/radarr-develop
-              tag: 5.15.0.9412
+              tag: 5.15.1.9463
             env:
               RADARR__APP__INSTANCENAME: Radarr-Anime
               RADARR__APP__THEME: dark

kubernetes/apps/anime/sonarr/app/helmrelease.yaml

@@ -31,7 +31,7 @@ spec:
           app:
             image:
               repository: ghcr.io/onedr0p/sonarr-develop
-              tag: 4.0.10.2624
+              tag: 4.0.10.2656
             env:
               SONARR__APP__INSTANCENAME: Sonarr-Anime
               SONARR__APP__THEME: dark

kubernetes/apps/ci-runners/forgejo/app/helmrelease.yaml

@@ -30,7 +30,7 @@ spec:
           runner-register:
             image:
               repository: code.forgejo.org/forgejo/runner
-              tag: 4.0.1
+              tag: 5.0.0
             command:
               - "forgejo-runner"
               - "register"
@@ -72,7 +72,7 @@ spec:
           app:
             image:
               repository: code.forgejo.org/forgejo/runner
-              tag: 4.0.1
+              tag: 5.0.0
             command:
               - "sh"
               - "-c"

kubernetes/apps/database/dragonfly/app/helmrelease.yaml

@@ -30,7 +30,7 @@ spec:
           app:
             image:
               repository: ghcr.io/dragonflydb/operator
-              tag: v1.1.7
+              tag: v1.1.8
             command: ["/manager"]
             args:
               - --health-probe-bind-address=:8081

kubernetes/apps/database/dragonfly/app/kustomization.yaml

@@ -4,6 +4,6 @@ apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
 resources:
   # renovate: datasource=github-releases depName=dragonflydb/dragonfly-operator
-  - https://raw.githubusercontent.com/dragonflydb/dragonfly-operator/v1.1.7/manifests/crd.yaml
+  - https://raw.githubusercontent.com/dragonflydb/dragonfly-operator/v1.1.8/manifests/crd.yaml
   - ./helmrelease.yaml
   - ./rbac.yaml

kubernetes/apps/database/dragonfly/cluster/dragonfly.yaml

@@ -5,7 +5,7 @@ kind: Dragonfly
 metadata:
   name: dragonfly
 spec:
-  image: ghcr.io/dragonflydb/dragonfly:v1.24.0
+  image: ghcr.io/dragonflydb/dragonfly:v1.25.1
   replicas: 3
   env:
     - name: MAX_MEMORY

kubernetes/apps/database/emqx/cluster/cluster.yaml

@@ -5,7 +5,7 @@ kind: EMQX
 metadata:
   name: emqx
 spec:
-  image: public.ecr.aws/emqx/emqx:5.8.1
+  image: public.ecr.aws/emqx/emqx:5.8.2
   config:
     mode: Merge
   coreTemplate:

kubernetes/apps/default/autobrr/app/helmrelease.yaml

@@ -31,7 +31,7 @@ spec:
           app:
             image:
               repository: ghcr.io/autobrr/autobrr
-              tag: v1.49.0@sha256:dc2195ccabf8438a8f8eb0581c5e6d2a40c061754e57552bc4f67f1b20a71970
+              tag: v1.50.0@sha256:6a6f23570ab6b418318ab12bf2558712714e2f243cf18b139afa414f8417e97d
             env:
               AUTOBRR__CHECK_FOR_UPDATES: "false"
               AUTOBRR__HOST: 0.0.0.0

kubernetes/apps/default/home-assistant/app/helmrelease.yaml

@@ -36,7 +36,7 @@ spec:
           app:
             image:
               repository: ghcr.io/onedr0p/home-assistant
-              tag: 2024.11.1@sha256:a3dd7577c28771702b21f817ad86600056467c2c7f45d261a1e7241910ddc2e2
+              tag: 2024.11.2@sha256:58df3d1169fb02ef2fb6f6cb2f2423abeb2142f89f3c0fd447cc983d63825c56
             env:
               TZ: America/Chicago
             envFrom:
@@ -54,7 +54,7 @@ spec:
           code-server:
             image:
               repository: ghcr.io/coder/code-server
-              tag: 4.95.1@sha256:d9bc7797d997e1b199e333676732e075bac4bae276dc0fe1baece2e313edfa09
+              tag: 4.95.3@sha256:6d74583d68179cbb6ddadc2518b450d2ac3eaec2d342474fe1941e03371cd2cf
             args: [
               "--auth", "none",
               "--user-data-dir", "/config/.vscode",

kubernetes/apps/default/linkwarden/app/helmrelease.yaml

@@ -31,7 +31,7 @@ spec:
           app:
             image:
               repository: ghcr.io/linkwarden/linkwarden
-              tag: v2.7.1@sha256:bbd22798ee726184d4571ea4f4d831d57475c86c4965c2bb1c3c2d3de88c728a
+              tag: v2.8.3@sha256:7f80a03d688c3e5d9ec6b34f5b65cd861ff8c9eb08d12932dc8fc7482991f238
             env:
               TIMEZONE: "America/Chicago"
               NEXTAUTH_URL: "https://{{ .Release.Name }}.jahanson.tech/api/v1/auth"

kubernetes/apps/default/plex/app/helmrelease.yaml

@@ -38,7 +38,7 @@ spec:
           app:
             image:
               repository: ghcr.io/onedr0p/plex
-              tag: 1.41.1.9057-af5eaea7a@sha256:5926b77196bb7c9f75b52f431d0483abea0fef1f576b7201592b385449201456
+              tag: 1.41.2.9200-c6bbc1b53@sha256:47c6f3d85f4e739210860934a0bb24126170fa2f6a602fb909467f17a035c311
             env:
               TZ: America/Chicago
               PLEX_ADVERTISE_URL: https://plex.hsn.dev:443,http://10.1.1.39:32400

kubernetes/apps/default/plex/trakt-sync/helmrelease.yaml

@@ -33,7 +33,7 @@ spec:
           app:
             image:
               repository: ghcr.io/taxel/plextraktsync
-              tag: 0.32.1
+              tag: 0.32.2
             args:
               - sync
             env:

kubernetes/apps/default/prowlarr/app/helmrelease.yaml

@@ -31,7 +31,7 @@ spec:
           app:
             image:
               repository: ghcr.io/onedr0p/prowlarr-develop
-              tag: 1.26.0.4833@sha256:face4aa669a4eb68b041dcf73ed4848cfe8f673826ef3032398a5e267eb1eac0
+              tag: 1.26.1.4844@sha256:dd6ab1a0c8f2d780b990f1034f2da6ffb0b4d3e3ca6042b656f691f06d4c9397
             env:
               # Ref: https://github.com/Radarr/Radarr/issues/7030#issuecomment-1039689518
               # Ref: https://github.com/dotnet/runtime/issues/9336

kubernetes/apps/default/radarr/app/helmrelease.yaml

@@ -31,7 +31,7 @@ spec:
           app:
             image:
               repository: ghcr.io/onedr0p/radarr-develop
-              tag: 5.15.0.9412
+              tag: 5.15.1.9463
             env:
               RADARR__APP__INSTANCENAME: Radarr
               RADARR__APP__THEME: dark

kubernetes/apps/default/recyclarr/app/helmrelease.yaml

@@ -34,7 +34,7 @@ spec:
           app:
             image:
               repository: ghcr.io/recyclarr/recyclarr
-              tag: 7.3.0@sha256:2aaa0205a93171b93a159e4665004ccee1a5aacd60359fb8d7683db0ae7e774b
+              tag: 7.4.0@sha256:619c3b8920a179f2c578acd0f54e9a068f57c049aff840469eed66e93a4be2cf
             env:
               # Ref: https://github.com/Radarr/Radarr/issues/7030#issuecomment-1039689518
               # Ref: https://github.com/dotnet/runtime/issues/9336

kubernetes/apps/default/redlib/app/helmrelease.yaml

@@ -38,7 +38,7 @@ spec:
           app:
             image:
               repository: quay.io/redlib/redlib
-              tag: latest@sha256:42db7afd24d3e55ceccb38f6e91ecfd44d78f381a04848bb4de67dae1836a3e4
+              tag: latest@sha256:7ee73f84c5678eb2039ff73e458df46dd4ff307f7ba086b6e666af62ce771c29
             env:
               REDLIB_DEFAULT_SHOW_NSFW: on
               REDLIB_DEFAULT_WIDE: on

kubernetes/apps/default/scrypted/app/helmrelease.yaml

@@ -32,7 +32,7 @@ spec:
           app:
             image:
               repository: ghcr.io/koush/scrypted
-              tag: v0.123.1-jammy-nvidia
+              tag: v0.123.31-jammy-nvidia
             probes:
               liveness:
                 enabled: true

kubernetes/apps/default/sonarr/app/helmrelease.yaml

@@ -31,7 +31,7 @@ spec:
           app:
             image:
               repository: ghcr.io/onedr0p/sonarr-develop
-              tag: 4.0.10.2624
+              tag: 4.0.10.2656
             env:
               SONARR__APP__INSTANCENAME: Sonarr
               SONARR__APP__THEME: dark

kubernetes/apps/default/stirling-pdf/app/helmrelease.yaml

@@ -31,7 +31,7 @@ spec:
           app:
             image:
               repository: ghcr.io/stirling-tools/s-pdf
-              tag: 0.31.1@sha256:fefbcbdc851bfdb29e172df03d8ac280efdd3eada92b16c46b0fc15932152c6c
+              tag: 0.33.1@sha256:d30bf0b2826f0e71cf6fe1b806d918db6d90121ac70b3384569e3b49edf51b3f
               pullPolicy: IfNotPresent
             env:
               TZ: America/Chicago

kubernetes/apps/default/zwave/app/helmrelease.yaml

@@ -36,7 +36,7 @@ spec:
           app:
             image:
               repository: ghcr.io/zwave-js/zwave-js-ui
-              tag: 9.26.0@sha256:dd945bf63aca8c31763d90addf36db1f0d809c232b806d193173c329c03a183f
+              tag: 9.27.2@sha256:ac7e66f98c39fe56b6ddb5d2e9cfced8246f74658278b82f6f60bee15206ae73
             env:
               TZ: America/Chicago
               PORT: &port 80

kubernetes/apps/kube-system/fstrim.yaml

@@ -7,7 +7,7 @@ spec:
   #  nodeName: nenya
   containers:
     - name: fstrim
-      image: ghcr.io/onedr0p/kubanetics:2024.10.7
+      image: ghcr.io/onedr0p/kubanetics:2024.11.0
       securityContext:
         privileged: true
       command: ["/bin/bash", "-c", "while true; do sleep 10; done"]

kubernetes/apps/kube-system/fstrim/app/helmrelease.yaml

@@ -33,7 +33,7 @@ spec:
           app:
             image:
               repository: ghcr.io/onedr0p/kubanetics
-              tag: 2024.10.7@sha256:f1abb7d38bb45b2eeace4eba1c44763134d6e88c377deb9928f93c5d042ea9af
+              tag: 2024.11.0@sha256:12ef95790aeaad654e50d3174fab7250fb4bc60513220c0e53bc71ea4aba99e4
             env:
               SCRIPT_NAME: fstrim.sh
             probes:

kubernetes/apps/network/cloudflared/app/helmrelease.yaml

@@ -36,7 +36,7 @@ spec:
           app:
             image:
               repository: docker.io/cloudflare/cloudflared
-              tag: 2024.11.0@sha256:2c78df02e1f23ab19d4c636921f05b9ebec163b887e946f98e22e56254a5540f
+              tag: 2024.11.1@sha256:665dda65335e35a782ed9319aa63e8404f88b34d2644d30adf3e91253604ffa0
             env:
               NO_AUTOUPDATE: "true"
               TUNNEL_CRED_FILE: /etc/cloudflared/creds/credentials.json

kubernetes/apps/observability/alertmanager/silencer/helmrelease.yaml

@@ -35,7 +35,7 @@ spec:
           app:
             image:
               repository: ghcr.io/onedr0p/kubanetics
-              tag: 2024.10.7
+              tag: 2024.11.0
             env:
               SCRIPT_NAME: alertmanager-silencer.sh
               ALERTMANAGER_URL: http://alertmanager.observability.svc.cluster.local:9093

kubernetes/apps/observability/grafana/app/helmrelease.yaml

@@ -252,7 +252,7 @@ spec:
         victoria-alert:
           # renovate: depName="VictoriaMetrics - vmalert"
           gnetId: 14950
-          revision: 12
+          revision: 13
           datasource: Prometheus
         victoria-operator:
           # renovate: depName="VictoriaMetrics - operator"

kubernetes/apps/qbittorrent/cross-seed/app/externalsecret.yaml

@@ -35,8 +35,8 @@ spec:
             skipRecheck: true,
             sonarr: ["http://sonarr.default.svc.cluster.local/?apikey={{ .SONARR_API_KEY }}"],
             torrentDir: "/qbittorrent/qBittorrent/BT_backup",
-            // torznab: []
+            torznab: []
-            torznab: [
+            /* torznab: [
                   6,  // ANT
                   8,  // BLU
                   9,  // TL
@@ -44,6 +44,7 @@ spec:
                   12, // FNP
                   14, // TD
             ].map(i => `http://prowlarr.default.svc.cluster.local/$${i}/api?apikey={{ .PROWLARR_API_KEY }}`),
+            */
           };
   dataFrom:
     - extract:

kubernetes/apps/qbittorrent/flood/app/helmrelease.yaml

@@ -43,7 +43,7 @@ spec:
           app:
             image:
               repository: jesec/flood
-              tag: master@sha256:8a18a3509a6c1557b769873a1ef85dcd5fa4cbce1a939be2c6c87f97eb79de45
+              tag: master@sha256:7b0f2b863434946260621b037d293130acb9f5d9248071408c641b858ffacccf
             envFrom:
               - secretRef:
                   name: flood-secret

kubernetes/apps/qbittorrent/qbittorrent/app/helmrelease.yaml

@@ -34,7 +34,7 @@ spec:
             nameOverride: qbittorrent
             image:
               repository: ghcr.io/onedr0p/qbittorrent-beta
-              tag: 5.0.1@sha256:684422cab9fe3cba04812cf4207398bb72aa0f0283c92fddecd833648ac3f7bf
+              tag: 5.0.2@sha256:adfd625f9cc7226eabad8aa117a551d42d5818c914850ef7fa3be60111383107
             env:
               UMASK: "022"
               QBT_WEBUI_PORT: &port 80

kubernetes/apps/qbittorrent/qbittorrent/tools/helmrelease.yaml

@@ -39,7 +39,7 @@ spec:
           tagging: &container
             image:
               repository: ghcr.io/buroa/qbtools
-              tag: v0.19.7@sha256:ceb38f6794b10a8f1147dbc8a4df24857e0dae72341eaf2d435796937d77ba3a
+              tag: v0.19.8@sha256:6d24270a3b4e31bfa8bcfc21ace625a27c9c71f789ef49d8454dacddbf87e123
             env:
               TZ: *timeZone
               POD_NAMESPACE:

kubernetes/bootstrap/talos/talconfig.yaml

@@ -3,7 +3,7 @@
 clusterName: theshire
 
 # renovate: datasource=github-releases depName=siderolabs/talos
-talosVersion: v1.8.1
+talosVersion: v1.8.3
 # renovate: datasource=docker depName=ghcr.io/siderolabs/kubelet
 kubernetesVersion: 1.31.2
 endpoint: "https://10.1.1.57:6444"

kubernetes/flux/repositories/oci/grafana.yaml

@@ -12,4 +12,4 @@ spec:
     operation: copy
   url: oci://ghcr.io/grafana/helm-charts/grafana
   ref:
-    tag: 8.5.12
+    tag: 8.6.0

renovate.json5

@@ -23,8 +23,9 @@
       "(^|/)\\.taskfiles/.+\\.ya?ml(?:\\.j2)?$"
     ]
   },
-  "regexManagers": [
+  "customManagers": [
     {
+      "customType": "regex",
       "description": [
         "Process CRD dependencies - Chart and Github Release are the same version"
       ],
@@ -35,15 +36,17 @@
       "datasourceTemplate": "helm"
     },
     {
+      "customType": "regex",
       "description": ["Generic Docker image Regex manager"],
       "fileMatch": ["infrastructure/.+\\.ya?ml$", "infrastructure/.+\\.tf$"],
       "matchStrings": [
-        "# renovate: docker-image( versioning=(?<versioning>.*=?))?\n .*[:|=] \"?(?<depName>.*?):(?<currentValue>[^\"\n]*=?)\"?"
+        "# renovate: docker-image( versioning=(?<versioning>.*=?))?\\\n .*[:|=] \"?(?<depName>.*?):(?<currentValue>[^\"\\n]*=?)\"?"
       ],
       "datasourceTemplate": "docker",
       "versioningTemplate": "{{#if versioning}}{{{versioning}}}{{else}}semver{{/if}}"
     },
     {
+      "customType": "regex",
       "description": ["Raw GitHub URL Regex manager"],
       "fileMatch": ["infrastructure/.+\\.ya?ml$", "kubernetes/.+\\.ya?ml$"],
       "matchStrings": [
@@ -69,24 +72,24 @@
     {
       "description": "Flux Group",
       "groupName": "Flux",
-      "matchPackagePatterns": ["^flux", "^ghcr.io/fluxcd/"],
       "matchDatasources": ["docker", "github-tags"],
       "versioning": "semver",
       "group": {
         "commitMessageTopic": "{{{groupName}}} group"
       },
-      "separateMinorPatch": true
+      "separateMinorPatch": true,
+      "matchPackageNames": ["/^flux/", "/^ghcr.io/fluxcd//"]
     },
     {
       "description": "Mastodon images",
       "groupName": "Mastodon",
-      "matchPackagePatterns": ["mastodon", "^ghcr.io/mastodon/"],
       "matchDatasources": ["docker", "github-tags"],
       "versioning": "semver",
       "group": {
         "commitMessageTopic": "{{{groupName}}} group"
       },
-      "separateMinorPatch": true
+      "separateMinorPatch": true,
+      "matchPackageNames": ["/mastodon/", "/^ghcr.io/mastodon//"]
     },
     {
       "description": "1Password Connect images",
@@ -104,12 +107,12 @@
     {
       "description": "Rook-Ceph image and chart",
       "groupName": "Rook Ceph",
-      "matchPackagePatterns": ["rook.ceph"],
       "matchDatasources": ["docker", "helm"],
       "group": {
         "commitMessageTopic": "{{{groupName}}} group"
       },
-      "separateMinorPatch": true
+      "separateMinorPatch": true,
+      "matchPackageNames": ["/rook.ceph/"]
     },
     {
       "description": "Cilium image and chart",
@@ -128,10 +131,7 @@
     {
       "description": "External Snapshotter charts",
       "groupName": "External Snapshotter",
-      "matchPackageNames": [
+      "matchPackageNames": ["snapshot-controller", "snapshot-validation-webhook"],
-        "snapshot-controller",
-        "snapshot-validation-webhook"
-      ],
       "matchDatasources": ["helm"],
       "group": {
         "commitMessageTopic": "{{{groupName}}} group"
@@ -141,23 +141,22 @@
     {
       "description": "Thanos image and chart - versions do not match",
       "groupName": "Thanos",
-      "matchPackagePatterns": ["quay.io/thanos/thanos", "thanos"],
       "matchDatasources": ["docker", "github-releases", "helm"],
       "matchUpdateTypes": ["minor", "patch"],
       "group": {
         "commitMessageTopic": "{{{groupName}}} group"
-      }
+      },
+      "matchPackageNames": ["/quay.io/thanos/thanos/", "/thanos/"]
     },
     {
       "description": "Vector image and chart - versions do not match",
       "groupName": "Vector",
-      "matchPackagePatterns": ["vector"],
       "matchDatasources": ["docker", "github-releases", "helm"],
       "matchUpdateTypes": ["minor", "patch"],
       "group": {
         "commitMessageTopic": "{{{groupName}}} group"
-      }
+      },
+      "matchPackageNames": ["/vector/"]
     }
-    // Version strategies
   ]
 }

shell.nix

@@ -3,6 +3,11 @@
 pkgs.mkShell {
   # Enable experimental features without having to specify the argument
   NIX_CONFIG = "experimental-features = nix-command flakes";
+  shellHook = ''
+    export TMP=$(mktemp -d "/tmp/nix-shell-XXXXXX")
+    export TEMP=$TMP
+    export TMPDIR=$TMP
+  '';
 
   nativeBuildInputs = with pkgs; [
     fluxcd