Conventions batch 4: env blocks, homeassistant className default, strict clusterIssuer

- apache-tika, gotenberg, cyberchef, homeassistant, patchmon: additive env
  value blocks rendered through tpl (value, secretKeyRef and configMapKeyRef
  forms), following the template-chart/outline pattern; patchmon gets separate
  blocks for the server container and the guacd sidecar.
- homeassistant: ingress.className now defaults to nginx; an empty className
  omits ingressClassName from the rendered Ingress, so the flexible upstream
  ingress style stays intact.
- outline, paperless-ngx: remove the ingress.clusterIssuer defaults
  (letsencrypt / letsencrypt-issuer) - the value is now strictly required,
  consistent with the repo-wide ingress standard; CI test-values set it
  explicitly.

Chart bumps: apache-tika 7.2.0, gotenberg 4.2.0, cyberchef 5.2.0,
patchmon 5.2.0, homeassistant 4.2.0 (minor); outline 5.0.0,
paperless-ngx 10.0.0 (major).

homeassistant/Chart.yaml

@@ -4,7 +4,7 @@ description: A Helm chart to deploy Home Assistant on Kubernetes
 icon: https://www.home-assistant.io/images/home-assistant-logo.svg
 type: application
 
-version: 4.1.2+up2026.8.3
+version: 4.2.0+up2026.8.3
 
 appVersion: "2026.8.3"
 

homeassistant/templates/homeassistant.ingress.yaml

@@ -10,7 +10,9 @@ metadata:
     {{- toYaml . | nindent 4 }}
   {{- end }}
 spec:
-  ingressClassName: {{ .Values.ingress.className }}
+  {{- with .Values.ingress.className }}
+  ingressClassName: {{ . }}
+  {{- end }}
   {{- if .Values.ingress.tls }}
   tls:
     {{- range .Values.ingress.tls }}

homeassistant/templates/homeassistant.sfs.yaml

@@ -28,6 +28,26 @@ spec:
           env:
             - name: TZ
               value: "{{ .Values.core.timezone }}"
+            {{- range $value := .Values.env }}
+            {{- if $value.value }}
+            - name: {{ $value.name | quote }}
+              value: {{ tpl $value.value $ | quote }}
+            {{- else if $value.valueFrom }}
+            {{- if $value.valueFrom.secretKeyRef }}
+            - name: {{ $value.name }}
+              valueFrom:
+                secretKeyRef:
+                  name: {{ tpl $value.valueFrom.secretKeyRef.name $ | quote }}
+                  key: {{ tpl $value.valueFrom.secretKeyRef.key $ | quote }}
+            {{- else if $value.valueFrom.configMapKeyRef }}
+            - name: {{ $value.name }}
+              valueFrom:
+                configMapKeyRef:
+                  name: {{ tpl $value.valueFrom.configMapKeyRef.name $ | quote }}
+                  key: {{ tpl $value.valueFrom.configMapKeyRef.key $ | quote }}
+            {{- end }}
+            {{- end }}
+            {{- end }}
           ports:
             - name: http
               containerPort: 8123

homeassistant/values.yaml

@@ -18,7 +18,8 @@ service:
 # This block is for setting up the ingress for more information can be found here: https://kubernetes.io/docs/concepts/services-networking/ingress/
 ingress:
   enabled: false
-  className: ""
+  # Ingress class; set to "" to omit ingressClassName from the rendered Ingress.
+  className: nginx
   annotations: {}
     # kubernetes.io/ingress.class: nginx
     # kubernetes.io/tls-acme: "true"
@@ -87,6 +88,11 @@ startupProbe:
   timeoutSeconds: 5
   failureThreshold: 30
 
+# Extra environment variables, appended to the ones the chart always sets.
+# Values are rendered through tpl; value, secretKeyRef and configMapKeyRef
+# forms are supported.
+env: []
+
 # Additional volumes on the output Deployment definition.
 volumes: []
 # - name: foo