chore(argocd): enforce api write-back and pin image tags

jellyfin_values.yml

@@ -1,7 +1,7 @@
 ---
 image:
   repository: docker.io/jellyfin/jellyfin
-  tag: ""
+  tag: "latest@sha256:96b09723b22fdde74283274bdc1f63b9b76768afd6045dd80d4a4559fc4bb7f3"
   pullPolicy: Always
 
 service:
@@ -17,9 +17,29 @@ persistence:
 resources:
   requests:
     memory: "2Gi"
-    cpu: "3"
+    cpu: "1"
     ephemeral-storage: "50Mi"
   limits:
     memory: "6Gi"
-    cpu: "4"
+    cpu: "1"
     ephemeral-storage: "1Gi"
+
+nodeSelector:
+  kubernetes.io/arch: amd64
+
+securityContext:
+  capabilities:
+    add:
+      - "SYS_ADMIN"
+    drop:
+      - "ALL"
+  privileged: false
+
+volumes:
+  - name: hwa
+    hostPath:
+      path: /dev/dri
+
+volumeMounts:
+  - name: hwa
+    mountPath: /dev/dri