100 Commits

This Branch

This Branch

All Branches

Author	SHA1	Message	Date
forust	41f18ea993	fix(deploy): move netbird from compose to k8s ... netbird runs in-cluster; the root active marker made apply-compose pick up netbird/compose.yaml and fail on gitignored .env vars. Drop the compose marker and enable k8s/active instead.	2026-09-26 17:24:03 +02:00
forust	91c344fe2c	fix(monitoring): disable control-plane alerts and scrapes on k0s ... k0s runs kube-controller-manager, kube-scheduler and etcd inside its own process rather than as pods, so the chart's Services never get endpoints and the targets stay permanently absent. Drop the matching ServiceMonitors and their Down/HighCommitDurations rules; kube-proxy and kubelet do get endpoints on k0s and stay enabled.	2026-09-26 17:16:55 +02:00
forust	cab6ef2102	Merge branch 'feat/netbird'	2026-09-26 17:05:55 +02:00
forust	a2ff9515a3	fix(deploy): validate compose without workstation secrets ... docker compose config required real values for gitignored .env files and secrets, so validate always failed on stacks with :? guards (netbird, netbox). Validate structure only via --no-interpolate, --no-env-resolution and --no-path-resolution, keeping normalization and consistency checks.	2026-09-26 17:00:43 +02:00
forust	62d39ee4f1	Merge pull request 'chore(deps): update netbirdio/dashboard docker tag to v2.93.0' (#53) from renovate/netbirdio-dashboard-2.x into main ... Reviewed-on: https://gitea.forust.xyz/forust/homelab/pulls/53	2026-09-25 22:27:21 +00:00
forust	f4df6d4437	Merge pull request 'chore(deps): update container patch updates' (#38) from renovate/container-patch-updates into main ... Reviewed-on: https://gitea.forust.xyz/forust/homelab/pulls/38	2026-09-25 22:18:21 +00:00
forust	b423119632	Merge pull request 'chore(deps): update renovate/renovate docker tag to v44.115.9' (#47) from renovate/renovate-renovate-44.x into main ... Reviewed-on: https://gitea.forust.xyz/forust/homelab/pulls/47	2026-09-25 22:17:46 +00:00
forust	6ad33d75e6	Merge pull request 'chore(deps): update prom/prometheus docker tag to v3.15.0' (#48) from renovate/prom-prometheus-3.x into main ... Reviewed-on: https://gitea.forust.xyz/forust/homelab/pulls/48	2026-09-25 22:17:15 +00:00
forust	b7a1835adb	Merge pull request 'feat(netbird): add tailscale-alternative' (#50) from feat/netbird into main ... Reviewed-on: https://gitea.forust.xyz/forust/homelab/pulls/50	2026-09-25 22:16:51 +00:00
forust	ad4bb8750d	chore(deploy): enable netbird	2026-09-25 22:16:02 +00:00
forust	f1e00b946f	Merge pull request 'Feat/documenting services' (#51) from feat/documenting-services into main ... Reviewed-on: https://gitea.forust.xyz/forust/homelab/pulls/51	2026-09-25 22:15:45 +00:00
forust	7ee7d0c961	Update README.md	2026-09-26 00:15:01 +02:00
forust	27ab6b859e	chore(deploy): enable netbird	2026-09-26 00:04:50 +02:00
forust	71e769c002	chore(deploy): disable checkmk, enable netbox and rackpeek	2026-09-26 00:04:37 +02:00
forust	16dd67c2c0	feat(rackpeek): add internal-only rack visualization service ... Compose and k8s manifests behind workstation/gigaforust internal hosts.	2026-09-26 00:00:49 +02:00
forust	c536a16a2a	feat(netbox): add enterprise-grade server documenting app w/ shared postgres	2026-09-25 23:24:21 +02:00
forust	a4a4bb4cc5	feat(netbird): add tailscale-alternative	2026-09-25 20:26:11 +02:00
forust	648b354951	refactor(deploy): marker-driven selection (k8s/active, root active); enable headscale/nextcloud hybrid, disable dockmon/kener/downtify/n8n	2026-09-23 18:11:51 +02:00
forust	b0a9b3476d	fix(deploy): drop broken %q quoting that wrapped remote vars in literal quotes	2026-09-23 16:33:51 +02:00
forust	ac3bf4a55a	fix(deploy): strip quotes and CR from DEPLOY_PATH	2026-09-23 16:31:06 +02:00
forust	34fb6f85ba	Merge pull request 'chore(deps): update darthnorse/dockmon docker tag to v2.5.0' (#39) from renovate/darthnorse-dockmon-2.x into main ... Reviewed-on: https://gitea.forust.xyz/forust/homelab/pulls/39	2026-09-23 14:16:21 +00:00
forust	54f43fc2c7	Merge pull request 'chore(deps): update ghcr.io/lukegus/termix docker tag to v2.8.0' (#40) from renovate/ghcr.io-lukegus-termix-2.x into main ... Reviewed-on: https://gitea.forust.xyz/forust/homelab/pulls/40	2026-09-23 14:16:06 +00:00
forust	88ae20a543	Merge pull request 'chore(deps): update ghcr.io/henriquesebastiao/downtify docker tag to v3' (#42) from renovate/ghcr.io-henriquesebastiao-downtify-3.x into main ... Reviewed-on: https://gitea.forust.xyz/forust/homelab/pulls/42	2026-09-23 14:15:51 +00:00
forust	aeefdd8560	Merge pull request 'chore(deps): update docker.n8n.io/n8nio/n8n docker tag to v2.41.0' (#43) from renovate/docker.n8n.io-n8nio-n8n-2.x into main ... Reviewed-on: https://gitea.forust.xyz/forust/homelab/pulls/43	2026-09-23 14:14:39 +00:00
forust	6e5f80611b	Merge pull request 'Cicd/deploy rework' (#44) from cicd/deploy-rework into main ... Reviewed-on: https://gitea.forust.xyz/forust/homelab/pulls/44	2026-09-23 14:11:42 +00:00
forust	5cf0c90258	style: prettier formatting for edu_master alerts and postgres readme	2026-09-23 16:10:33 +02:00
forust	90a452a253	feat(deploy): auto-rollout on push to main (gated by branch protection)	2026-09-23 15:58:15 +02:00
forust	a9eabfba02	fix(userbot): include internal-certificate in kustomize base	2026-09-23 15:52:32 +02:00
forust	46c7e99b1d	chore(deploy): rework k8s pipeline, monitoring and postgres 17 ... Deploy workflow uses git-tracked manifests, DISABLED flag and kustomize overlays; add webinar-checker metrics with ServiceMonitor and alerts; upgrade shared postgres to 17 with statuspage DB and probes/resources.	2026-09-23 15:47:26 +02:00
forust	8b2cf29771	feat(tls): internal CA wildcard for *.internal routes	2026-09-23 14:47:14 +02:00
forust	7b7fc3bcb0	fix(tls): drop internal certs for dormant namespaces (kener, downtify have no ns live)	2026-09-23 14:46:09 +02:00
forust	bc1e69ebe0	feat(tls): internal CA wildcard for *.internal routes ... Selfsigned root (10y) + internal-ca issuer; per-namespace internal-wildcard-tls certs referenced by all -local routers. Root public cert committed for client trust stores.	2026-09-23 14:45:05 +02:00
forust	f29bb3d580	revert: drop Grafana cert-manager dashboard	2026-09-23 14:42:09 +02:00
forust	1f7166026b	feat(observability): cert-manager metrics, dashboard and alerts	2026-09-23 14:32:36 +02:00
forust	1cbdfc1d6f	feat(observability): cert-manager metrics, dashboard and alerts ... - ServiceMonitor for cert-manager (release: prometheus-stack) - Grafana dashboard Cert-manager-Kubernetes (ID 22908, datasource refs fixed) via dashboard sidecar ConfigMap - PrometheusRule: NotReady (crit), expiry <14d (warn) / <7d (crit), ACME 429 rate-limit (warn)	2026-09-23 14:32:36 +02:00
forust	6be3769288	feat(tls): migrate public ingress TLS from Traefik ACME to cert-manager ... Big-bang: 24 Certificates (HTTP-01, letsencrypt-prod) replace Traefik certResolver on all prod IngressRoutes. Traefik certificatesResolvers removed (its acme-http router hijacked HTTP-01 for every host). AdGuard DoT shares the cert-manager adguard-certs secret; sync CronJob retired. Dormant files converted, n8n untouched (live-only deletion rule).	2026-09-23 14:16:23 +02:00
forust	ef325cd3b1	feat(tls): migrate public ingress TLS from Traefik ACME to cert-manager ... All prod IngressRoutes switch tls.certResolver to tls.secretName backed by per-router Certificates (HTTP-01, letsencrypt-prod). adguard-prod reuses the shared adguard-certs secret (also feeds DoT :853); sync CronJob removed as redundant. Traefik certificatesResolvers removed: its internal acme-http@internal router hijacks HTTP-01 for every host while enabled, blocking external solvers. Dormant files (kener, downtify) converted for consistency but not applied; n8n untouched per live-only rule.	2026-09-23 14:12:36 +02:00
forust	aa81f1bf8a	feat(adguard): Traefik-synced TLS for AdGuard DoT + reloader ... - CronJob mirrors Traefik prod cert dns.forust.xyz into adguard-certs (cert-manager HTTP-01 is hijacked by Traefik acme-http router, see adguardhome/k8s/cert-sync.yaml) - reloader for auto-restart on secret rotation - drop retired adguard.forust.xyz from prod route - traefik: enable kubernetesIngress, drop unused staging resolver	2026-09-23 14:04:14 +02:00
forust	93d768e988	fix(adguard): split deployment RBAC rule for list/watch ... Collection verbs cannot combine with resourceNames (grant would be void). Instance verbs stay name-scoped to adguard-deployment; list/watch is namespace-scoped (single Deployment in ns).	2026-09-23 13:54:06 +02:00
forust	a8f7c79934	fix(adguard): sync job RBAC and idempotency ... - grant list+watch on adguard-deployment (rollout status hung without it, job hit activeDeadline and failed) - compare content digests only (old hash embedded filenames, so every run patched + restarted even when in sync) Keeps explicit rollout restart alongside reloader annotation: one extra restart per rotation (~60d) is accepted for determinism if reloader is down.	2026-09-23 13:52:57 +02:00
forust	c42bf14c9a	fix(adguard): drop retired adguard.forust.xyz from prod route so dns.forust.xyz gets LE cert ... adguard.forust.xyz is NXDOMAIN (host retired); the combo SAN cert kept failing and dns.forust.xyz served TRAEFIK DEFAULT CERT. Scope prod route to dns.forust.xyz only. Also commit live traefik-values state (remove letsencrypt-staging resolver, live since helm rev 33).	2026-09-23 13:42:04 +02:00
forust	1e8479b853	feat(adguard): sync Traefik prod cert for dns.forust.xyz into adguard-certs ... CronJob adguard-cert-sync (daily 03:17) copies the public cert/key for dns.forust.xyz from Traefik acme.json into Secret adguard-certs, which AdGuard mounts for DNS-over-TLS on :853. - least-privilege RBAC: read pods/exec in ns traefik, get/update/patch Secret adguard-certs and get/patch adguard-deployment in ns adguard - script selects the PROD resolver entry only, matches main domain or SANs, compares sha256 hashes, patches the secret and restarts the deployment ONLY on change; exits non-zero and touches nothing when Traefik holds no cert yet (HTTP-01 currently cannot complete)	2026-09-23 13:39:38 +02:00
forust	c139d700f1	feat(adguard,traefik,cert-manager,reloader): foundation for adguard cert sync ... - traefik: enable kubernetesIngress provider (needed for cert-manager HTTP-01) - adguard: add reloader auto annotation for secret-driven restarts - cert-manager: namespace, helm values (crds), staging+prod ClusterIssuers - reloader: namespace manifest	2026-09-23 13:19:26 +02:00
forust	67b9996911	fix(renovate): default endpoint to gitea API URL ... Fall back to https://gitea.forust.xyz/api/v1 when RENOVATE_ENDPOINT is unset, in both local config and in-cluster ConfigMap.	2026-09-23 13:06:19 +02:00
forust	4e9ee567ca	Merge pull request 'chore(deps): update renovate/renovate docker tag to v44.106.0' (#41) from renovate/renovate-renovate-44.x into main ... Reviewed-on: https://gitea.forust.xyz/forust/homelab/pulls/41	2026-09-21 20:03:24 +00:00
forust	9c4580a522	fix(prometheus): exclude xui services from TraefikServiceHighLatency ... Long-lived VPN WebSocket sessions inflate P95 request duration; keep 5xx/down/cert alerts for xui unchanged.	2026-09-19 19:06:42 +02:00
forust	4e3ad00202	feat(xui): add 3x-ui VPN panel behind cloudflared tunnel ... VLESS+WS inbound (port 10000) via Traefik IngressRoute, panel on internal domains only with public route commented out. gitignore now covers nested k8s secrets and local-only grafana values.	2026-09-19 19:06:37 +02:00
forust	86ac43567d	chore(renovate): sync pins to 44.103.0	2026-09-18 22:21:48 +02:00
forust	35bf980bda	Merge branch 'main' of https://gitea.forust.xyz/forust/homelab	2026-09-18 22:19:57 +02:00
forust	51677ae184	ci: run all lint jobs natively without docker	2026-09-18 22:18:59 +02:00
forust	c9e6fc0e2b	ci: run ruff and yamllint natively, cache npm ... Ruff and yamllint ship in Arch repos, drop their container pulls. Prettier keeps the node container but mounts persistent npm cache. Hadolint and kubeconform stay containerized (AUR-only / hermetic pin).	2026-09-18 19:41:02 +02:00
forust	ab386fc436	ci: keep gitea workflows only, harden and speed up pipelines ... Drop duplicated .github/workflows (helm blocks ported to .gitea deploy first). Add ci concurrency with cancel on branches, pin checkout to SHA and prettier to 3.9.8, registry layer cache for image builds. renovate-run gains config validation and dry-run input.	2026-09-18 19:38:56 +02:00
forust	7e17ae638a	Merge pull request 'chore(deps): update container patch updates' (#35) from renovate/container-patch-updates into main ... Reviewed-on: https://gitea.forust.xyz/forust/homelab/pulls/35	2026-09-18 17:20:48 +00:00
forust	69e7df6a63	Merge pull request 'chore(deps): update renovate/renovate docker tag to v44.103.0' (#36) from renovate/renovate-renovate-44.x into main ... Reviewed-on: https://gitea.forust.xyz/forust/homelab/pulls/36	2026-09-18 17:20:39 +00:00
forust	dfd9cc6fbf	Merge pull request 'chore(deps): update cloudflare/cloudflared docker tag to v2026.9.1' (#37) from renovate/cloudflare-cloudflared-2026.x into main ... Reviewed-on: https://gitea.forust.xyz/forust/homelab/pulls/37	2026-09-18 17:20:31 +00:00
forust	7f0bd5f609	feat(renovate): add manual run pipeline and sync configs ... renovate-run workflow_dispatch runs pinned renovate via docker on self-hosted runner. Sync helm-values manager into config.js/configmap, bump compose and validator pins to 44.97.2.	2026-09-18 19:15:11 +02:00
forust	043923fc64	style(crowdsec): fix prettier formatting in grafana dashboards	2026-09-18 19:07:46 +02:00
forust	f0f8a35b0f	Merge branch 'main' of https://gitea.forust.xyz/forust/homelab ... # Conflicts: # postgres/k8s/postgres.yaml	2026-09-18 19:05:56 +02:00
forust	f5f389b440	chore(ci): deploy loki alloy and track helm values in renovate ... Deploy hook installs loki 7.3.0 and alloy 1.12.1 when loki/k8s/active exists. Renovate watches k8s values files.	2026-09-18 19:02:46 +02:00
forust	7cca330438	feat(crowdsec): switch agent to loki acquisition with static identity ... Read traefik logs from Loki instead of file tail. Static machine identity via pre-created secret stops 403 register races. Add janitor cronjob, dashboards, whitelists and metrics.	2026-09-18 19:02:43 +02:00
forust	5936de3e56	fix(alertmanager): quote null receiver and wire telegram template ... Unquoted null parses as YAML null and breaks routing. Add shared telegram message template.	2026-09-18 19:02:41 +02:00
forust	c98ea8b957	feat(monitoring): align storage to live pvc, add loki datasource and alerts ... Match grafana/alertmanager storageClass to live PVCs to avoid immutable-field failures. Add Loki datasource and LokiDown/AlloyDown alerts.	2026-09-18 19:02:38 +02:00
forust	34c33697bb	feat(loki): add single-binary loki and alloy stack ... Filesystem storage on local-path-retain, 14d retention. Alloy daemonset ships k8s pod logs to loki-gateway.	2026-09-18 19:02:36 +02:00
forust	92bd920113	Merge pull request 'chore(deps): update postgres docker tag to v17.11' (#34) from renovate/postgres-17.x into main ... Reviewed-on: https://gitea.forust.xyz/forust/homelab/pulls/34	2026-09-17 18:04:58 +00:00
forust	60b9766449	Merge pull request 'chore(deps): update ghcr.io/henriquesebastiao/downtify docker tag to v2.13.0' (#32) from renovate/ghcr.io-henriquesebastiao-downtify-2.x into main ... Reviewed-on: https://gitea.forust.xyz/forust/homelab/pulls/32	2026-09-17 17:58:27 +00:00
forust	ce21c60eba	Merge pull request 'chore(deps): update renovate/renovate docker tag to v44.97.2' (#33) from renovate/renovate-renovate-44.x into main ... Reviewed-on: https://gitea.forust.xyz/forust/homelab/pulls/33	2026-09-17 17:58:15 +00:00
forust	4953da2dd7	Merge pull request 'Feat/centralized postgres' (#26) from feat/centralized-postgres into main ... Reviewed-on: https://gitea.forust.xyz/forust/homelab/pulls/26	2026-09-17 17:55:58 +00:00
forust	4ac65f743c	lint(postgres): 126:77 error no new line character at the end of file (new-line-at-end-of-file)	2026-09-17 17:55:50 +00:00
forust	8f2e9d66c8	chore(gite): updated deprecated access log config	2026-09-17 17:55:50 +00:00
forust	c7d42fb90a	feat(postgres): migrate gitea to shared postgres database	2026-09-17 17:55:50 +00:00
forust	003b1e5dca	feat(postgres): upgrade shared database to PostgreSQL 17 ... Move the shared postgres service from 15.19 to 17.6 as the postgres17 StatefulSet with its own PVC, extend the initdb and ingress policy with the statuspage database, and drop the now-unused per-app postgres manifests for authentik, gitea and netronome.	2026-09-17 17:55:50 +00:00
forustandCopilot	b3463705c3	feat(postgres): migrate apps to shared database ... Move Authentik and Netronome to the shared PostgreSQL service after logical dump and restore. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>	2026-09-17 17:55:50 +00:00
forust	52e1f50a80	feat(postgres): add shared database deployments	2026-09-17 17:55:50 +00:00
forust	cdc2f10fe8	Merge pull request 'chore(deps): update container patch updates' (#30) from renovate/container-patch-updates into main ... Reviewed-on: https://gitea.forust.xyz/forust/homelab/pulls/30	2026-09-17 17:55:32 +00:00
forust	ac795feeed	Merge pull request 'chore(deps): update ghcr.io/alexta69/metube docker tag to v2026.09.15' (#31) from renovate/ghcr.io-alexta69-metube-2026.x into main ... Reviewed-on: https://gitea.forust.xyz/forust/homelab/pulls/31	2026-09-17 17:55:11 +00:00
forust	82949613db	fix(cloudflared): drop bogus exec livenessProbe that SIGTERMed the tunnel	2026-09-17 19:34:28 +02:00
forust	47d788ca13	feat(cloudflared): add Cloudflare Tunnel deployment (token-based, cfddns-style)	2026-09-17 19:09:02 +02:00
forust	77be606912	Merge pull request 'chore(deps): update grafana/grafana docker tag to v13.2.2' (#28) from renovate/container-patch-updates into main ... Reviewed-on: https://gitea.forust.xyz/forust/homelab/pulls/28	2026-09-15 12:07:56 +00:00
forust	6c24d4fb17	Merge pull request 'chore(deps): update renovate/renovate docker tag to v44.91.0' (#27) from renovate/renovate-renovate-44.x into main ... Reviewed-on: https://gitea.forust.xyz/forust/homelab/pulls/27	2026-09-15 12:07:44 +00:00
forust	e07537ff8b	Merge pull request 'chore(deps): update docker.n8n.io/n8nio/n8n docker tag to v2.40.0' (#29) from renovate/docker.n8n.io-n8nio-n8n-2.x into main ... Reviewed-on: https://gitea.forust.xyz/forust/homelab/pulls/29	2026-09-15 12:07:27 +00:00
forust	1e66b5f344	lint(postgres): 126:77 error no new line character at the end of file (new-line-at-end-of-file)	2026-09-14 11:56:23 +00:00
forust	d638a2c1f9	chore(gite): updated deprecated access log config	2026-09-14 11:56:23 +00:00
forust	b8512c6033	feat(postgres): migrate gitea to shared postgres database	2026-09-14 11:56:23 +00:00
forust	3e057ea18d	feat(postgres): upgrade shared database to PostgreSQL 17 ... Move the shared postgres service from 15.19 to 17.6 as the postgres17 StatefulSet with its own PVC, extend the initdb and ingress policy with the statuspage database, and drop the now-unused per-app postgres manifests for authentik, gitea and netronome.	2026-09-14 11:56:23 +00:00
forustandCopilot	77113fb629	feat(postgres): migrate apps to shared database ... Move Authentik and Netronome to the shared PostgreSQL service after logical dump and restore. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>	2026-09-14 11:56:23 +00:00
forust	a3a0ab92b7	feat(postgres): add shared database deployments	2026-09-14 11:56:23 +00:00
forust	68fb5eb45e	Merge pull request 'chore(deps): update renovate/renovate docker tag to v44.85.0' (#25) from renovate/renovate-renovate-44.x into main ... Reviewed-on: https://gitea.forust.xyz/forust/homelab/pulls/25	2026-09-14 09:48:39 +00:00
forust	82124017c0	Merge pull request 'chore(deps): update redis docker tag to v8.10.1' (#23) from renovate/redis-8.x into main ... Reviewed-on: https://gitea.forust.xyz/forust/homelab/pulls/23	2026-09-14 09:46:49 +00:00
forust	a4f8218b5e	Merge pull request 'chore(deps): update valkey/valkey docker tag to v9' (#24) from renovate/valkey-valkey-9.x into main ... Reviewed-on: https://gitea.forust.xyz/forust/homelab/pulls/24	2026-09-14 09:46:24 +00:00
forust	9ca8514a0a	Merge pull request 'chore(deps): update renovate/renovate docker tag to v44.84.0' (#21) from renovate/renovate-renovate-44.x into main ... Reviewed-on: https://gitea.forust.xyz/forust/homelab/pulls/21	2026-09-14 09:07:55 +00:00
forust	c6d8df2317	Merge pull request 'chore(deps): update ghcr.io/goauthentik/server docker tag to v2026' (#22) from renovate/ghcr.io-goauthentik-server-2026.x into main ... Reviewed-on: https://gitea.forust.xyz/forust/homelab/pulls/22	2026-09-14 09:07:41 +00:00
forust	25f547ff78	Merge pull request 'chore(deps): update docker.n8n.io/n8nio/n8n docker tag to v2.39.5' (#18) from renovate/docker.n8n.io-n8nio-n8n-2.x into main ... Reviewed-on: https://gitea.forust.xyz/forust/homelab/pulls/18	2026-09-14 09:04:42 +00:00
forust	663675f9a0	Merge pull request 'chore(deps): update ghcr.io/goauthentik/server docker tag to v2025.12.6' (#19) from renovate/ghcr.io-goauthentik-server-2025.x into main ... Reviewed-on: https://gitea.forust.xyz/forust/homelab/pulls/19	2026-09-14 09:03:35 +00:00
forust	b5d6f75330	Merge pull request 'chore(deps): update mcr.microsoft.com/playwright docker tag to v1.63.0' (#20) from renovate/mcr.microsoft.com-playwright-1.x into main ... Reviewed-on: https://gitea.forust.xyz/forust/homelab/pulls/20	2026-09-14 09:02:49 +00:00
forust	7799b676ca	ci: validate Renovate manifests with kubeconform	2026-09-14 10:51:40 +02:00
forustandCopilot	24d3686f60	ci: fix formatting and YAML lint scope ... Lint tracked YAML files without scanning generated dependencies. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>	2026-09-14 09:30:55 +02:00
forust	b8b3bba264	Merge branch 'feat/renovate'	2026-09-14 09:16:43 +02:00
forustandCopilot	abfbc04067	fix(infra): align monitoring and Gitea database config ... Keep CrowdSec scraping explicit and define Gitea's database name. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>	2026-09-14 09:16:01 +02:00
forustandCopilot	23ed72826a	chore(images): pin service image updates ... Replace floating service images with reviewable tags or digests. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>	2026-09-14 09:16:01 +02:00
forustandCopilot	7288058df6	feat(renovate): add Gitea update automation ... Run Renovate in Kubernetes to create reviewed image update PRs. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>	2026-09-14 09:16:01 +02:00