chore(config): migrate config renovate.json

.gitea/workflows/deploy-lib.sh

@@ -89,27 +89,10 @@ stage_validate() {
   cd "$REPO"
   select_manifests
   local m k cf
-  # Compose .env files and secret files are gitignored by design, so the
-  # workstation never has real values for them. Validate structure only:
-  # skip interpolation, env-file resolution, and path resolution so that
-  # required-variable guards (:?) and missing local files don't fail CI.
-  # Normalization and consistency checks stay enabled.
-  local compose_validate_flags=()
-  local compose_config_help
-  compose_config_help="$(docker compose config --help 2>/dev/null || true)"
-  if printf '%s' "$compose_config_help" | grep -q -- '--no-interpolate'; then
-    compose_validate_flags+=(--no-interpolate)
-  fi
-  if printf '%s' "$compose_config_help" | grep -q -- '--no-env-resolution'; then
-    compose_validate_flags+=(--no-env-resolution)
-  fi
-  if printf '%s' "$compose_config_help" | grep -q -- '--no-path-resolution'; then
-    compose_validate_flags+=(--no-path-resolution)
-  fi
   log "Validate compose stacks"
   for cf in ${COMPOSE_STACKS[@]+"${COMPOSE_STACKS[@]}"}; do
     echo "  config: $cf"
-    docker compose -f "$cf" config --quiet "${compose_validate_flags[@]}"
+    docker compose -f "$cf" config --quiet
   done
   log "Validate k8s manifests (kubectl dry-run=client)"
   for m in ${K8S_MANIFESTS[@]+"${K8S_MANIFESTS[@]}"}; do

.gitea/workflows/deploy.yaml

@@ -8,7 +8,7 @@ on:
 
 concurrency:
   group: deploy-main
-  cancel-in-progress: true
+  cancel-in-progress: false
 
 env:
   DEPLOY_HOST: ${{ secrets.DEPLOY_HOST }}

edu_master/k8s/alerts.yaml

@@ -11,14 +11,9 @@ spec:
       rules:
         # No successful webinar check for 5m (~2-3 missed 2-min checks).
         # Catches: playwright hangs/timeouts, version skew, site changes, hung job.
-        # The last_success > 0 guard is mandatory: checker.py initialises
-        # last_success to 0, so without it `time() - 0` equals the current epoch
-        # and humanizeDuration renders ~20722d on every pod restart. Keep the
-        # duration expression on the left so $value stays the real gap.
         - alert: WebinarCheckerNoSuccessfulCheck
           expr: |
-            ((time() - webinar_check_last_success_timestamp_seconds) > 300)
-              and (webinar_check_last_success_timestamp_seconds > 0)
+            (time() - webinar_check_last_success_timestamp_seconds > 300)
               and (webinar_check_last_run_timestamp_seconds > 0)
           for: 2m
           labels:
@@ -27,20 +22,6 @@ spec:
             summary: "Webinar checker has no successful check for 5m"
             description: "edu-master/webinar-checker: last successful webinar check was {{ $value | humanizeDuration }} ago. Checks are failing or hanging (see consecutive failures alert). Notifications about new webinars are NOT being sent."
 
-        # Checks are running but none has ever succeeded since pod start.
-        # Split out from the rule above so a zeroed gauge never feeds
-        # humanizeDuration.
-        - alert: WebinarCheckerNeverSucceeded
-          expr: |
-            (webinar_check_last_success_timestamp_seconds == 0)
-              and (webinar_check_last_run_timestamp_seconds > 0)
-          for: 10m
-          labels:
-            severity: critical
-          annotations:
-            summary: "Webinar checker has never completed a successful check"
-            description: 'edu-master/webinar-checker: checks have been running for 10m but not one has ever succeeded since the pod started, so every check is failing. Check pod logs (Loki: {namespace="edu-master", container="webinar-checker"}).'
-
         # Fast path: 3 consecutive failures (~6+ min at 2-min interval).
         - alert: WebinarCheckerConsecutiveFailures
           expr: |

metube/compose.yaml

@@ -1,6 +1,6 @@
 services:
   metube:
-    image: ghcr.io/alexta69/metube:2026.09.26
+    image: ghcr.io/alexta69/metube:2026.09.25
     container_name: metube
     restart: unless-stopped
     # ports:

metube/k8s/metube.yaml

@@ -27,7 +27,7 @@ spec:
     spec:
       containers:
         - name: metube
-          image: ghcr.io/alexta69/metube:2026.09.26
+          image: ghcr.io/alexta69/metube:2026.09.25
           envFrom:
             - configMapRef:
                 name: metube-config

netbird/compose.yaml

@@ -87,7 +87,7 @@ services:
       - proxy
 
   dashboard:
-    image: netbirdio/dashboard:v2.93.0
+    image: netbirdio/dashboard:v2.90.10
     container_name: netbird-dashboard
     restart: unless-stopped
     environment:

netbird/k8s/netbird.yaml

@@ -137,7 +137,7 @@ spec:
     spec:
       containers:
         - name: dashboard
-          image: netbirdio/dashboard:v2.93.0
+          image: netbirdio/dashboard:v2.90.10
           envFrom:
             - configMapRef:
                 name: netbird-config

prometheus-stack/k8s/grafana-values.yaml

@@ -69,18 +69,3 @@ alertmanager:
 defaultRules:
   disabled:
     CPUThrottlingHigh: true
-    KubeControllerManagerDown: true
-    KubeSchedulerDown: true
-    KubeEtcdDown: true
-    KubeEtcdHighCommitDurations: true
-
-# k0s runs controller-manager/scheduler/etcd internally, not as pods with
-# component=kube-controller-manager/kube-scheduler/k8s-app=kube-etcd labels.
-# Their Services get no endpoints, so the targets are permanently down.
-# kube-proxy and kubelet have endpoints on k0s, keep them enabled.
-kubeControllerManager:
-  enabled: false
-kubeScheduler:
-  enabled: false
-kubeEtcd:
-  enabled: false

renovate.json

@@ -1,7 +1,13 @@
 {
   "$schema": "https://docs.renovatebot.com/renovate-schema.json",
   "extends": ["config:recommended"],
-  "enabledManagers": ["dockerfile", "docker-compose", "kubernetes", "helm-values", "custom.regex"],
+  "enabledManagers": [
+    "dockerfile",
+    "docker-compose",
+    "kubernetes",
+    "helm-values",
+    "custom.regex"
+  ],
   "helm-values": {
     "managerFilePatterns": ["/k8s/.+values\\.ya?ml$/"]
   },
@@ -12,7 +18,10 @@
     {
       "customType": "regex",
       "description": "singlesource: playwright npm version pinned in npx command (k8s + compose)",
-      "fileMatch": ["^edu_master/k8s/playwright\\.yaml$", "^edu_master/compose\\.yaml$"],
+      "managerFilePatterns": [
+        "/^edu_master/k8s/playwright\\.yaml$/",
+        "/^edu_master/compose\\.yaml$/"
+      ],
       "matchStrings": ["playwright@(?<currentValue>\\d+\\.\\d+\\.\\d+)"],
       "datasourceTemplate": "npm",
       "depNameTemplate": "playwright"
@@ -20,7 +29,7 @@
     {
       "customType": "regex",
       "description": "singlesource: PLAYWRIGHT_VERSION file",
-      "fileMatch": ["^edu_master/PLAYWRIGHT_VERSION$"],
+      "managerFilePatterns": ["/^edu_master/PLAYWRIGHT_VERSION$/"],
       "matchStrings": ["^(?<currentValue>\\d+\\.\\d+\\.\\d+)$"],
       "datasourceTemplate": "pypi",
       "depNameTemplate": "playwright"

renovate/k8s/cronjob.yaml

@@ -16,7 +16,7 @@ spec:
           restartPolicy: Never
           containers:
             - name: renovate
-              image: renovate/renovate:44.115.10
+              image: renovate/renovate:44.115.9
               env:
                 - name: RENOVATE_PLATFORM
                   value: gitea

searxng/compose.yaml

@@ -3,7 +3,7 @@
 services:
   core:
     container_name: searxng-core
-    image: docker.io/searxng/searxng:${SEARXNG_VERSION:-2026.9.25-12f8b6515}
+    image: docker.io/searxng/searxng:${SEARXNG_VERSION:-2026.09.13-d4ce87c23}
     restart: unless-stopped
     # ports:
     # - ${SEARXNG_PORT:-8080}

searxng/k8s/searxng.yaml

@@ -27,7 +27,7 @@ spec:
     spec:
       containers:
         - name: searxng
-          image: docker.io/searxng/searxng:2026.9.25-12f8b6515
+          image: docker.io/searxng/searxng:2026.09.13-d4ce87c23
           envFrom:
             - configMapRef:
                 name: searxng-config