chore(deps): update container patch updates

Long-lived VPN WebSocket sessions inflate P95 request duration; keep 5xx/down/cert alerts for xui unchanged.

.gitignore

@@ -104,6 +104,10 @@ temp/*
 # kubernetes
 */k8s/*secret*
 !*/k8s/*secret*.example
+**/k8s/*secret*
+!**/k8s/*secret*.example
+# Local-only tweaks, not for upstream
+prometheus-stack/k8s/grafana-values.yaml
 traefik/k8s/local-tls.yaml
 converters/k8s/config.yaml
 convertx/k8s/config.yaml

n8n/compose.yaml

@@ -1,6 +1,6 @@
 services:
   n8n:
-    image: docker.n8n.io/n8nio/n8n:2.40.3
+    image: docker.n8n.io/n8nio/n8n:2.40.4
     container_name: n8n
     restart: unless-stopped
     environment:

n8n/k8s/n8n.yaml

@@ -27,7 +27,7 @@ spec:
     spec:
       containers:
         - name: n8n
-          image: docker.n8n.io/n8nio/n8n:2.40.3
+          image: docker.n8n.io/n8nio/n8n:2.40.4
           envFrom:
             - configMapRef:
                 name: n8n-config

prometheus-stack/k8s/traefik-alerts.yaml

@@ -42,7 +42,7 @@ spec:
         - alert: TraefikServiceHighLatency
           expr: |
             histogram_quantile(0.95,
-              sum(rate(traefik_service_request_duration_seconds_bucket[5m])) by (le, service)) > 2
+              sum(rate(traefik_service_request_duration_seconds_bucket{service!~"xui-xui-service-.*"}[5m])) by (le, service)) > 2
           for: 5m
           labels:
             severity: warning

renovate/k8s/cronjob.yaml

@@ -16,7 +16,7 @@ spec:
           restartPolicy: Never
           containers:
             - name: renovate
-              image: renovate/renovate:44.103.7
+              image: renovate/renovate:44.103.0
               env:
                 - name: RENOVATE_PLATFORM
                   value: gitea

vpn/xui/k8s/config.yaml

@@ -0,0 +1,11 @@
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: xui-config
+  namespace: xui
+data:
+  XUI_DB_FOLDER: "/etc/x-ui"
+  XUI_ENABLE_FAIL2BAN: "false"
+  XUI_INIT_WEB_BASE_PATH: "/"
+  XUI_LOG_LEVEL: "warning"
+  XUI_PORT: "30379"

vpn/xui/k8s/ingress.yaml

@@ -0,0 +1,81 @@
+apiVersion: traefik.io/v1alpha1
+kind: IngressRoute
+metadata:
+  name: xui-local
+  namespace: xui
+spec:
+  entryPoints:
+    - websecure
+  routes:
+    - match: Host(`xui.workstation.internal`) || Host(`xui.gigaforust.internal`)
+      kind: Rule
+      services:
+        - name: xui-service
+          port: 30379
+---
+# Public panel access (optional).
+# Realistic, but intentionally disabled: the panel has its own login,
+# security-chain adds Authentik in front of it.
+# To enable: uncomment and add Public Hostname `xui.forust.xyz`
+# in the Cloudflare tunnel (same as other *.forust.xyz hosts).
+# ---
+# apiVersion: traefik.io/v1alpha1
+# kind: IngressRoute
+# metadata:
+#   name: xui-prod
+#   namespace: xui
+# spec:
+#   entryPoints:
+#     - websecure
+#   routes:
+#     - match: Host(`xui.forust.xyz`)
+#       kind: Rule
+#       middlewares:
+#         - name: security-chain@file
+#       services:
+#         - name: xui-service
+#           port: 30379
+#   tls:
+#     certResolver: letsencrypt
+---
+apiVersion: traefik.io/v1alpha1
+kind: IngressRoute
+metadata:
+  name: xray-prod
+  namespace: xui
+spec:
+  entryPoints:
+    - websecure
+  routes:
+    - match: Host(`xray.forust.xyz`) && PathPrefix(`/pzzfpz6oi281f0u8`)
+      kind: Rule
+      services:
+        - name: xui-service
+          port: 2096
+    - match: Host(`xray.forust.xyz`)
+      kind: Rule
+      services:
+        - name: xui-service
+          port: 10000
+  tls:
+    certResolver: letsencrypt
+---
+apiVersion: traefik.io/v1alpha1
+kind: IngressRoute
+metadata:
+  name: xray-local
+  namespace: xui
+spec:
+  entryPoints:
+    - websecure
+  routes:
+    - match: (Host(`xray.workstation.internal`) || Host(`xray.gigaforust.internal`)) && PathPrefix(`/pzzfpz6oi281f0u8`)
+      kind: Rule
+      services:
+        - name: xui-service
+          port: 2096
+    - match: Host(`xray.workstation.internal`) || Host(`xray.gigaforust.internal`)
+      kind: Rule
+      services:
+        - name: xui-service
+          port: 10000

vpn/xui/k8s/namespace.yaml

@@ -0,0 +1,4 @@
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: xui

vpn/xui/k8s/xui.yaml

@@ -0,0 +1,74 @@
+apiVersion: v1
+kind: Service
+metadata:
+  name: xui-service
+  namespace: xui
+spec:
+  selector:
+    app: xui
+  ports:
+    - port: 30379
+      name: panel
+      targetPort: 30379
+    - port: 10000
+      name: xray
+      targetPort: 10000
+    - port: 2096
+      name: sub
+      targetPort: 2096
+---
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: xui-deployment
+  namespace: xui
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app: xui
+  template:
+    metadata:
+      labels:
+        app: xui
+    spec:
+      containers:
+        - name: xui
+          image: ghcr.io/mhsanaei/3x-ui:v3.8.5
+          envFrom:
+            - configMapRef:
+                name: xui-config
+          tty: true
+          ports:
+            - containerPort: 30379
+              name: panel
+            - containerPort: 10000
+              name: xray
+            - containerPort: 2096
+              name: sub
+          volumeMounts:
+            - name: x-ui-db
+              mountPath: /etc/x-ui
+          resources:
+            requests:
+              memory: "128Mi"
+              cpu: "100m"
+            limits:
+              memory: "1Gi"
+              cpu: "1000m"
+      volumes:
+        - name: x-ui-db
+          persistentVolumeClaim:
+            claimName: xui-pvc
+---
+apiVersion: v1
+kind: PersistentVolumeClaim
+metadata:
+  name: xui-pvc
+  namespace: xui
+spec:
+  accessModes:
+    - ReadWriteOnce
+  resources:
+    requests:
+      storage: 1Gi