chore(deps): update ghcr.io/c4illin/convertx docker tag to v0.19.0

checker.py initialises last_success to 0, so right after a pod restart
`time() - last_success` equals the current epoch. The rule compared that
against 300, went firing instantly, and humanizeDuration rendered the raw
epoch delta as ~20722d. The last_run > 0 guard did not help because a run
happens long before the first success.

Guard the duration rule on last_success > 0, keeping the duration
expression on the left of `and` so $value stays the real gap, and add a
separate WebinarCheckerNeverSucceeded rule for the zeroed-gauge case so a
checker that has never succeeded is still caught.

.gitea/workflows/deploy-lib.sh

@@ -89,10 +89,27 @@ stage_validate() {
   cd "$REPO"
   select_manifests
   local m k cf
+  # Compose .env files and secret files are gitignored by design, so the
+  # workstation never has real values for them. Validate structure only:
+  # skip interpolation, env-file resolution, and path resolution so that
+  # required-variable guards (:?) and missing local files don't fail CI.
+  # Normalization and consistency checks stay enabled.
+  local compose_validate_flags=()
+  local compose_config_help
+  compose_config_help="$(docker compose config --help 2>/dev/null || true)"
+  if printf '%s' "$compose_config_help" | grep -q -- '--no-interpolate'; then
+    compose_validate_flags+=(--no-interpolate)
+  fi
+  if printf '%s' "$compose_config_help" | grep -q -- '--no-env-resolution'; then
+    compose_validate_flags+=(--no-env-resolution)
+  fi
+  if printf '%s' "$compose_config_help" | grep -q -- '--no-path-resolution'; then
+    compose_validate_flags+=(--no-path-resolution)
+  fi
   log "Validate compose stacks"
   for cf in ${COMPOSE_STACKS[@]+"${COMPOSE_STACKS[@]}"}; do
     echo "  config: $cf"
-    docker compose -f "$cf" config --quiet
+    docker compose -f "$cf" config --quiet "${compose_validate_flags[@]}"
   done
   log "Validate k8s manifests (kubectl dry-run=client)"
   for m in ${K8S_MANIFESTS[@]+"${K8S_MANIFESTS[@]}"}; do

.gitea/workflows/deploy.yaml

@@ -8,7 +8,7 @@ on:
 
 concurrency:
   group: deploy-main
-  cancel-in-progress: false
+  cancel-in-progress: true
 
 env:
   DEPLOY_HOST: ${{ secrets.DEPLOY_HOST }}

edu_master/k8s/alerts.yaml

@@ -11,9 +11,14 @@ spec:
       rules:
         # No successful webinar check for 5m (~2-3 missed 2-min checks).
         # Catches: playwright hangs/timeouts, version skew, site changes, hung job.
+        # The last_success > 0 guard is mandatory: checker.py initialises
+        # last_success to 0, so without it `time() - 0` equals the current epoch
+        # and humanizeDuration renders ~20722d on every pod restart. Keep the
+        # duration expression on the left so $value stays the real gap.
         - alert: WebinarCheckerNoSuccessfulCheck
           expr: |
-            (time() - webinar_check_last_success_timestamp_seconds > 300)
+            ((time() - webinar_check_last_success_timestamp_seconds) > 300)
+              and (webinar_check_last_success_timestamp_seconds > 0)
               and (webinar_check_last_run_timestamp_seconds > 0)
           for: 2m
           labels:
@@ -22,6 +27,20 @@ spec:
             summary: "Webinar checker has no successful check for 5m"
             description: "edu-master/webinar-checker: last successful webinar check was {{ $value | humanizeDuration }} ago. Checks are failing or hanging (see consecutive failures alert). Notifications about new webinars are NOT being sent."
 
+        # Checks are running but none has ever succeeded since pod start.
+        # Split out from the rule above so a zeroed gauge never feeds
+        # humanizeDuration.
+        - alert: WebinarCheckerNeverSucceeded
+          expr: |
+            (webinar_check_last_success_timestamp_seconds == 0)
+              and (webinar_check_last_run_timestamp_seconds > 0)
+          for: 10m
+          labels:
+            severity: critical
+          annotations:
+            summary: "Webinar checker has never completed a successful check"
+            description: 'edu-master/webinar-checker: checks have been running for 10m but not one has ever succeeded since the pod started, so every check is failing. Check pod logs (Loki: {namespace="edu-master", container="webinar-checker"}).'
+
         # Fast path: 3 consecutive failures (~6+ min at 2-min interval).
         - alert: WebinarCheckerConsecutiveFailures
           expr: |

prometheus-stack/k8s/grafana-values.yaml

@@ -69,3 +69,18 @@ alertmanager:
 defaultRules:
   disabled:
     CPUThrottlingHigh: true
+    KubeControllerManagerDown: true
+    KubeSchedulerDown: true
+    KubeEtcdDown: true
+    KubeEtcdHighCommitDurations: true
+
+# k0s runs controller-manager/scheduler/etcd internally, not as pods with
+# component=kube-controller-manager/kube-scheduler/k8s-app=kube-etcd labels.
+# Their Services get no endpoints, so the targets are permanently down.
+# kube-proxy and kubelet have endpoints on k0s, keep them enabled.
+kubeControllerManager:
+  enabled: false
+kubeScheduler:
+  enabled: false
+kubeEtcd:
+  enabled: false

searxng/compose.yaml

@@ -3,7 +3,7 @@
 services:
   core:
     container_name: searxng-core
-    image: docker.io/searxng/searxng:${SEARXNG_VERSION:-2026.09.13-d4ce87c23}
+    image: docker.io/searxng/searxng:${SEARXNG_VERSION:-2026.9.25-12f8b6515}
     restart: unless-stopped
     # ports:
     # - ${SEARXNG_PORT:-8080}

searxng/k8s/searxng.yaml

@@ -27,7 +27,7 @@ spec:
     spec:
       containers:
         - name: searxng
-          image: docker.io/searxng/searxng:2026.09.13-d4ce87c23
+          image: docker.io/searxng/searxng:2026.9.25-12f8b6515
           envFrom:
             - configMapRef:
                 name: searxng-config