feat(reloader): enable deployment and reload runtime-config consumers

Merge pull request 'fix(deploy): validate resolved Compose config and namespaced Secrets' (#84 ) from fix/deploy-validation into main
Reviewed-on: https://gitea.forust.xyz/forust/homelab/pulls/84
2026-10-06 14:54:45 +00:00 · 2026-10-06 14:54:27 +00:00 · 2026-10-06 16:31:48 +02:00 · 2026-10-06 15:58:44 +02:00 · 2026-10-06 11:27:38 +02:00 · 2026-10-06 11:27:35 +02:00
290 changed files with 1604 additions and 25578 deletions
@@ -0,0 +1,80 @@
 #!/usr/bin/env bash
 # Local regressions only: kubectl is mocked and Docker is used for config parsing.
 set -euo pipefail
 repo="$(cd "$(dirname "${BASH_SOURCE[0]}")/../.." && pwd)"
 scratch="$(mktemp -d)"
 trap 'rm -rf "$scratch"' EXIT
 mkdir -p "$scratch/repo/app" "$scratch/repo/postgres" "$scratch/repo/netbird" "$scratch/repo/renovate"
 git -C "$scratch/repo" init -q
 for file in app/compose.yaml postgres/shared-compose.yaml netbird/client.compose.yaml renovate/renovate-compose.yaml; do
  touch "$scratch/repo/$file"
 done
 git -C "$scratch/repo" add .
 # shellcheck source=../workflows/compose-lint.sh
 source "$repo/.gitea/workflows/compose-lint.sh"
 actual="$(cd "$scratch/repo" && compose_files)"
 expected=$'app/compose.yaml\nnetbird/client.compose.yaml\npostgres/shared-compose.yaml\nrenovate/renovate-compose.yaml'
 [ "$actual" = "$expected" ] || { echo 'Compose discovery missed a file' >&2; exit 1; }
 cat >"$scratch/compose.yaml" <<'YAML'
 services:
  example:
    image: busybox:1.37.0
    environment:
      REQUIRED: ${HOMELAB_TEST_REQUIRED:?required for this regression}
 YAML
 unset HOMELAB_TEST_REQUIRED
 if validate_compose_file "$scratch/compose.yaml" >"$scratch/config.log" 2>&1; then
  echo 'Full Compose validation accepted a missing variable' >&2
  exit 1
 fi
 grep -q 'required for this regression' "$scratch/config.log"
 HOMELAB_TEST_REQUIRED=present validate_compose_file "$scratch/compose.yaml"
 cat >"$scratch/resources.json" <<'JSON'
 {"kind":"List","items":[
  {"kind":"Deployment","metadata":{"namespace":"app"},"spec":{"template":{"spec":{
    "containers":[{"envFrom":[{"secretRef":{"name":"credentials"}},{"secretRef":{"name":"optional","optional":true}}],"env":[{"valueFrom":{"secretKeyRef":{"name":"credentials","key":"password"}}}]}],
    "initContainers":[{"envFrom":[{"secretRef":{"name":"init"}}]}],
    "imagePullSecrets":[{"name":"registry"}],
    "volumes":[{"secret":{"secretName":"mounted"}},{"projected":{"sources":[{"secret":{"name":"projected"}},{"secret":{"name":"optional-projected","optional":true}}]}}]
  }}}},
  {"kind":"CronJob","metadata":{},"spec":{"jobTemplate":{"spec":{"template":{"spec":{"containers":[{"envFrom":[{"secretRef":{"name":"cron"}}]}]}}}}}},
  {"kind":"IngressRoute","metadata":{"namespace":"app"},"spec":{"tls":{"secretName":"controller-issued-tls"}}}
 ]}
 JSON
 actual="$(jq -r -f "$repo/.gitea/workflows/secret-references.jq" "$scratch/resources.json" | sort)"
 expected=$'app credentials\napp init\napp mounted\napp projected\napp registry\ndefault cron'
 [ "$actual" = "$expected" ] || { echo "Unexpected Secret references: $actual" >&2; exit 1; }
 REPO="$repo"
 # shellcheck source=../workflows/deploy-lib.sh
 source "$repo/.gitea/workflows/deploy-lib.sh"
 K8S_MANIFESTS=("$scratch/resources.json")
 KUSTOMIZE_APPS=()
 # No live cluster access. Reject credentials in app even if they exist elsewhere.
 kubectl() {
  case "$1" in
    create) cat "$scratch/resources.json" ;;
    get)
      if [ "$3" = credentials ] && [ "$5" = app ]; then
        return 1
      fi
      return 0
      ;;
    *) echo "Unexpected kubectl invocation: $*" >&2; return 1 ;;
  esac
 }
 if check_referenced_secrets >"$scratch/secrets.log"; then
  echo 'Namespace-scoped Secret check accepted a missing Secret' >&2
  exit 1
 fi
 grep -q 'MISSING OR UNREADABLE: app/credentials' "$scratch/secrets.log"
 # API/rendering errors must not produce an empty reference list and pass.
 kubectl() { return 1; }
 if check_referenced_secrets >"$scratch/secrets.log"; then
  echo 'Secret check accepted a failed manifest render' >&2
  exit 1
 fi
 printf '%s\n' 'Deploy validation regressions passed.'
@@ -88,19 +88,17 @@ jobs:
        shell: bash
        run: |
          set -euo pipefail
-          tools_dir="$(bash .gitea/workflows/install-ci-tools.sh shellcheck)"
+          tools_dir="$(bash .gitea/workflows/install-ci-tools.sh shellcheck jq)"
          export PATH="$tools_dir:$PATH"
          # userbot/ is a git subtree synced from forust/userbot, so its shell
          # scripts are upstream's to maintain, not ours. Linting them would let a
          # routine subtree pull turn the deploy gate red on code we do not own.
          mapfile -t scripts < <(
-            git ls-files '*.sh' ':(glob)**/*.bash' ':!userbot/**'
+            git ls-files '*.sh' ':(glob)**/*.bash'
          )
          if [ "${#scripts[@]}" -eq 0 ]; then
            echo "No shell scripts found."
            exit 0
          fi
          shellcheck --external-sources --source-path=SCRIPTDIR --severity=style "${scripts[@]}"
          bash .gitea/tests/deploy-validation.sh
  lint-prettier:
    runs-on: [self-hosted, linux, arch, homelab]
@@ -197,155 +195,6 @@ jobs:
          hadolint -c .hadolint.yaml "${dockerfiles[@]}"
  # Known, accepted, and recorded. Each line is a real advisory against a
  # package we build into the panel image, kept in this workflow rather than in
  # the package manifest so that a subtree sync from forust/userbot cannot
  # silently widen the exemption.
  #
  # starlette is the reason this job is not simply "fail on everything":
  # fastapi 0.115.12 pins `starlette<0.47.0`, and the fixes for the last four
  # below need 0.49.1 through 1.3.1, so clearing them means a jump from fastapi
  # 0.115.12 to 0.141.x. That is upstream's call, not a drive-by in a lint
  # commit. Of the seven, four are reachable here in principle: 1942 is a
  # crafted Range header hitting FileResponse, and the panel serves its built
  # SPA through exactly that; 249 is request.form() ignoring max_fields for
  # x-www-form-urlencoded, which is the login form; 1941 is a large multipart
  # body blocking the event loop; 161 and 248 are unvalidated Host and request
  # path reaching request.url. 2280 needs HTTPEndpoint, which the panel does
  # not use, and 2281 is Windows-only, and this deploys on Linux.
  #
  # The panel answers on userbot.workstation.internal and has no public
  # forust.xyz route, which is what keeps the four reachable ones from being
  # an internet-facing DoS. It still manages Telegram credentials.
  #
  # Deleting an entry here is how you accept a new advisory, so the diff says
  # so out loud.
  scan-deps:
    runs-on: [self-hosted, linux, arch, homelab]
    timeout-minutes: 15
    steps:
      - name: Checkout repository
        uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
      - name: Audit the Python dependencies that ship in the image
        shell: bash
        run: |
          set -euo pipefail
          tools_dir="$(bash .gitea/workflows/install-ci-tools.sh pip-audit)"
          export PATH="$tools_dir:$PATH"
          # requirements.txt, not requirements-dev.txt: this is what the image
          # installs, and the test tooling is not a shipped attack surface.
          pip-audit -r userbot/panel/backend/requirements.txt --strict \
            --ignore-vuln CVE-2025-67720 \
            --ignore-vuln PYSEC-2026-161 \
            --ignore-vuln PYSEC-2026-1941 \
            --ignore-vuln PYSEC-2026-1942 \
            --ignore-vuln PYSEC-2026-2280 \
            --ignore-vuln PYSEC-2026-2281 \
            --ignore-vuln PYSEC-2026-248 \
            --ignore-vuln PYSEC-2026-249
      # devDependencies are excluded on purpose. `npm audit` on the full tree
      # reports 7 findings, and every one of them is a build- or test-time
      # package: the esbuild CORS advisory needs a vite dev server serving to
      # the internet, and nanoid's infinite loop needs a custom generator
      # called with size 0, which postcss does not do. None of them are in the
      # 91 kB bundle the panel serves. The one production finding, devalue
      # via svelte, is moderate, which is where --audit-level draws the line;
      # this fails on the next high or critical one.
      - name: Audit the production npm dependencies
        shell: bash
        run: |
          set -euo pipefail
          # The pinned node, not whatever the runner has. Its system node is a
          # rolling Arch package: during this very push its npm was missing
          # entirely, and an hour later it was npm 12 on node 26. Both are the
          # wrong major anyway — the panel image is node:22-alpine.
          tools_dir="$(bash .gitea/workflows/install-ci-tools.sh node)"
          export PATH="$tools_dir:$PATH"
          cd userbot/panel/frontend
          npm ci
          npm audit --omit=dev --audit-level=high
  test-backend:
    runs-on: [self-hosted, linux, arch, homelab]
    timeout-minutes: 15
    steps:
      - name: Checkout repository
        uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
      # 25 tests over the panel's pydantic models, its auth flow, the SPA
      # fallback and the Kubernetes client it shells out with. They existed and
      # had never been executed by anything.
      #
      # Note that userbot/ is a subtree synced from forust/userbot, so a routine
      # sync can turn this red on upstream's code. Unlike the shellcheck job,
      # which skips that tree because style disagreements there are ours to
      # lose, a failing test here is a real defect in a service we deploy.
      - name: Run the panel backend test suite
        shell: bash
        run: |
          set -euo pipefail
          tools_dir="$(bash .gitea/workflows/install-ci-tools.sh uv)"
          export PATH="$tools_dir:$PATH"
          # A venv in a temp dir rather than a checked-out one: the runner is
          # shared, and a leftover .venv would let a dependency the
          # requirements no longer pin still satisfy an import.
          #
          # --python is not optional. uv otherwise takes whatever interpreter it
          # finds first, and which one that is depends on the machine: this
          # runner runs jobs on the host, where the only interpreter is 3.14,
          # and pyrogram's sync.py calls the bare asyncio.get_event_loop() that
          # 3.14 no longer auto-creates, so three tests fail at collection. The
          # image is python:3.13-slim, so 3.13 is also the version worth
          # testing: uv fetches a managed build of it when the host has none,
          # which is what makes this job independent of the runner.
          venv="$(mktemp -d)/venv"
          uv venv --python 3.13 --quiet "$venv"
          uv pip install --quiet --python "$venv/bin/python" \
            -r userbot/panel/backend/requirements-dev.txt
          # `python -m`, not bare `pytest`: the tests import `app.*` relative to
          # the backend directory, which only works if the cwd is on sys.path,
          # and only `python -m` puts it there.
          cd userbot/panel/backend
          "$venv/bin/python" -m pytest tests/ -q
  test-frontend:
    runs-on: [self-hosted, linux, arch, homelab]
    timeout-minutes: 15
    steps:
      - name: Checkout repository
        uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
      # One `npm ci` for both checks below: it is by far the slowest part of
      # this job, and a second one would learn nothing the first did not.
      #
      # `npm ci`, not `npm install`, for the same reason the Dockerfile uses it:
      # the lockfile is what makes the tree that gets checked the tree that
      # gets shipped.
      - name: Type-check and test the panel frontend
        shell: bash
        run: |
          set -euo pipefail
          # The pinned node, not whatever the runner has. Its system node is a
          # rolling Arch package: during this very push its npm was missing
          # entirely, and an hour later it was npm 12 on node 26. Both are the
          # wrong major anyway — the panel image is node:22-alpine.
          tools_dir="$(bash .gitea/workflows/install-ci-tools.sh node)"
          export PATH="$tools_dir:$PATH"
          cd userbot/panel/frontend
          npm ci
          # svelte-check has been a devDependency all along with no script
          # pointing at it, so the type errors it reports had nowhere to
          # surface. It is clean today, which is the only reason it can be a
          # gate: it stops at whatever upstream introduces rather than
          # reporting a backlog we inherited.
          npm run check
          npm test
  validate:
    runs-on: [self-hosted, linux, arch, homelab]
    timeout-minutes: 20
@@ -464,25 +313,12 @@ jobs:
  build:
    needs:
-      # scan-deps and the two test jobs were missing here, so a commit with a
+      # The panel's scan-deps/test-backend/test-frontend jobs gated here until
-      # known-vulnerable dependency or a failing test still moved the :prod tag.
+      # userbot moved to its own repo; upstream's code is upstream's gate now.
-      # The deploy was blocked either way - it requires the whole workflow to
+      # The rule is unchanged: publishing and passing the checks are the same
-      # have succeeded - but the tag had already moved, and the next deploy to
+      # gate, so a commit that fails any of these still cannot move :prod.
-      # run resolved it. Publishing and passing the checks are the same gate.
+      [lint-actionlint, lint-shellcheck, lint-compose, lint-prettier, lint-ruff, lint-yaml, lint-dockerfiles, validate]
-      [
+    if: github.event_name != 'pull_request' && (github.ref_name == 'main' || github.ref_name == 'dev') && !startsWith(github.ref_name, 'renovate/')
        lint-actionlint,
        lint-shellcheck,
        lint-compose,
        lint-prettier,
        lint-ruff,
        lint-yaml,
        lint-dockerfiles,
        scan-deps,
        test-backend,
        test-frontend,
        validate,
      ]
    if: github.event_name != 'pull_request' && (github.ref_name == 'main' || github.ref_name == 'dev')
    runs-on: [self-hosted, linux, arch, homelab]
    timeout-minutes: 60
    outputs:
@@ -530,15 +366,9 @@ jobs:
          for file in "${changed_files[@]}"; do
            case "$file" in
              dtek_notif/*)
                add_service dtek_notif
                ;;
              errorpages/*)
                add_service errorpages
                ;;
              userbot/*)
                add_service userbot
                ;;
              homepages/*)
                add_service homepages
                ;;
@@ -558,7 +388,11 @@ jobs:
          echo "services=$(paste -sd, /tmp/services.txt)" >> "$GITHUB_OUTPUT"
      - name: Log in to registry
-        if: steps.services.outputs.services != ''
+        # The pin step below also writes (manifest PUTs), and it runs on every
        # main push — including manifest-only ones where services is empty. A
        # stale persistent login on the old runner used to mask this; a clean
        # runner pushes anonymously and gets 401.
        if: steps.services.outputs.services != '' || github.ref_name == 'main'
        shell: bash
        # Through env, not by substitution into the script. A secret written
        # into a run: block is pasted into the shell source before bash parses
@@ -608,21 +442,6 @@ jobs:
          for service in "${services[@]}"; do
            case "$service" in
              dtek_notif)
                image="${REGISTRY}/forust/dtek-notif"
                set_tags
                build_args=()
                for tag in "${tags[@]}"; do
                  build_args+=(-t "${image}:${tag}")
                done
                docker build \
                  --cache-from "type=registry,ref=${image}:buildcache" \
                  --cache-to "type=registry,ref=${image}:buildcache,mode=max" \
                  "${build_args[@]}" dtek_notif
                for tag in "${tags[@]}"; do
                  docker push "${image}:${tag}"
                done
                ;;
              errorpages)
                image="${REGISTRY}/forust/error-pages"
                set_tags
@@ -638,32 +457,6 @@ jobs:
                  docker push "${image}:${tag}"
                done
                ;;
              userbot)
                set_tags
                for target in runtime panel; do
                  case "$target" in
                    runtime)
                      context="userbot"
                      image="${REGISTRY}/forust/userbot"
                      ;;
                    panel)
                      context="userbot/panel"
                      image="${REGISTRY}/forust/userbot-panel"
                      ;;
                  esac
                  build_args=()
                  for tag in "${tags[@]}"; do
                    build_args+=(-t "${image}:${tag}")
                  done
                  docker build \
                    --cache-from "type=registry,ref=${image}:buildcache" \
                    --cache-to "type=registry,ref=${image}:buildcache,mode=max" \
                    "${build_args[@]}" "$context"
                  for tag in "${tags[@]}"; do
                    docker push "${image}:${tag}"
                  done
                done
                ;;
              homepages)
                for variant in forust xdfnx; do
                  case "$variant" in
@@ -21,8 +21,7 @@
 # All committed Compose files, including the ones deploy never starts.
 compose_files() {
  git ls-files \
-    '*/compose.yaml' '*/compose.yml' 'compose.yaml' 'compose.yml' \
+    '*compose.yaml' '*compose.yml'
    '*/docker-compose.yaml' '*/docker-compose.yml'
 }
 # Prints the flags that turn `docker compose config` into the general check.
@@ -233,13 +233,28 @@ registry_digest() {
  # pipefail reports the rightmost non-zero stage, so a ref the registry does not
  # have would abort the caller at the assignment instead of yielding an empty
  # string. The callers check for empty themselves and report it by name.
-  docker manifest inspect "$1" 2>/dev/null \
+  #
-    | jq -r --arg arch "$arch" '
+  # Retried with a hard timeout because the registry has a known hang mode (and
-        .manifests[]?
+  # a known blink mode: a single failed lookup aborts the whole apply file in
-        | select(.platform.os == "linux" and .platform.architecture == $arch)
+  # render_pinned). A short sleep between attempts lets a restarting registry
-        | .digest
+  # come back instead of failing the deploy on one bad second.
-      ' 2>/dev/null \
+  local attempt=0 digest=""
-    | head -1 || true
+  while [ "$attempt" -lt 3 ]; do
    digest="$(timeout 25s docker manifest inspect "$1" 2>/dev/null \
      | jq -r --arg arch "$arch" '
          .manifests[]?
          | select(.platform.os == "linux" and .platform.architecture == $arch)
          | .digest
        ' 2>/dev/null \
      | head -1 || true)"
    [ -n "$digest" ] && break
    attempt=$((attempt + 1))
    if [ "$attempt" -lt 3 ]; then
      echo "WARNING: registry lookup of $1 failed (attempt $attempt/3), retrying in 5s" >&2
      sleep 5
    fi
  done
  printf '%s' "$digest"
 }
 # The commit this deploy is for: what CI validated, or - on a manual dispatch,
@@ -489,7 +504,7 @@ rollback_workloads() {
  local -a recovered=()
  while read -r kind ns name; do
    [ -n "${kind:-}" ] || continue
-    # Helm-owned workloads are already rolled back by the release's --atomic
+    # Helm-owned workloads are already rolled back by the release's --rollback-on-failure
    # upgrade. `rollout undo` here would step back to the revision Helm just
    # escaped (the failed one), so leave them for the operator instead.
    if kubectl get "${kind}/${name}" -n "$ns" -o jsonpath='{.metadata.annotations}' 2>/dev/null | grep -q 'meta.helm.sh/release-name'; then
@@ -548,7 +563,7 @@ helm_release_status() {
 }
 # recover_pending_release <release> <namespace>
-# Rolls a release out of a pending-* state left by a failed --atomic upgrade
+# Rolls a release out of a pending-* state left by a failed upgrade with --rollback-on-failure
 # whose own rollback never completed. Without this every future upgrade errors
 # out until a human runs `helm rollback`. Passes through releases that are not
 # pending (deployed, failed, not-found). Returns non-zero when the release is
@@ -573,6 +588,28 @@ recover_pending_release() {
  return 0
 }
 # wait_for_calm <stage>
 # The deploy itself is heavy enough to melt this single node (helm churn plus
 # apply churn drove load past 40, killed netbird/ssh, left helm pending-*).
 # Never pile a heavy step onto an already-hot node: wait up to 10 minutes for
 # the 1-minute load average to drop below the ceiling, then proceed anyway
 # with a warning so a permanently busy node cannot wedge the pipeline forever.
 wait_for_calm() {
  local load waited=0
  while [ "$waited" -lt 600 ]; do
    load="$(cut -d' ' -f1 /proc/loadavg | cut -d. -f1)"
    if [ "$load" -lt 28 ]; then
      return 0
    fi
    if [ "$((waited % 60))" -eq 0 ]; then
      log "$1: load $load, waiting for calm (<28)..."
    fi
    sleep 15
    waited=$((waited + 15))
  done
  echo "WARN: $1: node still loaded ($load) after 10m, proceeding anyway"
 }
 upgrade_helm_releases() {
  local entry release chart namespace version values marker repo
  for entry in ${HELM_RELEASES[@]+"${HELM_RELEASES[@]}"}; do
@@ -593,22 +630,24 @@ upgrade_helm_releases() {
    helm repo add "${repo%% *}" "${repo#* }" >/dev/null 2>&1 || true
    helm repo update "${repo%% *}" >/dev/null 2>&1 || true
    log "Upgrading $release ($chart $version)"
-    # A previous --atomic run whose own rollback never finished leaves the
+    wait_for_calm "helm $release"
    # A previous run with --rollback-on-failure whose own rollback never finished leaves the
    # release in pending-*, which blocks every future upgrade. Recover first
    # so one wedged revision cannot wedge the pipeline forever.
    if ! recover_pending_release "$release" "$namespace"; then
      echo "ERROR: $release is stuck and automatic rollback did not recover it, run 'helm rollback $release -n $namespace' by hand."
      return 1
    fi
-    # --atomic rolls the release back when the upgrade times out or the workloads
+    # --rollback-on-failure (+ --wait) rolls the release back when the upgrade
-    # it touches never become ready, so a bad chart bump is not left half applied.
+    # times out or the workloads it touches never become ready, so a bad chart
    # bump is not left half applied. (--atomic was this combo; deprecated.)
    if ! helm upgrade --install "$release" "$chart" \
      --namespace "$namespace" \
      --version "$version" \
      --values "$REPO/$values" \
-      --atomic --cleanup-on-fail --timeout 10m; then
+      --wait --rollback-on-failure --cleanup-on-fail --timeout 10m; then
      echo "WARN: upgrade of $release failed, checking release state"
-      # --atomic already attempted its own rollback; finish the job when that
+      # --rollback-on-failure already attempted its own rollback; finish the job when that
      # rollback never completed, otherwise the release stays pending-* and
      # blocks every future run.
      if ! recover_pending_release "$release" "$namespace"; then
@@ -647,27 +686,52 @@ stage_preflight() {
  git -C "$REPO" reset --hard "$target"
 }
 # Required pod Secrets, scoped to the resource namespace. TLS route Secrets are
 # created by cert-manager and are not prerequisites for applying a Certificate.
 check_referenced_secrets() {
  local m k objects refs extracted ns name
  local missing=()
  refs=""
  for m in ${K8S_MANIFESTS[@]+"${K8S_MANIFESTS[@]}"}; do
    objects="$(kubectl create --dry-run=client --validate=false -f "$m" -o json)" || return 1
    extracted="$(printf '%s' "$objects" | jq -r -f "$REPO/.gitea/workflows/secret-references.jq")" || return 1
    refs+="$extracted"$'\n'
  done
  for k in ${KUSTOMIZE_APPS[@]+"${KUSTOMIZE_APPS[@]}"}; do
    objects="$(kubectl kustomize "$k" | kubectl create --dry-run=client --validate=false -f - -o json)" || return 1
    extracted="$(printf '%s' "$objects" | jq -r -f "$REPO/.gitea/workflows/secret-references.jq")" || return 1
    refs+="$extracted"$'\n'
  done
  while read -r ns name; do
    [ -n "${name:-}" ] || continue
    if kubectl get secret "$name" -n "$ns" -o name >/dev/null 2>&1; then
      echo "  ok: $ns/$name"
    else
      echo "  MISSING OR UNREADABLE: $ns/$name"
      missing+=("$ns/$name")
    fi
  done < <(printf '%s' "$refs" | sort -u)
  if [ "${#missing[@]}" -gt 0 ]; then
    echo "ERROR: required pod Secrets are missing or unreadable:"
    printf '  - %s\n' "${missing[@]}"
    echo "Create them in the listed namespaces from the service's secret example."
    return 1
  fi
 }
 stage_validate() {
  cd "$REPO"
  select_manifests
  local m k cf
-  # Compose .env files and secret files are gitignored by design, so the
+  # The deploy host has the local .env and secret files. Resolve them here so
-  # workstation never has real values for the inactive stacks. This stage only
+  # missing configuration fails before either apply job changes workloads.
-  # runs the full check on active stacks; the general structure check for every
+  # CI keeps the structure-only check for inactive stacks.
  # committed Compose file (active or not) lives in the ci workflow, which has no
  # .env at all.
  #
  # Active stacks are still validated with interpolation and env-file resolution
  # off, so required-variable guards (:?) and missing local files do not fail the
  # deploy. Normalization and consistency checks stay enabled.
  # shellcheck source=compose-lint.sh
  source "$REPO/.gitea/workflows/compose-lint.sh"
  local compose_validate_flags=()
  mapfile -t compose_validate_flags < <(compose_safe_flags)
  log "Validate compose stacks"
  for cf in ${COMPOSE_STACKS[@]+"${COMPOSE_STACKS[@]}"}; do
    echo "  config: $cf"
-    validate_compose_file "$cf" ${compose_validate_flags[@]+"${compose_validate_flags[@]}"}
+    validate_compose_file "$cf"
  done
  log "Validate k8s manifests (kubectl dry-run=client)"
  for m in ${K8S_MANIFESTS[@]+"${K8S_MANIFESTS[@]}"}; do
@@ -685,33 +749,7 @@ stage_validate() {
  done
  log "Checking referenced Secrets exist"
  echo "  (deploy never applies *secret*.yaml; create missing ones manually)"
-  local ref_secrets=() missing_secrets=() all_secrets s
+  check_referenced_secrets
  if [ "${#K8S_MANIFESTS[@]}" -gt 0 ]; then
    while IFS= read -r s; do
      [ -n "$s" ] && ref_secrets+=("$s")
    done < <(
      {
        grep -h -A1 -E 'secretRef:|secretKeyRef:' "${K8S_MANIFESTS[@]}" 2>/dev/null || true
        grep -h -E 'secretName:' "${K8S_MANIFESTS[@]}" 2>/dev/null || true
      } | grep -E 'name:' | sed -E 's/.*name:[[:space:]]*//' | tr -d '"'"'"' "'"'" | sed -E 's/[[:space:]]*#.*//' | awk 'NF' | sort -u || true
    )
  fi
  all_secrets="$(kubectl get secrets -A --no-headers -o custom-columns=:metadata.name 2>/dev/null || true)"
  for s in ${ref_secrets[@]+"${ref_secrets[@]}"}; do
    if printf '%s\n' "$all_secrets" | grep -qx "$s"; then
      echo "  ok: $s"
    else
      echo "  MISSING: $s"
      missing_secrets+=("$s")
    fi
  done
  if [ "${#missing_secrets[@]}" -gt 0 ]; then
    echo "ERROR: ${#missing_secrets[@]} referenced Secret(s) not found in the cluster:"
    printf '  - %s\n' "${missing_secrets[@]}"
    echo "Create them manually from the laptop, e.g.:"
    echo "  kubectl apply -f SERVICE/k8s/secrets.yaml  # see SERVICE/k8s/secrets.yaml.example"
    exit 1
  fi
 }
 stage_apply_k8s() {
@@ -747,6 +785,7 @@ stage_apply_k8s() {
    fi
  fi
  upgrade_helm_releases
  wait_for_calm "apply resources"
  if [ "${#other_files[@]}" -gt 0 ]; then
    log "Applying resources (${#other_files[@]} files, our images pinned to digests)"
    for m in "${other_files[@]}"; do
@@ -763,19 +802,6 @@ stage_apply_k8s() {
      exit 1
    fi
  done
  if [ -f "$REPO/userbot/k8s/active" ]; then
    log "userbot panel hook"
    if kubectl get secret userbot-common-secrets -n userbot >/dev/null 2>&1; then
      echo "  userbot-common-secrets already present in userbot ns, not touching"
    elif kubectl get secret userbot-common-secrets -n default >/dev/null 2>&1; then
      echo "  bootstrapping userbot-common-secrets into userbot ns"
      kubectl get secret userbot-common-secrets -n default -o json \
        | jq 'del(.metadata.annotations,.metadata.creationTimestamp,.metadata.resourceVersion,.metadata.uid,.metadata.managedFields) | .metadata.namespace = "userbot"' \
        | kubectl apply -f -
    else
      echo "  WARNING: userbot-common-secrets missing in both default and userbot ns; create it manually from the laptop"
    fi
  fi
  restart_stale_images
  # No verification here on purpose. This stage may be killed at any point by
@@ -967,8 +993,7 @@ traefik_routed_hosts() {
 #
 # Except that a 404 is not evidence on its own. A router Traefik refused to
 # build answers with the same 404 and nothing behind it, so a middleware that
-# fails to load -- the crowdsec bouncer, which Traefik disables silently when
+# fails to load takes down every route that referenced it while
 # it cannot fetch the plugin -- takes down every route that referenced it while
 # this stage reports `ok` for all of them. No status code separates those two
 # cases, so ask Traefik which routes it built and fail on the difference.
 stage_smoke() {
@@ -39,10 +39,15 @@ env:
 jobs:
  preflight:
    # Autodeploy defaults to OFF: pushes deploy only when the AUTODEPLOY repo
    # variable is set to 'true' (Settings -> Actions -> Variables). A manual
    # Run workflow always bypasses the switch: dispatching it is the explicit
    # intent to deploy.
    if: >-
-      github.event_name != 'workflow_run' ||
+      (vars.AUTODEPLOY == 'true' || github.event_name == 'workflow_dispatch') &&
      (github.event_name != 'workflow_run' ||
      (github.event.workflow_run.conclusion == 'success' &&
-       github.event.workflow_run.head_branch == 'main')
+       github.event.workflow_run.head_branch == 'main'))
    runs-on: [self-hosted, linux, arch, homelab, prod]
    timeout-minutes: 10
    steps:
@@ -73,14 +78,14 @@ jobs:
    needs: [validate]
    runs-on: [self-hosted, linux, arch, homelab, prod]
    # Apply only, no verification, so this is just the work itself: snapshot,
-    # then sequential `helm upgrade --atomic --timeout 10m`, then the apply loop.
+    # then sequential `helm upgrade --install --wait --rollback-on-failure --timeout 10m`, then the apply loop.
    # Verification has its own job and its own budget.
    #
    # 45 is roughly four times the measured cost of the stage, which is
    # deliberately not raised on a theory:
    #
    #   helm, healthy          3 no-op upgrades              ~3-5 min
-    #   helm, one release bad  --atomic spends its 10m,      ~10-15 min
+    #   helm, one release bad  rollback-on-failure spends its 10m,      ~10-15 min
    #                            then rolls that one back
    #   apply loop             ~40 manifests, 4 of which     ~1 min
    #                           resolve an image digest
@@ -95,12 +100,12 @@ jobs:
    # The 45 minutes this was last raised to 45 were still not enough, and the
    # job logs for those runs no longer exist, so what actually consumed the
    # budget is not known - the two measurable candidates above account for
-    # ~15 of it. The one unbounded thing left in this stage is
+    # ~15 of it. The unbounded `docker manifest inspect` against the registry's
-    # `docker manifest inspect` at deploy-lib.sh:236, which has no timeout
+    # known hang mode is now bounded inside registry_digest (25s timeout, 3
-    # against a registry with a known hang mode. Bound it, and make the stage
+    # attempts): a dead registry fails each owned image after ~85s instead of
-    # announce what it is working on, before spending any of that on a larger
+    # hanging the stage, and a blinking one is retried instead of failing the
-    # ceiling: a stage that is killed with a diagnosable last line is a bug
+    # whole apply file. Still open: make the stage announce which manifest it
-    # report, one that vanishes is not.
+    # is working on, so a killed run leaves a diagnosable last line.
    timeout-minutes: 45
    steps:
      - name: Checkout repository
@@ -16,6 +16,10 @@ here="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
 TOOLS_DIR="${TOOLS_DIR:-${RUNNER_TEMP:-/tmp}/homelab-tools}"
 BIN_DIR="$TOOLS_DIR/bin"
 mkdir -p "$BIN_DIR"
 # The just-installed tools must resolve inside this script too: callers only
 # prepend BIN_DIR to PATH after the script exits, so a bare `uv` below would
 # miss the binary install_uv just placed (exit 127 on a clean runner).
 export PATH="$BIN_DIR:$PATH"
 arch="$(uname -m)"
 # Upstream projects disagree on arch spelling: kubeconform and actionlint use
@@ -53,14 +57,31 @@ fetch() {
  fi
 }
 # resolve <command>
 # Absolute path to use for invoking a tool: the copy in BIN_DIR when present,
 # otherwise the name for PATH lookup. Every version check and every in-script
 # invocation goes through this, so a tool missing from both places reads as
 # "not installed" instead of dying with 127 under `set -e`.
 resolve() {
  if [ -x "$BIN_DIR/$1" ]; then
    printf '%s' "$BIN_DIR/$1"
  else
    printf '%s' "$1"
  fi
 }
 # installed_version <command>
 # Prints the version of an already-installed tool, or nothing. Each tool spells
 # its version flag differently, hence the case.
 installed_version() {
-  local out
+  local bin out
  bin="$(resolve "$1")"
  if ! command -v "$bin" >/dev/null 2>&1; then
    return 0
  fi
  case "$1" in
-    kubeconform) out="$("$1" -v 2>/dev/null | head -1 || true)" ;;
+    kubeconform) out="$("$bin" -v 2>/dev/null | head -1 || true)" ;;
-    *) out="$("$1" --version 2>/dev/null | head -1 || true)" ;;
+    *) out="$("$bin" --version 2>/dev/null | head -1 || true)" ;;
  esac
  printf '%s' "$out"
 }
@@ -99,6 +120,15 @@ install_shellcheck() {
  rm -rf "$tmp"
 }
 install_jq() {
  if at_version jq "${JQ_VERSION}"; then
    return 0
  fi
  fetch "https://github.com/jqlang/jq/releases/download/jq-${JQ_VERSION}/jq-linux-${goarch}" \
    "$BIN_DIR/jq"
  chmod 0755 "$BIN_DIR/jq"
 }
 install_uv() {
  if at_version uv "${UV_VERSION}"; then
    return 0
@@ -130,7 +160,7 @@ install_uv_tool() {
    return 0
  fi
  install_uv
-  UV_TOOL_BIN_DIR="$BIN_DIR" uv tool install --force "$1==$2" >/dev/null
+  UV_TOOL_BIN_DIR="$BIN_DIR" "$BIN_DIR/uv" tool install --force "$1==$2" >/dev/null
 }
 install_ruff() {
@@ -215,6 +245,7 @@ for tool in "${wanted[@]}"; do
  case "$tool" in
    kubeconform) install_kubeconform ;;
    shellcheck) install_shellcheck ;;
    jq) install_jq ;;
    actionlint) install_actionlint ;;
    prettier) install_prettier ;;
    ruff) install_ruff ;;
@@ -81,7 +81,7 @@ jobs:
          docker run --rm \
            -v "$PWD/renovate/renovate.json:/opt/renovate/renovate.json:ro" \
            -e RENOVATE_PLATFORM=gitea \
-            -e RENOVATE_ENDPOINT=https://gitea.forust.xyz/api/v1 \
+            -e RENOVATE_ENDPOINT=https://git.forust.xyz/api/v1 \
            -e RENOVATE_TOKEN="$RENOVATE_TOKEN" \
            -e RENOVATE_GITHUB_COM_TOKEN="${RENOVATE_GITHUB_COM_TOKEN:-}" \
            -e RENOVATE_REPOSITORIES="${RENOVATE_REPOSITORIES:-forust/homelab}" \
@@ -0,0 +1,13 @@
 # kubectl emits a List for files containing multiple resources.
 (if .kind == "List" then .items[] else . end)
 | (.metadata.namespace // "default") as $ns
 | [
    (.. | objects
      | (.secretRef? // empty), (.secretKeyRef? // empty), (.secret? // empty)
      | select(.optional != true)
      | .name // .secretName // empty),
    (.. | objects | .imagePullSecrets[]?.name)
  ]
 | unique[]
 | select(. != null and . != "")
 | "\($ns) \(.)"
@@ -36,16 +36,28 @@ ssh_opts=(
 )
 rc=0
 # apply-k8s and apply-compose are separate workflow jobs so the graph stays
 # intact for the verify job, but on a single node they must not run at once:
 # host docker churn on top of cluster churn is what melts the node (load 40+,
 # netbird/ssh die, helm is left pending-*). Serialize them on the workstation
 # with a shared lock; whoever arrives second waits.
 remote_cmd=(bash -se)
 case "$1" in
  apply-k8s | apply-compose)
    remote_cmd=(flock -w 5400 /tmp/homelab-apply.lock bash -se)
    ;;
 esac
 for attempt in 1 2 3; do
  if [ "$attempt" -gt 1 ]; then
    echo ":: warning::ssh transport failed, retrying (${attempt}/3)"
    sleep $((attempt * 5))
  fi
  rc=0
  # shellcheck disable=SC2029 # remote_cmd/ssh_opts expand on the client on purpose: they select the local ssh invocation, only the heredoc runs remotely.
  ssh "${ssh_opts[@]}" "${DEPLOY_USER}@${DEPLOY_HOST}" \
    env "REPO=$deploy_path" "APPLY_PRUNE=${APPLY_PRUNE:-false}" \
    "DEPLOY_SHA=${DEPLOY_SHA:-}" "DEPLOY_SNAPSHOT_DIR=${DEPLOY_SNAPSHOT_DIR:-}" \
-    "STAGE=$1" bash -se <<'EOF' || rc=$?
+    "STAGE=$1" "${remote_cmd[@]}" <<'EOF' || rc=$?
 source "$REPO/.gitea/workflows/deploy-lib.sh"
 run_stage "$STAGE"
 EOF
@@ -31,3 +31,6 @@ UV_VERSION="0.12.17"
 # so the tree that gets tested is the tree that gets built. Renovate keeps this
 # in step with the Dockerfile's node: tag via the "node runtime" group.
 NODE_VERSION="22.23.3"
 # Secret-reference regression tests parse rendered Kubernetes objects.
 JQ_VERSION="1.8.1"
@@ -51,6 +51,8 @@ spec:
 apiVersion: apps/v1
 kind: Deployment
 metadata:
  annotations:
    reloader.stakater.com/auto: "true"
  name: adguard-deployment
  namespace: adguard
 spec:
@@ -58,12 +60,12 @@ spec:
  selector:
    matchLabels:
      app: adguard
  strategy:
    type: Recreate
  template:
    metadata:
      labels:
        app: adguard
      annotations:
        reloader.stakater.com/auto: "true"
    spec:
      containers:
        - name: adguard
@@ -73,7 +75,7 @@ spec:
              memory: "1.5Gi"
              cpu: "300m"
            requests:
-              memory: "1Gi"
+              memory: "512Mi"
              cpu: "50m"
          ports:
            - containerPort: 3000
@@ -82,6 +84,13 @@ spec:
              name: dns
            - containerPort: 853
              name: dot
          readinessProbe:
            tcpSocket:
              port: dns
            initialDelaySeconds: 5
            periodSeconds: 5
            successThreshold: 1
            failureThreshold: 3
          volumeMounts:
            - name: adguard-data
              mountPath: /opt/adguardhome/work
@@ -9,9 +9,6 @@ spec:
  routes:
    - match: Host(`dns.forust.xyz`)
      kind: Rule
      middlewares:
        - name: crowdsec-bouncer
          namespace: crowdsec
      services:
        - name: adguard-service
          port: 3000
@@ -27,6 +27,8 @@ spec:
 apiVersion: apps/v1
 kind: Deployment
 metadata:
  annotations:
    reloader.stakater.com/auto: "true"
  name: authentik-server-deployment
  namespace: authentik
 spec:
@@ -34,6 +36,8 @@ spec:
  selector:
    matchLabels:
      app: authentik-server
  strategy:
    type: Recreate
  template:
    metadata:
      labels:
@@ -53,7 +57,7 @@ spec:
          resources:
            requests:
              memory: "768Mi"
-              cpu: "300m"
+              cpu: "100m"
            limits:
              memory: "1.5Gi"
              cpu: "1000m"
@@ -61,6 +65,8 @@ spec:
 apiVersion: apps/v1
 kind: Deployment
 metadata:
  annotations:
    reloader.stakater.com/auto: "true"
  name: authentik-worker-deployment
  namespace: authentik
 spec:
@@ -68,6 +74,8 @@ spec:
  selector:
    matchLabels:
      app: authentik-worker
  strategy:
    type: Recreate
  template:
    metadata:
      labels:
@@ -87,7 +95,7 @@ spec:
          resources:
            requests:
              memory: "320Mi"
-              cpu: "300m"
+              cpu: "100m"
            limits:
              memory: "768Mi"
              cpu: "700m"
@@ -9,9 +9,6 @@ spec:
  routes:
    - match: Host(`auth.forust.xyz`)
      kind: Rule
      middlewares:
        - name: crowdsec-bouncer
          namespace: crowdsec
      services:
        - name: authentik-server-service
          port: 9000
@@ -1,6 +1,8 @@
 apiVersion: apps/v1
 kind: Deployment
 metadata:
  annotations:
    reloader.stakater.com/auto: "true"
  name: cfddns
  labels:
    app: cfddns
@@ -9,6 +11,8 @@ spec:
  selector:
    matchLabels:
      app: cfddns
  strategy:
    type: Recreate
  template:
    metadata:
      labels:
@@ -17,6 +17,8 @@ spec:
 apiVersion: apps/v1
 kind: Deployment
 metadata:
  annotations:
    reloader.stakater.com/auto: "true"
  name: checkmk-deployment
  namespace: checkmk
 spec:
@@ -24,6 +26,8 @@ spec:
  selector:
    matchLabels:
      app: checkmk
  strategy:
    type: Recreate
  template:
    metadata:
      labels:
@@ -9,9 +9,6 @@ spec:
  routes:
    - match: Host(`cmk.forust.xyz`)
      kind: Rule
      middlewares:
        - name: crowdsec-bouncer
          namespace: crowdsec
      services:
        - name: checkmk-service
          port: 5000
@@ -1,6 +1,8 @@
 apiVersion: apps/v1
 kind: Deployment
 metadata:
  annotations:
    reloader.stakater.com/auto: "true"
  name: cloudflared
  labels:
    app: cloudflared
@@ -9,6 +11,8 @@ spec:
  selector:
    matchLabels:
      app: cloudflared
  strategy:
    type: Recreate
  template:
    metadata:
      labels:
@@ -1,7 +1,7 @@
 services:
  convertx:
    container_name: convertx
-    image: ghcr.io/c4illin/convertx:v0.18.0
+    image: ghcr.io/c4illin/convertx:v0.19.0
    restart: unless-stopped
    ports:
      - "9992:3000"
@@ -13,6 +13,8 @@ spec:
 apiVersion: apps/v1
 kind: Deployment
 metadata:
  annotations:
    reloader.stakater.com/auto: "true"
  name: convertx-deployment
  namespace: converters
 spec:
@@ -20,13 +22,15 @@ spec:
  selector:
    matchLabels:
      app: convertx
  strategy:
    type: Recreate
  template:
    metadata:
      labels:
        app: convertx
    spec:
      containers:
-        - image: ghcr.io/c4illin/convertx:v0.18.0
+        - image: ghcr.io/c4illin/convertx:v0.19.0
          name: convertx
          envFrom:
            - configMapRef:
@@ -1,69 +0,0 @@
 # crowdsec/k8s is NOT managed by deploy.yaml - apply this by hand, and apply it
 # together with a restart:
 #   kubectl apply -f crowdsec/k8s/crowdsec-middleware.yaml
 #   kubectl -n traefik rollout restart deploy/traefik
 #
 # The restart is not optional. In stream mode the plugin runs a package-level
 # ticker goroutine (handleStreamTicker over the isCrowdsecStreamHealthy and
 # updateFailure globals) that no reconfiguration stops. Applying a change
 # wedges the instance: every route referencing it answers 404 and traefik logs
 # 'invalid middleware crowdsec-crowdsec-bouncer@kubernetescrd' until the pod is
 # replaced. Re-applying the previous config does NOT recover it, and the config
 # is not the cause - a valid CIDR cannot fail NewChecker, which is a plain
 # net.ParseCIDR. Only a new pod clears it. Measured cost: ~35s down for all
 # 20 hosts behind this middleware.
 apiVersion: traefik.io/v1alpha1
 kind: Middleware
 metadata:
  name: crowdsec-bouncer
  namespace: crowdsec
 spec:
  plugin:
    crowdsec-bouncer:
      enabled: true
      LogLevel: INFO
      # `live` blocked on a `GET /v1/decisions` per request, so a burst
      # saturated the LAPI and the plugin 403'd IPs that were never banned.
      # v1.3.3 ignores UpdateMaxFailure in `live`, so fail-open is only
      # reachable in stream mode, which polls into a cache instead - no
      # per-request call to saturate. 15s rather than the 60s default: the
      # deploy runner shares one public IP with the house, so this bounds
      # both how late a ban lands and how long a lifted one lingers.
      CrowdsecMode: stream
      UpdateIntervalSeconds: 15
      # -1 = never block because the LAPI is unreachable. In v1.3.3
      # handleStreamTicker only clears isCrowdsecStreamHealthy when
      # updateMaxFailure != -1, and ServeHTTP 403s once it is false, so this
      # makes a CrowdSec outage mean "no protection", not "every site 403".
      UpdateMaxFailure: -1
      CrowdsecLapiScheme: http
      CrowdsecLapiHost: crowdsec-service.crowdsec.svc.cluster.local:8080
      CrowdsecLapiKeyFile: "/etc/traefik/secrets/traefik-api-key"
      # Bypasses the bouncer and the decision cache, no LAPI round-trip.
      # Keep in sync with forust/local-network in crowdsec-values.yaml.
      ClientTrustedIPs:
        - "127.0.0.0/8"
        - "10.0.0.0/8"
        - "172.16.0.0/12"
        - "192.168.0.0/16"
        - "100.64.0.0/10"
        - "169.254.0.0/16"
        - "fc00::/7"
        - "fe80::/10"
        # The mobile operator range from forust/mobile-whitelist, repeated
        # deliberately rather than relying on the parser whitelist alone.
        # That whitelist drops the event before it reaches a bucket, so no
        # decision is ever created - but it is one config away from not
        # firing, and the bouncer would then enforce a ban that was never
        # justified. This is the last line: even a decision that exists for
        # any reason is not served against the phone.
        - "84.245.64.0/18"
      # The name is HTTPTimeoutSeconds, an int in seconds (min 1) - there is
      # no CrowdsecLapiTimeout, and an unrecognised key is silently dropped,
      # which is how this sat at the 10s default. Nothing rides on it per
      # request any more, so this only bounds the stream pull - and too low
      # is the dangerous direction: the LAPI needs ~2s to answer
      # /v1/decisions/stream, and a pull that times out leaves the ban cache
      # frozen at its startup contents ("failed sending new decisions"),
      # i.e. new bans silently never apply. Keep it above the pull latency.
      HTTPTimeoutSeconds: 10
@@ -16,6 +16,12 @@ agent:
      value: crowdsecurity/traefik crowdsecurity/base-http-scenarios
    - name: DISABLE_COLLECTIONS
      value: crowdsecurity/sshd
    # Bans on 401/403 bursts hurt more than they protect: with L3 enforcement
    # a false positive cuts the IP off everything (SSH included), and past
    # incidents show legit automation (deploy runner, mesh peers, registry
    # pulls) tripping this probe. Probing/XSS/SQLi/CVE scenarios stay.
    - name: DISABLE_SCENARIOS
      value: crowdsecurity/http-generic-bf
  metrics:
    enabled: true
    serviceMonitor:
@@ -81,6 +87,13 @@ config:
            - "169.254.0.0/16"
            - "fc00::/7"
            - "fe80::/10"
      vps-whitelist.yaml: |
        name: forust/vps-whitelist
        description: "Whitelist static VPS"
        whitelist:
          reason: "VPS"
          ip:
            - "193.181.211.79"
  postoverflows:
    s01-whitelist:
@@ -18,8 +18,6 @@ spec:
    - match: Host(`dockmon.forust.xyz`)
      kind: Rule
      middlewares:
        - name: crowdsec-bouncer
          namespace: crowdsec
        - name: security-headers@file
      services:
        - name: dockmon-service
@@ -1,7 +1,7 @@
 services:
  downtify:
    container_name: downtify
-    image: ghcr.io/henriquesebastiao/downtify:3.1.0
+    image: ghcr.io/henriquesebastiao/downtify:3.4.0
    restart: unless-stopped
    # ports:
    #   - '7077:8000'
@@ -20,6 +20,8 @@ spec:
  selector:
    matchLabels:
      app: downtify
  strategy:
    type: Recreate
  template:
    metadata:
      labels:
@@ -27,7 +29,7 @@ spec:
    spec:
      containers:
        - name: downtify
-          image: ghcr.io/henriquesebastiao/downtify:3.1.0
+          image: ghcr.io/henriquesebastiao/downtify:3.4.0
          ports:
            - containerPort: 8000
          volumeMounts:
@@ -10,8 +10,6 @@ spec:
    - match: Host(`downtify.forust.xyz`)
      kind: Rule
      middlewares:
        - name: crowdsec-bouncer
          namespace: crowdsec
        - name: security-chain@file
      services:
        - name: downtify-service
@@ -1,13 +0,0 @@
 FROM python:3.9-alpine
 WORKDIR /app
 # Установка зависимостей
 COPY requirements.txt .
 RUN pip install --no-cache-dir -r requirements.txt
 # Копирование кода
 COPY main.py .
 COPY .env .
 # Запуск бота
 CMD ["python", "-u", "main.py"]
@@ -1,373 +0,0 @@
 Mozilla Public License Version 2.0
 ==================================
 1. Definitions
 --------------
 1.1. "Contributor"
    means each individual or legal entity that creates, contributes to
    the creation of, or owns Covered Software.
 1.2. "Contributor Version"
    means the combination of the Contributions of others (if any) used
    by a Contributor and that particular Contributor's Contribution.
 1.3. "Contribution"
    means Covered Software of a particular Contributor.
 1.4. "Covered Software"
    means Source Code Form to which the initial Contributor has attached
    the notice in Exhibit A, the Executable Form of such Source Code
    Form, and Modifications of such Source Code Form, in each case
    including portions thereof.
 1.5. "Incompatible With Secondary Licenses"
    means
    (a) that the initial Contributor has attached the notice described
        in Exhibit B to the Covered Software; or
    (b) that the Covered Software was made available under the terms of
        version 1.1 or earlier of the License, but not also under the
        terms of a Secondary License.
 1.6. "Executable Form"
    means any form of the work other than Source Code Form.
 1.7. "Larger Work"
    means a work that combines Covered Software with other material, in 
    a separate file or files, that is not Covered Software.
 1.8. "License"
    means this document.
 1.9. "Licensable"
    means having the right to grant, to the maximum extent possible,
    whether at the time of the initial grant or subsequently, any and
    all of the rights conveyed by this License.
 1.10. "Modifications"
    means any of the following:
    (a) any file in Source Code Form that results from an addition to,
        deletion from, or modification of the contents of Covered
        Software; or
    (b) any new file in Source Code Form that contains any Covered
        Software.
 1.11. "Patent Claims" of a Contributor
    means any patent claim(s), including without limitation, method,
    process, and apparatus claims, in any patent Licensable by such
    Contributor that would be infringed, but for the grant of the
    License, by the making, using, selling, offering for sale, having
    made, import, or transfer of either its Contributions or its
    Contributor Version.
 1.12. "Secondary License"
    means either the GNU General Public License, Version 2.0, the GNU
    Lesser General Public License, Version 2.1, the GNU Affero General
    Public License, Version 3.0, or any later versions of those
    licenses.
 1.13. "Source Code Form"
    means the form of the work preferred for making modifications.
 1.14. "You" (or "Your")
    means an individual or a legal entity exercising rights under this
    License. For legal entities, "You" includes any entity that
    controls, is controlled by, or is under common control with You. For
    purposes of this definition, "control" means (a) the power, direct
    or indirect, to cause the direction or management of such entity,
    whether by contract or otherwise, or (b) ownership of more than
    fifty percent (50%) of the outstanding shares or beneficial
    ownership of such entity.
 2. License Grants and Conditions
 --------------------------------
 2.1. Grants
 Each Contributor hereby grants You a world-wide, royalty-free,
 non-exclusive license:
 (a) under intellectual property rights (other than patent or trademark)
    Licensable by such Contributor to use, reproduce, make available,
    modify, display, perform, distribute, and otherwise exploit its
    Contributions, either on an unmodified basis, with Modifications, or
    as part of a Larger Work; and
 (b) under Patent Claims of such Contributor to make, use, sell, offer
    for sale, have made, import, and otherwise transfer either its
    Contributions or its Contributor Version.
 2.2. Effective Date
 The licenses granted in Section 2.1 with respect to any Contribution
 become effective for each Contribution on the date the Contributor first
 distributes such Contribution.
 2.3. Limitations on Grant Scope
 The licenses granted in this Section 2 are the only rights granted under
 this License. No additional rights or licenses will be implied from the
 distribution or licensing of Covered Software under this License.
 Notwithstanding Section 2.1(b) above, no patent license is granted by a
 Contributor:
 (a) for any code that a Contributor has removed from Covered Software;
    or
 (b) for infringements caused by: (i) Your and any other third party's
    modifications of Covered Software, or (ii) the combination of its
    Contributions with other software (except as part of its Contributor
    Version); or
 (c) under Patent Claims infringed by Covered Software in the absence of
    its Contributions.
 This License does not grant any rights in the trademarks, service marks,
 or logos of any Contributor (except as may be necessary to comply with
 the notice requirements in Section 3.4).
 2.4. Subsequent Licenses
 No Contributor makes additional grants as a result of Your choice to
 distribute the Covered Software under a subsequent version of this
 License (see Section 10.2) or under the terms of a Secondary License (if
 permitted under the terms of Section 3.3).
 2.5. Representation
 Each Contributor represents that the Contributor believes its
 Contributions are its original creation(s) or it has sufficient rights
 to grant the rights to its Contributions conveyed by this License.
 2.6. Fair Use
 This License is not intended to limit any rights You have under
 applicable copyright doctrines of fair use, fair dealing, or other
 equivalents.
 2.7. Conditions
 Sections 3.1, 3.2, 3.3, and 3.4 are conditions of the licenses granted
 in Section 2.1.
 3. Responsibilities
 -------------------
 3.1. Distribution of Source Form
 All distribution of Covered Software in Source Code Form, including any
 Modifications that You create or to which You contribute, must be under
 the terms of this License. You must inform recipients that the Source
 Code Form of the Covered Software is governed by the terms of this
 License, and how they can obtain a copy of this License. You may not
 attempt to alter or restrict the recipients' rights in the Source Code
 Form.
 3.2. Distribution of Executable Form
 If You distribute Covered Software in Executable Form then:
 (a) such Covered Software must also be made available in Source Code
    Form, as described in Section 3.1, and You must inform recipients of
    the Executable Form how they can obtain a copy of such Source Code
    Form by reasonable means in a timely manner, at a charge no more
    than the cost of distribution to the recipient; and
 (b) You may distribute such Executable Form under the terms of this
    License, or sublicense it under different terms, provided that the
    license for the Executable Form does not attempt to limit or alter
    the recipients' rights in the Source Code Form under this License.
 3.3. Distribution of a Larger Work
 You may create and distribute a Larger Work under terms of Your choice,
 provided that You also comply with the requirements of this License for
 the Covered Software. If the Larger Work is a combination of Covered
 Software with a work governed by one or more Secondary Licenses, and the
 Covered Software is not Incompatible With Secondary Licenses, this
 License permits You to additionally distribute such Covered Software
 under the terms of such Secondary License(s), so that the recipient of
 the Larger Work may, at their option, further distribute the Covered
 Software under the terms of either this License or such Secondary
 License(s).
 3.4. Notices
 You may not remove or alter the substance of any license notices
 (including copyright notices, patent notices, disclaimers of warranty,
 or limitations of liability) contained within the Source Code Form of
 the Covered Software, except that You may alter any license notices to
 the extent required to remedy known factual inaccuracies.
 3.5. Application of Additional Terms
 You may choose to offer, and to charge a fee for, warranty, support,
 indemnity or liability obligations to one or more recipients of Covered
 Software. However, You may do so only on Your own behalf, and not on
 behalf of any Contributor. You must make it absolutely clear that any
 such warranty, support, indemnity, or liability obligation is offered by
 You alone, and You hereby agree to indemnify every Contributor for any
 liability incurred by such Contributor as a result of warranty, support,
 indemnity or liability terms You offer. You may include additional
 disclaimers of warranty and limitations of liability specific to any
 jurisdiction.
 4. Inability to Comply Due to Statute or Regulation
 ---------------------------------------------------
 If it is impossible for You to comply with any of the terms of this
 License with respect to some or all of the Covered Software due to
 statute, judicial order, or regulation then You must: (a) comply with
 the terms of this License to the maximum extent possible; and (b)
 describe the limitations and the code they affect. Such description must
 be placed in a text file included with all distributions of the Covered
 Software under this License. Except to the extent prohibited by statute
 or regulation, such description must be sufficiently detailed for a
 recipient of ordinary skill to be able to understand it.
 5. Termination
 --------------
 5.1. The rights granted under this License will terminate automatically
 if You fail to comply with any of its terms. However, if You become
 compliant, then the rights granted under this License from a particular
 Contributor are reinstated (a) provisionally, unless and until such
 Contributor explicitly and finally terminates Your grants, and (b) on an
 ongoing basis, if such Contributor fails to notify You of the
 non-compliance by some reasonable means prior to 60 days after You have
 come back into compliance. Moreover, Your grants from a particular
 Contributor are reinstated on an ongoing basis if such Contributor
 notifies You of the non-compliance by some reasonable means, this is the
 first time You have received notice of non-compliance with this License
 from such Contributor, and You become compliant prior to 30 days after
 Your receipt of the notice.
 5.2. If You initiate litigation against any entity by asserting a patent
 infringement claim (excluding declaratory judgment actions,
 counter-claims, and cross-claims) alleging that a Contributor Version
 directly or indirectly infringes any patent, then the rights granted to
 You by any and all Contributors for the Covered Software under Section
 2.1 of this License shall terminate.
 5.3. In the event of termination under Sections 5.1 or 5.2 above, all
 end user license agreements (excluding distributors and resellers) which
 have been validly granted by You or Your distributors under this License
 prior to termination shall survive termination.
 ************************************************************************
 *                                                                      *
 *  6. Disclaimer of Warranty                                           *
 *  -------------------------                                           *
 *                                                                      *
 *  Covered Software is provided under this License on an "as is"       *
 *  basis, without warranty of any kind, either expressed, implied, or  *
 *  statutory, including, without limitation, warranties that the       *
 *  Covered Software is free of defects, merchantable, fit for a        *
 *  particular purpose or non-infringing. The entire risk as to the     *
 *  quality and performance of the Covered Software is with You.        *
 *  Should any Covered Software prove defective in any respect, You     *
 *  (not any Contributor) assume the cost of any necessary servicing,   *
 *  repair, or correction. This disclaimer of warranty constitutes an   *
 *  essential part of this License. No use of any Covered Software is   *
 *  authorized under this License except under this disclaimer.         *
 *                                                                      *
 ************************************************************************
 ************************************************************************
 *                                                                      *
 *  7. Limitation of Liability                                          *
 *  --------------------------                                          *
 *                                                                      *
 *  Under no circumstances and under no legal theory, whether tort      *
 *  (including negligence), contract, or otherwise, shall any           *
 *  Contributor, or anyone who distributes Covered Software as          *
 *  permitted above, be liable to You for any direct, indirect,         *
 *  special, incidental, or consequential damages of any character      *
 *  including, without limitation, damages for lost profits, loss of    *
 *  goodwill, work stoppage, computer failure or malfunction, or any    *
 *  and all other commercial damages or losses, even if such party      *
 *  shall have been informed of the possibility of such damages. This   *
 *  limitation of liability shall not apply to liability for death or   *
 *  personal injury resulting from such party's negligence to the       *
 *  extent applicable law prohibits such limitation. Some               *
 *  jurisdictions do not allow the exclusion or limitation of           *
 *  incidental or consequential damages, so this exclusion and          *
 *  limitation may not apply to You.                                    *
 *                                                                      *
 ************************************************************************
 8. Litigation
 -------------
 Any litigation relating to this License may be brought only in the
 courts of a jurisdiction where the defendant maintains its principal
 place of business and such litigation shall be governed by laws of that
 jurisdiction, without reference to its conflict-of-law provisions.
 Nothing in this Section shall prevent a party's ability to bring
 cross-claims or counter-claims.
 9. Miscellaneous
 ----------------
 This License represents the complete agreement concerning the subject
 matter hereof. If any provision of this License is held to be
 unenforceable, such provision shall be reformed only to the extent
 necessary to make it enforceable. Any law or regulation which provides
 that the language of a contract shall be construed against the drafter
 shall not be used to construe this License against a Contributor.
 10. Versions of the License
 ---------------------------
 10.1. New Versions
 Mozilla Foundation is the license steward. Except as provided in Section
 10.3, no one other than the license steward has the right to modify or
 publish new versions of this License. Each version will be given a
 distinguishing version number.
 10.2. Effect of New Versions
 You may distribute the Covered Software under the terms of the version
 of the License under which You originally received the Covered Software,
 or under the terms of any subsequent version published by the license
 steward.
 10.3. Modified Versions
 If you create software not governed by this License, and you want to
 create a new license for such software, you may create and use a
 modified version of this License if you rename the license and remove
 any references to the name of the license steward (except to note that
 such modified license differs from this License).
 10.4. Distributing Source Code Form that is Incompatible With Secondary
 Licenses
 If You choose to distribute Source Code Form that is Incompatible With
 Secondary Licenses under the terms of this version of the License, the
 notice described in Exhibit B of this License must be attached.
 Exhibit A - Source Code Form License Notice
 -------------------------------------------
  This Source Code Form is subject to the terms of the Mozilla Public
  License, v. 2.0. If a copy of the MPL was not distributed with this
  file, You can obtain one at https://mozilla.org/MPL/2.0/.
 If it is not possible or desirable to put the notice in a particular
 file, then You may include the notice in a location (such as a LICENSE
 file in a relevant directory) where a recipient would be likely to look
 for such a notice.
 You may add additional accurate notices of copyright ownership.
 Exhibit B - "Incompatible With Secondary Licenses" Notice
 ---------------------------------------------------------
  This Source Code Form is "Incompatible With Secondary Licenses", as
  defined by the Mozilla Public License, v. 2.0.
@@ -1,15 +0,0 @@
 services:
  dtek_notif:
    build:
      context: .
      dockerfile: Dockerfile
    image: gcr.forust.xyz/forust/dtek-notif:latest
    pull_policy: build
    restart: unless-stopped
    environment:
      - TZ=Europe/Kyiv
    dns:
      - 1.1.1.1
      - 8.8.8.8
    networks:
      - default
@@ -1,748 +0,0 @@
 import asyncio
 import contextlib
 import logging
 import os
 from datetime import datetime, timedelta
 import requests
 from aiogram import Bot, Dispatcher
 from aiogram.filters import Command
 from aiogram.types import KeyboardButton, Message
 from aiogram.utils.keyboard import ReplyKeyboardBuilder
 from bs4 import BeautifulSoup
 from dotenv import load_dotenv
 # Загрузка переменных окружения
 load_dotenv()
 # Настройки
 TELEGRAM_TOKEN = os.getenv('TELEGRAM_TOKEN', 'YOUR_TOKEN_HERE')
 ALLOWED_CHAT_IDS = list(map(int, os.getenv('ALLOWED_CHAT_IDS', '').split(','))) if os.getenv('ALLOWED_CHAT_IDS') else []
 CHECK_INTERVAL = int(os.getenv('CHECK_INTERVAL', '120'))
 # Параметры для запроса
 VOE_CITY_ID = int(os.getenv('VOE_CITY_ID', 'VOE_CITY_ID'))
 VOE_STREET_ID = int(os.getenv('VOE_STREET_ID', 'VOE_STREET_ID'))
 VOE_HOUSE_ID = int(os.getenv('VOE_HOUSE_ID', 'VOE_HOUSE_ID'))
 # Настройка логирования
 logging.basicConfig(level=logging.INFO, format='%(asctime)s - %(name)s - %(levelname)s - %(message)s')
 logger = logging.getLogger(__name__)
 # Глобальные переменные
 bot = Bot(token=TELEGRAM_TOKEN)
 dp = Dispatcher()
 last_schedule: list[dict] | None = None
 last_notification_time: dict[str, datetime] = {}
 # ============================================================================
 # УТИЛИТЫ
 # ============================================================================
 def format_time_duration(minutes: int) -> str:
    """Форматирует время из минут в часы и минуты"""
    hours = minutes // 60
    mins = minutes % 60
    if hours == 0:
        return f'{mins}м'
    elif mins == 0:
        return f'{hours}ч'
    return f'{hours}ч {mins}м'
 def get_day_statistics(day_blocks: list[dict]) -> dict[str, int]:
    """Получает статистику по дню"""
    total_minutes = 0
    confirmed_minutes = 0
    possible_minutes = 0
    for block in day_blocks:
        for half in [block['first_half'], block['second_half']]:
            if half['status'] == 'off':
                total_minutes += 30
                if half['confirmed']:
                    confirmed_minutes += 30
                else:
                    possible_minutes += 30
    return {'total': total_minutes, 'confirmed': confirmed_minutes, 'possible': possible_minutes}
 # ============================================================================
 # ПАРСИНГ ДАННЫХ
 # ============================================================================
 def parse_html(html: str) -> list[dict]:
    """Парсит HTML с графиком отключений (логика от 15.11.2024)"""
    soup = BeautifulSoup(html, 'html.parser')
    cells = soup.select('.disconnection-detailed-table-cell.cell')
    schedule = []
    current_hour = 0
    current_day = 0
    for cell in cells:
        if 'legend' in cell.get('class', []) or 'head' in cell.get('class', []):
            continue
        cell_classes = cell.get('class', [])
        # ПРоверка статуса отключения на весь час
        full_hour_off = 'has_disconnection' in cell_classes and 'full_hour' in cell_classes
        hour_block = cell.select_one('.hour_block')
        if not hour_block:
            continue
        # Проверка подтверждённости отключения для всего часа
        cell_confirmed = None
        if 'confirm_1' in cell_classes:
            cell_confirmed = True
        elif 'confirm_0' in cell_classes:
            cell_confirmed = False
        # Проверка половин часа
        left = hour_block.select_one('.half.left')
        right = hour_block.select_one('.half.right')
        def parse_half(half, is_full_hour_off: bool, cell_confirmed: bool | None = None) -> dict:
            """Парсит половину часа"""
            if not half:
                return {'status': 'on', 'queue': None, 'confirmed': None}
            half_classes = half.get('class', [])
            # Если вся ячейка full_hour - используем статус ячейки
            if is_full_hour_off:
                return {'status': 'off', 'queue': None, 'confirmed': cell_confirmed}
            # Определяем статус половины
            if 'has_disconnection' in half_classes:
                status = 'off'
            elif 'no_disconnection' in half_classes:
                status = 'on'
            else:
                status = 'on'  # По умолчанию считаем включенным
            # Если выключено - ищем подробности
            queue = None
            confirmed = None
            if status == 'off':
                disconnection_div = half.select_one('.disconnection')
                if disconnection_div:
                    # Ищем номер черги в title
                    if disconnection_div.has_attr('title'):
                        title = disconnection_div['title']
                        if 'Номер черги' in title or 'Номер черги:' in title:
                            with contextlib.suppress(BaseException):
                                queue = title.split(':')[-1].strip()
                    # Определяем подтверждение
                    disc_classes = disconnection_div.get('class', [])
                    if 'disconnection_confirm_1' in disc_classes:
                        confirmed = True
                    elif 'disconnection_confirm_0' in disc_classes:
                        confirmed = False
            return {'status': status, 'queue': queue, 'confirmed': confirmed}
        first_half_data = parse_half(left, full_hour_off, cell_confirmed)
        second_half_data = parse_half(right, full_hour_off, cell_confirmed)
        schedule.append(
            {
                'hour': current_hour,
                'day': current_day,
                'first_half': first_half_data,
                'second_half': second_half_data,
            }
        )
        current_hour += 1
        if current_hour >= 24:
            current_hour = 0
            current_day += 1
    return schedule
 def get_voe_html(city_id: int, street_id: int, house_id: int) -> str:
    """Получает HTML с сайта VOE"""
    url = 'https://www.voe.com.ua/disconnection/detailed?ajax_form=1&_wrapper_format=drupal_ajax'
    headers = {
        'Content-Type': 'application/x-www-form-urlencoded; charset=UTF-8',
        'X-Requested-With': 'XMLHttpRequest',
        'User-Agent': 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36',
    }
    data = {
        'search_type': 0,
        'city_id': city_id,
        'street_id': street_id,
        'house_id': house_id,
        'form_build_id': 'form-Irv5aHw1R2FT_Ik2apyHOZ47hTH5xPNH_LQnBrmpSTc',
        'form_id': 'disconnection_detailed_search_form',
        '_triggering_element_name': 'search',
        '_triggering_element_value': 'Показати',
        '_drupal_ajax': 1,
    }
    try:
        response = requests.post(url, headers=headers, data=data, timeout=10)
        response.raise_for_status()
        resp_json = response.json()
        insert_html = next((item['data'] for item in resp_json if item.get('command') == 'insert'), None)
        if not insert_html:
            raise ValueError('HTML не найден в ответе')
        return insert_html
    except requests.exceptions.RequestException as e:
        logger.error(f'Ошибка запроса VOE: {e}')
        raise
 # ============================================================================
 # ФОРМАТИРОВАНИЕ СООБЩЕНИЙ
 # ============================================================================
 def get_main_keyboard():
    """Создает главную клавиатуру"""
    builder = ReplyKeyboardBuilder()
    builder.row(KeyboardButton(text='📊 Графік'), KeyboardButton(text='🔄 Оновити'))
    builder.row(KeyboardButton(text='📅 Сьогодні'), KeyboardButton(text='📅 Завтра'))
    builder.row(KeyboardButton(text='ℹ️ Про бота'))
    return builder.as_markup(resize_keyboard=True)
 def format_schedule_message(schedule: list[dict], days_to_show: int = 2) -> str:
    """Форматирует полный график на несколько дней"""
    lines = [
        '⚡️ <b>Графік відключень світла</b>',
        f'🕐 Оновлено: {datetime.now().strftime("%d.%m.%Y %H:%M:%S")}',
        '─' * 30,
        '',
    ]
    start_date = datetime.now()
    for day in range(min(days_to_show, 2)):
        day_blocks = [b for b in schedule if b['day'] == day]
        if not day_blocks:
            continue
        date_str = (start_date + timedelta(days=day)).strftime('%d.%m.%Y')
        day_name = '🌅 <b>Сьогодні</b>' if day == 0 else '🌄 <b>Завтра</b>'
        lines.append(f'{day_name} ({date_str})')
        # Статистика
        stats = get_day_statistics(day_blocks)
        if stats['total'] > 0:
            lines.append(f'⏱ Всього: <code>{format_time_duration(stats["total"])}</code>')
            if stats['confirmed'] > 0:
                lines.append(f'🔴 Підтверджено: <code>{format_time_duration(stats["confirmed"])}</code>')
            if stats['possible'] > 0:
                lines.append(f'🟠 Можливо: <code>{format_time_duration(stats["possible"])}</code>')
        else:
            lines.append('🟢 <b>Відключень немає!</b>')
        lines.append('')
        # Детальный список отключений
        disconnections = []
        current_status = None
        start_time = None
        current_confirmed = None
        current_queue = None
        for block in day_blocks:
            hour = block['hour']
            for half_idx, half in enumerate([block['first_half'], block['second_half']]):
                time_str = f'{hour:02d}:00' if half_idx == 0 else f'{hour:02d}:30'
                if half['status'] == 'off':
                    if current_status != 'off':
                        start_time = time_str
                        current_confirmed = half['confirmed']
                        current_queue = half['queue']
                    current_status = 'off'
                else:
                    if current_status == 'off':
                        icon = '🔴' if current_confirmed else '🟠'
                        queue_text = f' (Ч{current_queue})' if current_queue else ''
                        disconnections.append(f'{icon} <code>{start_time} - {time_str}</code>{queue_text}')
                    current_status = half['status']
        # Если день закончился на отключении
        if current_status == 'off':
            icon = '🔴' if current_confirmed else '🟠'
            queue_text = f' (Ч{current_queue})' if current_queue else ''
            next_hour = (day_blocks[-1]['hour'] + 1) % 24
            end_time = f'{next_hour:02d}:00'
            disconnections.append(f'{icon} <code>{start_time} - {end_time}</code>{queue_text}')
        if disconnections:
            for idx, disc in enumerate(disconnections, 1):
                lines.append(f'{idx}. {disc}')
        lines.append('')
    lines.append('<i>🔴 = підтверджено • 🟠 = можливо • 🟢 = світло</i>')
    return '\n'.join(lines)
 def format_single_day_schedule(schedule: list[dict], day: int) -> str:
    """Форматирует график на один день"""
    day_blocks = [b for b in schedule if b['day'] == day]
    if not day_blocks:
        return '❌ Немає даних для цього дня'
    start_date = datetime.now()
    date_str = (start_date + timedelta(days=day)).strftime('%d.%m.%Y')
    day_name = '🟠 <b>Сьогодні</b>' if day == 0 else '🔶 <b>Завтра</b>'
    lines = [f'{day_name}  •  {date_str}', '']
    # Статистика
    lines.append('<b>📊 Статистика</b>')
    stats = get_day_statistics(day_blocks)
    if stats['total'] == 0:
        lines.append('└ 🟢 <b>Відключень немає!</b>')
    else:
        total_time = format_time_duration(stats['total'])
        lines.append(f'├ ⏱ Всього: <code>{total_time}</code>')
        if stats['confirmed'] > 0:
            confirmed_time = format_time_duration(stats['confirmed'])
            lines.append(f'├ 🔴 Підтверджено: <code>{confirmed_time}</code>')
        if stats['possible'] > 0:
            possible_time = format_time_duration(stats['possible'])
            lines.append(f'└ 🟠 Можливо: <code>{possible_time}</code>')
        else:
            lines.append('└ 🟢 Решта часу світло')
    lines.append('')
    # Детальный список отключений
    disconnections = []
    current_status = None
    start_time = None
    current_confirmed = None
    current_queue = None
    for block in day_blocks:
        hour = block['hour']
        for half_idx, half in enumerate([block['first_half'], block['second_half']]):
            time_str = f'{hour:02d}:00' if half_idx == 0 else f'{hour:02d}:30'
            if half['status'] == 'off':
                if current_status != 'off':
                    start_time = time_str
                    current_confirmed = half['confirmed']
                    current_queue = half['queue']
                current_status = 'off'
            else:
                if current_status == 'off':
                    icon = '🔴' if current_confirmed else '🟠'
                    queue_text = f' (Ч.{current_queue})' if current_queue else ''
                    disconnections.append(f'{icon} <code>{start_time} - {time_str}</code>{queue_text}')
                current_status = half['status']
    # Если день закончился на отключении
    if current_status == 'off':
        icon = '🔴' if current_confirmed else '🟠'
        queue_text = f' (Ч.{current_queue})' if current_queue else ''
        next_hour = (day_blocks[-1]['hour'] + 1) % 24
        end_time = f'{next_hour:02d}:00'
        disconnections.append(f'{icon} <code>{start_time} - {end_time}</code>{queue_text}')
    if disconnections:
        lines.append('<b>⚡️ Розклад відключень</b>')
        for idx, disc in enumerate(disconnections, 1):
            lines.append(f'{idx}. {disc}')
    lines.append('')
    lines.append('<i>🔴 підтверджено  •  🟠 можливо  •  🟢 світло</i>')
    return '\n'.join(lines)
 def schedules_differ(old_schedule: list[dict] | None, new_schedule: list[dict] | None) -> bool:
    """Проверяет отличия между графиками"""
    if old_schedule is None or new_schedule is None:
        return True
    if len(old_schedule) != len(new_schedule):
        return True
    for old, new in zip(old_schedule, new_schedule, strict=False):
        if old['day'] >= 2:
            break
        if old['first_half'] != new['first_half'] or old['second_half'] != new['second_half']:
            return True
    return False
 # ============================================================================
 # УВЕДОМЛЕНИЯ
 # ============================================================================
 async def send_to_all_users(message_text: str, parse_mode: str = 'HTML'):
    """Отправляет сообщение всем пользователям"""
    if not ALLOWED_CHAT_IDS:
        logger.warning('Нет допущенных ID чатов для отправки уведомлений')
        return
    for chat_id in ALLOWED_CHAT_IDS:
        try:
            await bot.send_message(chat_id, message_text, parse_mode=parse_mode)
            logger.info(f'✅ Сообщение отправлено пользователю {chat_id}')
        except Exception as e:
            logger.error(f'❌ Ошибка отправки пользователю {chat_id}: {e}')
        await asyncio.sleep(0.5)
 async def check_schedule():
    """Проверяет график и отправляет уведомления"""
    global last_schedule
    try:
        logger.info('🔍 Проверка графика...')
        html = get_voe_html(VOE_CITY_ID, VOE_STREET_ID, VOE_HOUSE_ID)
        new_schedule = parse_html(html)
        if schedules_differ(last_schedule, new_schedule):
            logger.info('✨ Обнаружены изменения!')
            message = format_schedule_message(new_schedule, days_to_show=2)
            if last_schedule is not None:
                await send_to_all_users(f'🔄 <b>Графік оновлено!</b>\n\n{message}')
            last_schedule = new_schedule
        else:
            logger.info('✓ Графік без змін')
    except Exception as e:
        logger.error(f'❌ Ошибка при проверке графика: {e}')
 async def check_upcoming_disconnections():
    """Проверяет предстоящие события и отправляет предупреждения за 5 минут"""
    global last_notification_time
    if last_schedule is None:
        return
    now = datetime.now()
    today_blocks = [b for b in last_schedule if b['day'] == 0]
    # Создаем список всех переходов (off -> on или on -> off)
    transitions = []
    prev_status = None
    for block in today_blocks:
        hour = block['hour']
        for half_idx, half in enumerate([block['first_half'], block['second_half']]):
            minute = 0 if half_idx == 0 else 30
            time_str = f'{hour:02d}:{minute:02d}'
            current_status = half['status']
            # Если статус изменился - это переход
            if prev_status is not None and prev_status != current_status:
                transitions.append(
                    {
                        'hour': hour,
                        'minute': minute,
                        'time_str': time_str,
                        'from_status': prev_status,
                        'to_status': current_status,
                        'confirmed': half.get('confirmed'),
                        'queue': half.get('queue'),
                    }
                )
            prev_status = current_status
    # Проверяем переходы
    for transition in transitions:
        event_time = now.replace(hour=transition['hour'], minute=transition['minute'], second=0, microsecond=0)
        time_until = (event_time - now).total_seconds() / 60
        notification_key = f'{transition["hour"]}:{transition["minute"]}_{transition["to_status"]}'
        # Если за 5 минут до события (±1 минута) и еще не отправляли
        if 4 <= time_until <= 6:
            # Проверяем, не отправляли ли уже уведомление сегодня
            if notification_key in last_notification_time:
                last_notif_time = last_notification_time[notification_key]
                if last_notif_time.date() == now.date():
                    continue  # Уже отправляли сегодня
            # Переход на ОТКЛЮЧЕНИЕ (on -> off)
            if transition['from_status'] == 'on' and transition['to_status'] == 'off':
                icon = '🔴' if transition['confirmed'] else '🟠'
                status = 'підтверджено' if transition['confirmed'] else 'можливе'
                queue_info = f' (Черга {transition["queue"]})' if transition['queue'] else ''
                warning = (
                    f'⚠️ <b>УВАГА! ВІДКЛЮЧЕННЯ</b>\n\n'
                    f'Через ~5 хвилин\n'
                    f'Час: <code>{transition["time_str"]}</code>\n'
                    f'Статус: {icon} {status}{queue_info}'
                )
                await send_to_all_users(warning)
                last_notification_time[notification_key] = now
                logger.info(f'📢 Відправлено попередження про ВІДКЛЮЧЕННЯ в {transition["time_str"]}')
            # Переход на ВКЛЮЧЕНИЕ (off -> on)
            elif transition['from_status'] == 'off' and transition['to_status'] == 'on':
                warning = (
                    f'✅ <b>УВАГА! ВКЛЮЧЕННЯ</b>\n\n'
                    f'Через ~5 хвилин буде світло\n'
                    f'Час: <code>{transition["time_str"]}</code>'
                )
                await send_to_all_users(warning)
                last_notification_time[notification_key] = now
                logger.info(f'📢 Відправлено попередження про ВКЛЮЧЕННЯ в {transition["time_str"]}')
 async def monitoring_loop():
    """Основной цикл мониторинга"""
    await check_schedule()
    while True:
        try:
            await asyncio.sleep(CHECK_INTERVAL)
            await check_schedule()
            await check_upcoming_disconnections()
        except Exception as e:
            logger.error(f'Ошибка в цикле мониторинга: {e}')
            await asyncio.sleep(5)
 # ============================================================================
 # ОБРАБОТЧИКИ КОМАНД
 # ============================================================================
@dp.message(Command('start'))
 async def cmd_start(message: Message):
    """Обработчик /start"""
    if message.chat.id not in ALLOWED_CHAT_IDS:
        await message.answer('❌ У вас немає доступу до цього бота.')
        return
    await message.answer(
        '👋 <b>Ласкаво просимо!</b>\n\n'
        '🤖 <b>Бот для моніторингу графіку відключень світла</b>\n\n'
        '✨ <b>Можливості:</b>\n'
        '• 📊 Перегляд графіку на сьогодні і завтра\n'
        '• 🔔 Автоматичні сповіщення за 5 хвилин до подій\n'
        '• 🔄 Моніторинг змін графіку\n\n'
        'Використовуйте кнопки нижче 👇',
        parse_mode='HTML',
        reply_markup=get_main_keyboard(),
    )
@dp.message(lambda msg: msg.text == 'ℹ️ Про бота')
 async def cmd_info(message: Message):
    """Показывает информацию о боте"""
    if message.chat.id not in ALLOWED_CHAT_IDS:
        return
    await message.answer(
        '<b>ℹ️ Про бота</b>\n\n'
        '🚀 <b>Версія:</b> 2.2 (Стабільна)\n\n'
        '📝 <b>Реліз-ноути:</b>\n'
        '├ 15.11.2024: Адаптація під оновлену логіку сайту VOE\n'
        '├ Виправлено парсинг half.left та half.right\n'
        '├ Покращено визначення підтвердження відключень\n'
        '└ Оптимізовано обробку статусу для всієї години\n\n'
        '⚡ <b>Функціональність:</b>\n'
        '├ Моніторинг графіку 24/7\n'
        '├ Сповіщення за 5 хвилин\n'
        '├ Детальна статистика дня\n'
        '└ Красива візуалізація\n\n'
        '🔐 <b>Безпека:</b> Використовуються .env файли\n'
        '💾 <b>Джерело:</b> voe.com.ua',
        parse_mode='HTML',
        reply_markup=get_main_keyboard(),
    )
@dp.message(Command('schedule'))
 async def cmd_schedule(message: Message):
    """Показывает полный график"""
    if message.chat.id not in ALLOWED_CHAT_IDS:
        await message.answer('❌ У вас немає доступу.')
        return
    try:
        await message.answer('⏳ Завантаження графіку...')
        html = get_voe_html(VOE_CITY_ID, VOE_STREET_ID, VOE_HOUSE_ID)
        schedule = parse_html(html)
        text = format_schedule_message(schedule, days_to_show=2)
        await message.answer(text, parse_mode='HTML', reply_markup=get_main_keyboard())
    except Exception as e:
        await message.answer(f'❌ <b>Помилка:</b> {str(e)}', parse_mode='HTML', reply_markup=get_main_keyboard())
@dp.message(Command('today'))
 async def cmd_today(message: Message):
    """Показывает график на сегодня"""
    if message.chat.id not in ALLOWED_CHAT_IDS:
        await message.answer('❌ У вас немає доступу.')
        return
    try:
        await message.answer('⏳ Завантаження графіку сьогодні...')
        html = get_voe_html(VOE_CITY_ID, VOE_STREET_ID, VOE_HOUSE_ID)
        schedule = parse_html(html)
        text = format_single_day_schedule(schedule, 0)
        await message.answer(text, parse_mode='HTML', reply_markup=get_main_keyboard())
    except Exception as e:
        await message.answer(f'❌ <b>Помилка:</b> {str(e)}', parse_mode='HTML', reply_markup=get_main_keyboard())
@dp.message(Command('tomorrow'))
 async def cmd_tomorrow(message: Message):
    """Показывает график на завтра"""
    if message.chat.id not in ALLOWED_CHAT_IDS:
        await message.answer('❌ У вас немає доступу.')
        return
    try:
        await message.answer('⏳ Завантаження графіку завтра...')
        html = get_voe_html(VOE_CITY_ID, VOE_STREET_ID, VOE_HOUSE_ID)
        schedule = parse_html(html)
        text = format_single_day_schedule(schedule, 1)
        await message.answer(text, parse_mode='HTML', reply_markup=get_main_keyboard())
        # await message.answer("❌ Функція тимчасово недоступна. Чекаємо на оновлення сайту", parse_mode="HTML", reply_markup=get_main_keyboard())
    except Exception as e:
        await message.answer(f'❌ <b>Помилка:</b> {str(e)}', parse_mode='HTML', reply_markup=get_main_keyboard())
@dp.message(Command('check'))
 async def cmd_check(message: Message):
    """Принудительная проверка графика"""
    if message.chat.id not in ALLOWED_CHAT_IDS:
        await message.answer('❌ У вас немає доступу.')
        return
    try:
        await message.answer('🔄 <b>Перевіряю графік...</b>', parse_mode='HTML')
        html = get_voe_html(VOE_CITY_ID, VOE_STREET_ID, VOE_HOUSE_ID)
        new_schedule = parse_html(html)
        prefix = (
            '✅ <b>Знайдено зміни!</b>\n\n'
            if schedules_differ(last_schedule, new_schedule)
            else '✓ <b>Графік без змін</b>\n\n'
        )
        result = prefix + format_schedule_message(new_schedule, days_to_show=2)
        await message.answer(result, parse_mode='HTML', reply_markup=get_main_keyboard())
    except Exception as e:
        await message.answer(f'❌ <b>Помилка:</b> {str(e)}', parse_mode='HTML', reply_markup=get_main_keyboard())
@dp.message()
 async def handle_text(message: Message):
    """Обработчик текстовых сообщений и кнопок"""
    if message.chat.id not in ALLOWED_CHAT_IDS:
        return
    text = message.text
    # Кнопка "Графік"
    if text == '📊 Графік':
        await cmd_schedule(message)
    # Кнопка "Сьогодні"
    elif text == '📅 Сьогодні':
        await cmd_today(message)
    # Кнопка "Завтра"
    elif text == '📅 Завтра':
        await cmd_tomorrow(message)
    # Кнопка "Оновити"
    elif text == '🔄 Оновити':
        await cmd_check(message)
    # Кнопка "Про бота"
    elif text == 'ℹ️ Про бота':
        await cmd_info(message)
    # Неизвестная команда
    else:
        await message.answer(
            '❓ <b>Команда не розпізнана</b>\n\n'
            'Використовуйте кнопки на клавіатурі або команди:\n'
            '/start • /today • /tomorrow • /schedule • /check',
            parse_mode='HTML',
            reply_markup=get_main_keyboard(),
        )
 # ============================================================================
 # ГЛАВНАЯ ФУНКЦИЯ
 # ============================================================================
 async def main():
    """Главная функция"""
    logger.info('=' * 50)
    logger.info('ЗАПУСК БОТА V2.2 (stable 2.2, 15.11.2025)')
    logger.info('=' * 50)
    if not TELEGRAM_TOKEN or os.getenv('TELEGRAM_TOKEN', 'YOUR_TOKEN_HERE') == TELEGRAM_TOKEN:
        logger.error('❌ TELEGRAM_TOKEN не конфігурований! Напишіть токен в .env файл')
        return
    if not ALLOWED_CHAT_IDS:
        logger.error('❌ ALLOWED_CHAT_IDS не конфігуровані! Напишіть ID в .env файл')
        return
    logger.info(f'📌 Allowed chat ids: {ALLOWED_CHAT_IDS}')
    logger.info(f'⏱ Інтервал перевірки: {CHECK_INTERVAL} сек')
    logger.info('=' * 50)
    # Запускаем мониторинг
    monitoring_task = asyncio.create_task(monitoring_loop())
    try:
        await dp.start_polling(bot)
    except KeyboardInterrupt:
        logger.info('⏹ Бот зупинений користувачем')
    finally:
        monitoring_task.cancel()
        await bot.session.close()
        logger.info('✓ Підключення закрито')
 if __name__ == '__main__':
    try:
        asyncio.run(main())
    except KeyboardInterrupt:
        logger.info('⏹ Завершено')
@@ -1,7 +0,0 @@
 [project]
 name = "dtek-notif"
 version = "0.1.0"
 description = "Add your description here"
 readme = "README.md"
 requires-python = ">=3.13"
 dependencies = []
@@ -1,5 +0,0 @@
 requests>=2.31.0
 beautifulsoup4>=4.12.0
 aiogram>=3.3.0
 python-dotenv>=1.0.0
 aiohttp>=3.9.0
@@ -10,6 +10,8 @@ spec:
  selector:
    matchLabels:
      app: edu-master-playwright
  strategy:
    type: Recreate
  template:
    metadata:
      labels:
@@ -1,6 +1,8 @@
 apiVersion: apps/v1
 kind: Deployment
 metadata:
  annotations:
    reloader.stakater.com/auto: "true"
  name: session-keeper
  namespace: edu-master
  labels:
@@ -10,6 +12,8 @@ spec:
  selector:
    matchLabels:
      app: edu-master-session-keeper
  strategy:
    type: Recreate
  template:
    metadata:
      labels:
@@ -1,6 +1,8 @@
 apiVersion: apps/v1
 kind: Deployment
 metadata:
  annotations:
    reloader.stakater.com/auto: "true"
  name: webinar-checker
  namespace: edu-master
  labels:
@@ -10,6 +12,8 @@ spec:
  selector:
    matchLabels:
      app: edu-master-webinar-checker
  strategy:
    type: Recreate
  template:
    metadata:
      labels:
@@ -20,6 +20,8 @@ spec:
  selector:
    matchLabels:
      app: error-pages
  strategy:
    type: Recreate
  template:
    metadata:
      labels:
@@ -1,6 +1,6 @@
 services:
  server:
-    image: docker.gitea.com/gitea:1.27.3
+    image: docker.gitea.com/gitea:28.0.0
    container_name: gitea
    restart: always
    environment:
@@ -13,9 +13,12 @@ services:
      - GITEA__database__PASSWD=gitea
      - GITEA__database__NAME=gitea
      # Server
-      - GITEA__server__ROOT_URL=https://gitea.forust.xyz
+      - GITEA__server__ROOT_URL=https://git.forust.xyz
      - GITEA__server__SSH_DOMAIN=gitssh.forust.xyz
      - GITEA__server__SSH_PORT=2221
      # Pin 28.0 defaults explicitly (see k8s/config.yaml for rationale)
      - GITEA__service__DISABLE_REGISTRATION=true
      - GITEA__actions__RUN_RETENTION_DAYS=90
      # Mailer
      - GITEA__mailer__ENABLED=true
      - GITEA__mailer__FROM=${SERVICE_EMAIL}
@@ -34,7 +37,7 @@ services:
      - "traefik.http.services.gitea.loadbalancer.server.port=3000"
      # Prod Router
-      - "traefik.http.routers.gitea.rule=Host(`gitea.forust.xyz`)"
+      - "traefik.http.routers.gitea.rule=Host(`git.forust.xyz`) || Host(`gitea.forust.xyz`)"
      - "traefik.http.routers.gitea.entrypoints=websecure"
      - "traefik.http.routers.gitea.tls.certresolver"
      # Local Router
@@ -8,6 +8,7 @@ spec:
  dnsNames:
    - gcr.forust.xyz
    - gitea.forust.xyz
    - git.forust.xyz
  issuerRef:
    name: letsencrypt-prod
    kind: ClusterIssuer
@@ -4,11 +4,14 @@ metadata:
  name: gitea-config
  namespace: gitea
 data:
-  GITEA__server__DOMAIN: "gitea.forust.xyz"
+  GITEA__server__ROOT_URL: "https://git.forust.xyz"
  GITEA__server__ROOT_URL: "https://gitea.forust.xyz"
  GITEA__server__SSH_DOMAIN: "gitssh.forust.xyz"
  GITEA__server__SSH_PORT: "2221"
  GITEA__service__DISABLE_REGISTRATION: "true"
  GITEA__actions__RUN_RETENTION_DAYS: "90"
  GITEA__database__DB_TYPE: "postgres"
  GITEA__database__HOST: "postgres.database.svc.cluster.local:5432"
  GITEA__database__NAME: "gitea"
@@ -17,6 +17,8 @@ spec:
 apiVersion: apps/v1
 kind: Deployment
 metadata:
  annotations:
    reloader.stakater.com/auto: "true"
  name: gitea-deployment
  namespace: gitea
 spec:
@@ -24,6 +26,8 @@ spec:
  selector:
    matchLabels:
      app: gitea
  strategy:
    type: Recreate
  template:
    metadata:
      labels:
@@ -31,7 +35,7 @@ spec:
    spec:
      containers:
        - name: gitea
-          image: gitea/gitea:1.27.3
+          image: gitea/gitea:28.0.0
          envFrom:
            - configMapRef:
                name: gitea-config
@@ -48,7 +52,7 @@ spec:
          resources:
            requests:
              memory: "320Mi"
-              cpu: "300m"
+              cpu: "100m"
            limits:
              memory: "1Gi"
              cpu: "1300m"
@@ -7,21 +7,11 @@ spec:
  entryPoints:
    - websecure
  routes:
-    - match: Host(`gitea.forust.xyz`)
+    - match: Host(`gitea.forust.xyz`) || Host(`git.forust.xyz`)
      kind: Rule
      middlewares:
        - name: crowdsec-bouncer
          namespace: crowdsec
      services:
        - name: gitea-service
          port: 3000
    # Registry route: NO crowdsec-bouncer.
    # A deploy burst (runner Action API polls, `docker manifest inspect` per
    # own image, containerd pulls, smoke probes) fires hundreds of parallel
    # registry calls, and a ban on the runner breaks every later job. This
    # route only serves authenticated OCI traffic - registry tokens and
    # basic-auth are already handled by gitea - and scanners get nothing
    # useful from /v2, so there is no bruteforce surface to protect here.
    - match: Host(`gcr.forust.xyz`) && PathPrefix(`/v2`)
      kind: Rule
      services:
@@ -39,7 +29,7 @@ spec:
  entryPoints:
    - websecure
  routes:
-    - match: Host(`gitea.workstation.internal`) || Host(`gitea.gigaforust.internal`)
+    - match: (Host(`gitea.workstation.internal`) || Host(`gitea.gigaforust.internal`)) || (Host(`git.workstation.internal`) || Host(`git.gigaforust.internal`))
      kind: Rule
      services:
        - name: gitea-service
@@ -177,8 +177,8 @@ data:
                  # url: https://gitssh.forust.xyz
                # - title: gcr.forust.xyz
                  # url: https://gcr.forust.xyz/v2/
-                - title: gitea.forust.xyz
+                - title: git.forust.xyz
-                  url: https://gitea.forust.xyz
+                  url: https://git.forust.xyz
                - title: nextcloud.forust.xyz
                  url: https://nextcloud.forust.xyz
                - title: mc.forust.xyz
@@ -13,6 +13,8 @@ spec:
 apiVersion: apps/v1
 kind: Deployment
 metadata:
  annotations:
    reloader.stakater.com/auto: "true"
  name: glance-deployment
  namespace: glance
 spec:
@@ -20,6 +22,8 @@ spec:
  selector:
    matchLabels:
      app: glance
  strategy:
    type: Recreate
  template:
    metadata:
      labels:
@@ -23,17 +23,11 @@ spec:
          port: 8080
    - match: Host(`hs.forust.xyz`) && PathPrefix(`/admin`)
      kind: Rule
      middlewares:
        - name: crowdsec-bouncer
          namespace: crowdsec
      services:
        - name: headscale-ui-external
          port: 80
    - match: Host(`hs.forust.xyz`) && PathPrefix(`/metrics`)
      kind: Rule
      middlewares:
        - name: crowdsec-bouncer
          namespace: crowdsec
      services:
        - name: headscale-server-external
          port: 9090
@@ -53,8 +47,6 @@ spec:
      kind: Rule
      middlewares:
        - name: headplane-prefix
        - name: crowdsec-bouncer
          namespace: crowdsec
      services:
        - name: headplane-external
          port: 3000
@@ -0,0 +1,4 @@
 SECRET_ENCRYPTION_KEY="REPLACE_ME"
 TZ="Europe/Bratislava"
 PUID="1000"
 PGID="1000"
@@ -0,0 +1,38 @@
 services:
  homarr:
    container_name: homarr
    image: ghcr.io/homarr-labs/homarr:v2.1.2
    restart: unless-stopped
    volumes:
      - ./appdata:/appdata
      - /var/run/docker.sock:/var/run/docker.sock:ro
      - ./kubeconfig:/app/config/kubeconfig:ro
    env_file: .env
    ports:
      - 80:7575
      - 81:3000
    environment:
      - TZ=${TZ:-Europe/Bratislava}
      - TURBO_TELEMETRY_DISABLED=1
      - KUBECONFIG=/app/config/kubeconfig
    labels:
      - "traefik.enable=true"
      - "traefik.http.services.homarr.loadbalancer.server.port=7575"
      # Prod Router
      - "traefik.http.routers.homarr.rule=Host(`homarr.forust.xyz`)"
      - "traefik.http.routers.homarr.entrypoints=websecure"
      - "traefik.http.routers.homarr.tls.certresolver=letsencrypt"
      # Local Router
      - "traefik.http.routers.homarr-local.rule=Host(`homarr.workstation.internal`)"
      - "traefik.http.routers.homarr-local.entrypoints=websecure"
      - "traefik.http.routers.homarr-local.tls=true"
      # Dev Router
      - "traefik.http.routers.homarr-dev.rule=Host(`homarr.gigaforust.internal`)"
      - "traefik.http.routers.homarr-dev.entrypoints=websecure"
      - "traefik.http.routers.homarr-dev.tls=true"
    networks:
      - proxy
 networks:
  proxy:
    external: true
@@ -1,8 +1,21 @@
 # apiVersion: cert-manager.io/v1
 # kind: Certificate
 # metadata:
 #   name: home-prod-tls
 #   namespace: homarr
 # spec:
 #   secretName: home-prod-tls
 #   dnsNames:
 #     - home.forust.xyz
 #   issuerRef:
 #     name: letsencrypt-prod
 #     kind: ClusterIssuer
 # ---
 apiVersion: cert-manager.io/v1
 kind: Certificate
 metadata:
  name: internal-wildcard-tls
-  namespace: userbot
+  namespace: homarr
 spec:
  secretName: internal-wildcard-tls
  dnsNames:
@@ -0,0 +1,9 @@
 apiVersion: v1
 kind: ConfigMap
 metadata:
  name: homarr-config
  namespace: homarr
 data:
  TZ: "Europe/Bratislava"
  TURBO_TELEMETRY_DISABLED: "1"
  ENABLE_KUBERNETES: "true"
@@ -0,0 +1,83 @@
 apiVersion: v1
 kind: Service
 metadata:
  name: homarr-service
  namespace: homarr
 spec:
  selector:
    app: homarr
  ports:
    - port: 7575
      targetPort: 7575
 ---
 apiVersion: apps/v1
 kind: Deployment
 metadata:
  annotations:
    reloader.stakater.com/auto: "true"
  name: homarr-deployment
  namespace: homarr
 spec:
  replicas: 1
  selector:
    matchLabels:
      app: homarr
  strategy:
    type: Recreate
  template:
    metadata:
      labels:
        app: homarr
    spec:
      serviceAccountName: homarr
      containers:
        - name: homarr
          image: ghcr.io/homarr-labs/homarr:v2.1.2
          envFrom:
            - configMapRef:
                name: homarr-config
            - secretRef:
                name: homarr-secrets
          ports:
            - containerPort: 7575
          readinessProbe:
            httpGet:
              path: /
              port: 7575
            initialDelaySeconds: 30
            periodSeconds: 10
            failureThreshold: 6
          livenessProbe:
            httpGet:
              path: /
              port: 7575
            initialDelaySeconds: 60
            periodSeconds: 30
            failureThreshold: 3
          volumeMounts:
            - name: homarr-data
              mountPath: /appdata
          resources:
            requests:
              cpu: "250m"
              memory: "350Mi"
            limits:
              cpu: "500m"
              memory: "700Mi"
      volumes:
        - name: homarr-data
          persistentVolumeClaim:
            claimName: homarr-pvc
 ---
 apiVersion: v1
 kind: PersistentVolumeClaim
 metadata:
  name: homarr-pvc
  namespace: homarr
 spec:
  resources:
    requests:
      storage: 2Gi
  volumeMode: Filesystem
  accessModes:
    - ReadWriteOnce
@@ -0,0 +1,33 @@
 # apiVersion: traefik.io/v1alpha1
 # kind: IngressRoute
 # metadata:
 #   name: homarr-prod
 #   namespace: homarr
 # spec:
 #   entryPoints:
 #     - websecure
 #   routes:
 #     - match: Host(`home.forust.xyz`)
 #       kind: Rule
 #       services:
 #         - name: homarr-service
 #           port: 7575
 #   tls:
 #     secretName: home-prod-tls
 # ---
 apiVersion: traefik.io/v1alpha1
 kind: IngressRoute
 metadata:
  name: homarr-local
  namespace: homarr
 spec:
  entryPoints:
    - websecure
  routes:
    - match: Host(`home.workstation.internal`) || Host(`home.gigaforust.internal`)
      kind: Rule
      services:
        - name: homarr-service
          port: 7575
  tls:
    secretName: internal-wildcard-tls
@@ -0,0 +1,4 @@
 apiVersion: v1
 kind: Namespace
 metadata:
  name: homarr
@@ -0,0 +1,58 @@
 apiVersion: v1
 kind: ServiceAccount
 metadata:
  name: homarr
  namespace: homarr
 ---
 apiVersion: rbac.authorization.k8s.io/v1
 kind: ClusterRole
 metadata:
  name: homarr-readonly
 rules:
  - apiGroups: [""]
    resources:
      - pods
      - services
      - endpoints
      - namespaces
      - nodes
      - configmaps
      - persistentvolumeclaims
      - events
    verbs: ["get", "list", "watch"]
  - apiGroups: ["apps"]
    resources:
      - deployments
      - statefulsets
      - daemonsets
      - replicasets
    verbs: ["get", "list", "watch"]
  - apiGroups: ["networking.k8s.io"]
    resources:
      - ingresses
    verbs: ["get", "list", "watch"]
  - apiGroups: ["traefik.io"]
    resources:
      - ingressroutes
      - ingressroutetcps
      - ingressrouteudps
      - middlewares
    verbs: ["get", "list", "watch"]
  - apiGroups: ["metrics.k8s.io"]
    resources:
      - pods
      - nodes
    verbs: ["get", "list"]
 ---
 apiVersion: rbac.authorization.k8s.io/v1
 kind: ClusterRoleBinding
 metadata:
  name: homarr-readonly
 roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: ClusterRole
  name: homarr-readonly
 subjects:
  - kind: ServiceAccount
    name: homarr
    namespace: homarr
@@ -0,0 +1,9 @@
 apiVersion: v1
 kind: Secret
 metadata:
  name: homarr-secrets
  namespace: homarr
 type: Opaque
 stringData:
  # openssl rand -hex 32
  SECRET_ENCRYPTION_KEY: "REPLACE_ME"
@@ -174,7 +174,7 @@
        <h2>./projects</h2>
        <ul class="repo-list">
          <li>
-            <a href="https://gitea.forust.xyz/forust/gosleep" target="_blank">forust/gosleep</a>
+            <a href="https://git.forust.xyz/forust/gosleep" target="_blank">forust/gosleep</a>
            <span class="comment">// linux sleep timer written in rust (originally in go)</span>
          </li>
        </ul>
@@ -0,0 +1,31 @@
 # Gateway API PoC for homepages. Lives next to the TLS secrets so
 # certificateRefs stay same-namespace and no ReferenceGrant is needed.
 # Listener ports must match the Traefik entryPoints (80/443),
 # otherwise Traefik marks the listener Invalid.
 # Local .internal hosts are deliberately left on IngressRoute,
 # only prod is migrated here.
 apiVersion: gateway.networking.k8s.io/v1
 kind: Gateway
 metadata:
  name: homepages
  namespace: homepages
 spec:
  gatewayClassName: traefik
  listeners:
    - name: http
      protocol: HTTP
      port: 80
      allowedRoutes:
        namespaces:
          from: Same
    - name: https
      protocol: HTTPS
      port: 443
      tls:
        mode: Terminate
        certificateRefs:
          - name: forust-homepage-prod-tls
          - name: xdfnx-homepage-prod-tls
      allowedRoutes:
        namespaces:
          from: Same
@@ -20,6 +20,8 @@ spec:
  selector:
    matchLabels:
      app: forust-homepage
  strategy:
    type: Recreate
  template:
    metadata:
      labels:
@@ -67,6 +69,8 @@ spec:
  selector:
    matchLabels:
      app: xdfnx-homepage
  strategy:
    type: Recreate
  template:
    metadata:
      labels:
@@ -0,0 +1,69 @@
 # PoC: homepages prod hosts via Gateway API.
 # Runs alongside k8s/ingress.yaml - delete the prod IngressRoutes only after verification.
 # There are no local .internal hosts here, they stay on the local IngressRoute.
 # No per-route security middlewares: L3 enforcement moved to the host
 # firewall bouncer, so HTTPRoutes stay clean.
 ---
 apiVersion: gateway.networking.k8s.io/v1
 kind: HTTPRoute
 metadata:
  name: homepages-http-redirect
  namespace: homepages
 spec:
  parentRefs:
    - name: homepages
      kind: Gateway
      sectionName: http
  hostnames:
    - forust.xyz
    - www.forust.xyz
    - xdfnx.cfd
  rules:
    - filters:
        - type: RequestRedirect
          requestRedirect:
            scheme: https
            statusCode: 301
 ---
 apiVersion: gateway.networking.k8s.io/v1
 kind: HTTPRoute
 metadata:
  name: forust-homepage-https
  namespace: homepages
 spec:
  parentRefs:
    - name: homepages
      kind: Gateway
      sectionName: https
  hostnames:
    - forust.xyz
    - www.forust.xyz
  rules:
    - matches:
        - path:
            type: PathPrefix
            value: /
      backendRefs:
        - name: forust-homepage-service
          port: 80
 ---
 apiVersion: gateway.networking.k8s.io/v1
 kind: HTTPRoute
 metadata:
  name: xdfnx-homepage-https
  namespace: homepages
 spec:
  parentRefs:
    - name: homepages
      kind: Gateway
      sectionName: https
  hostnames:
    - xdfnx.cfd
  rules:
    - matches:
        - path:
            type: PathPrefix
            value: /
      backendRefs:
        - name: xdfnx-homepage-service
          port: 80
@@ -9,9 +9,6 @@ spec:
  routes:
    - match: Host(`forust.xyz`) || Host(`www.forust.xyz`)
      kind: Rule
      middlewares:
        - name: crowdsec-bouncer
          namespace: crowdsec
      priority: 10
      services:
        - name: forust-homepage-service
@@ -49,9 +46,6 @@ spec:
  routes:
    - match: Host(`xdfnx.cfd`)
      kind: Rule
      middlewares:
        - name: crowdsec-bouncer
          namespace: crowdsec
      services:
        - name: xdfnx-homepage-service
          port: 80
@@ -43,7 +43,7 @@ services:
  database:
    container_name: immich_postgres
-    image: ghcr.io/immich-app/postgres:14-vectorchord0.4.3-pgvectors0.2.0@sha256:bcf63357191b76a916ae5eb93464d65c07511da41e3bf7a8416db519b40b1c23
+    image: ghcr.io/immich-app/postgres:16-vectorchord0.4.3-pgvectors0.2.0@sha256:1a078b237c1d9b420b0ee59147386b4aa60d3a07a8e6a402fc84a57e41b043a4
    environment:
      POSTGRES_PASSWORD: ${DB_PASSWORD}
      POSTGRES_USER: ${DB_USERNAME}
@@ -14,6 +14,8 @@ spec:
 apiVersion: apps/v1
 kind: Deployment
 metadata:
  annotations:
    reloader.stakater.com/auto: "true"
  name: immich-deployment
  namespace: immich
  labels:
@@ -9,9 +9,6 @@ spec:
  routes:
    - match: Host(`immich.forust.xyz`)
      kind: Rule
      middlewares:
        - name: crowdsec-bouncer
          namespace: crowdsec
      services:
        - name: immich-service
          port: 2283
@@ -14,6 +14,8 @@ spec:
 apiVersion: apps/v1
 kind: Deployment
 metadata:
  annotations:
    reloader.stakater.com/auto: "true"
  name: immich-machine-learning-deployment
  namespace: immich
  labels:
@@ -23,6 +25,8 @@ spec:
  selector:
    matchLabels:
      app: immich-machine-learning
  strategy:
    type: Recreate
  template:
    metadata:
      labels:
@@ -50,7 +50,7 @@ spec:
          # that config_file, and it also loses the step where the entrypoint
          # drops from root to the postgres user: postmaster then starts as
          # root and refuses to run.
-          image: ghcr.io/immich-app/postgres:14-vectorchord0.4.3-pgvectors0.2.0@sha256:bcf63357191b76a916ae5eb93464d65c07511da41e3bf7a8416db519b40b1c23
+          image: ghcr.io/immich-app/postgres:16-vectorchord0.4.3-pgvectors0.2.0@sha256:1a078b237c1d9b420b0ee59147386b4aa60d3a07a8e6a402fc84a57e41b043a4
          env:
            - name: POSTGRES_USER
              value: immich
@@ -90,10 +90,16 @@ spec:
          # rotational disk on a loaded single node, and pg_isready can take
          # seconds during WAL recovery. A 1s timeout kills the container
          # mid-recovery and restarts the spiral.
          #
          # Budgets are sized for HDD stalls, not for a healthy disk: fsync of
          # a single file was observed taking 70s under node IO pressure, so
          # the startup budget is 15 minutes and liveness tolerates 5 minutes
          # of unresponsiveness. Killing a stalled-but-healthy postmaster only
          # buys another full WAL replay, which is more IO, not less.
          startupProbe:
            exec:
              command: ["sh", "-c", "pg_isready -U immich -d immich"]
-            failureThreshold: 60
+            failureThreshold: 180
            periodSeconds: 5
            timeoutSeconds: 5
          readinessProbe:
@@ -105,8 +111,9 @@ spec:
            exec:
              command: ["sh", "-c", "pg_isready -U immich -d immich"]
            initialDelaySeconds: 30
-            periodSeconds: 20
+            periodSeconds: 60
-            timeoutSeconds: 5
+            timeoutSeconds: 10
            failureThreshold: 5
          # The image template sets shared_buffers to 512MB, and the vchord and
          # vectors workers are Rust binaries with a real RSS footprint on top
          # of postmaster, checkpointer and friends. 1Gi was enough to start
@@ -17,6 +17,8 @@ spec:
 apiVersion: apps/v1
 kind: StatefulSet
 metadata:
  annotations:
    reloader.stakater.com/auto: "true"
  name: immich-valkey
  namespace: immich
  labels:
@@ -9,9 +9,6 @@ spec:
  routes:
    - match: Host(`status.forust.xyz`)
      kind: Rule
      middlewares:
        - name: crowdsec-bouncer
          namespace: crowdsec
      services:
        - name: kener-service
          port: 3000
@@ -13,6 +13,8 @@ spec:
 apiVersion: apps/v1
 kind: Deployment
 metadata:
  annotations:
    reloader.stakater.com/auto: "true"
  name: kener-deployment
  namespace: kener
 spec:
@@ -20,6 +22,8 @@ spec:
  selector:
    matchLabels:
      app: kener
  strategy:
    type: Recreate
  template:
    metadata:
      labels:
@@ -1,6 +1,6 @@
 services:
  metube:
-    image: ghcr.io/alexta69/metube:2026.09.27
+    image: ghcr.io/alexta69/metube:2026.09.29
    container_name: metube
    restart: unless-stopped
    # ports:
@@ -13,6 +13,8 @@ spec:
 apiVersion: apps/v1
 kind: Deployment
 metadata:
  annotations:
    reloader.stakater.com/auto: "true"
  name: metube-deployment
  namespace: metube
 spec:
@@ -20,6 +22,8 @@ spec:
  selector:
    matchLabels:
      app: metube
  strategy:
    type: Recreate
  template:
    metadata:
      labels:
@@ -27,7 +31,7 @@ spec:
    spec:
      containers:
        - name: metube
-          image: ghcr.io/alexta69/metube:2026.09.27
+          image: ghcr.io/alexta69/metube:2026.09.29
          envFrom:
            - configMapRef:
                name: metube-config
@@ -1,6 +1,6 @@
 services:
  n8n:
-    image: docker.n8n.io/n8nio/n8n:2.41.3
+    image: docker.n8n.io/n8nio/n8n:2.42.3
    container_name: n8n
    restart: unless-stopped
    environment:
@@ -9,9 +9,6 @@ spec:
  routes:
    - match: Host(`n8n.forust.xyz`)
      kind: Rule
      middlewares:
        - name: crowdsec-bouncer
          namespace: crowdsec
      services:
        - name: n8n-service
          port: 5678
@@ -13,6 +13,8 @@ spec:
 apiVersion: apps/v1
 kind: Deployment
 metadata:
  annotations:
    reloader.stakater.com/auto: "true"
  name: n8n-deployment
  namespace: n8n
 spec:
@@ -20,6 +22,8 @@ spec:
  selector:
    matchLabels:
      app: n8n
  strategy:
    type: Recreate
  template:
    metadata:
      labels:
@@ -27,7 +31,7 @@ spec:
    spec:
      containers:
        - name: n8n
-          image: docker.n8n.io/n8nio/n8n:2.41.3
+          image: docker.n8n.io/n8nio/n8n:2.42.3
          envFrom:
            - configMapRef:
                name: n8n-config
@@ -2,7 +2,7 @@ name: netbird
 services:
  netbird-server:
-    image: netbirdio/netbird-server:0.79.0
+    image: netbirdio/netbird-server:0.80.0
    container_name: netbird-server
    restart: unless-stopped
    environment:
@@ -87,7 +87,7 @@ services:
      - proxy
  dashboard:
-    image: netbirdio/dashboard:v2.93.0
+    image: netbirdio/dashboard:v2.94.0
    container_name: netbird-dashboard
    restart: unless-stopped
    environment:
@@ -32,9 +32,6 @@ spec:
    - match: Host(`nb.forust.xyz`)
      kind: Rule
      priority: 1
      middlewares:
        - name: crowdsec-bouncer
          namespace: crowdsec
      services:
        - name: netbird-dashboard-service
          port: 80
@@ -32,6 +32,8 @@ spec:
 apiVersion: apps/v1
 kind: Deployment
 metadata:
  annotations:
    reloader.stakater.com/auto: "true"
  name: netbird-server-deployment
  namespace: netbird
 spec:
@@ -39,6 +41,8 @@ spec:
  selector:
    matchLabels:
      app: netbird-server
  strategy:
    type: Recreate
  template:
    metadata:
      labels:
@@ -46,7 +50,7 @@ spec:
    spec:
      containers:
        - name: netbird-server
-          image: netbirdio/netbird-server:0.79.0
+          image: netbirdio/netbird-server:0.80.0
          command: ["/bin/sh", "/opt/netbird/entrypoint.sh", "--config", "/run/netbird/config.yaml"]
          envFrom:
            - configMapRef:
@@ -92,7 +96,7 @@ spec:
          resources:
            requests:
              memory: "128Mi"
-              cpu: "250m"
+              cpu: "100m"
            limits:
              memory: "384Mi"
              cpu: "1000m"
@@ -124,6 +128,8 @@ spec:
 apiVersion: apps/v1
 kind: Deployment
 metadata:
  annotations:
    reloader.stakater.com/auto: "true"
  name: netbird-dashboard-deployment
  namespace: netbird
 spec:
@@ -131,6 +137,8 @@ spec:
  selector:
    matchLabels:
      app: netbird-dashboard
  strategy:
    type: Recreate
  template:
    metadata:
      labels:
@@ -138,7 +146,7 @@ spec:
    spec:
      containers:
        - name: dashboard
-          image: netbirdio/dashboard:v2.93.0
+          image: netbirdio/dashboard:v2.94.0
          envFrom:
            - configMapRef:
                name: netbird-config
@@ -9,9 +9,6 @@ spec:
  routes:
    - match: Host(`netbox.forust.xyz`)
      kind: Rule
      middlewares:
        - name: crowdsec-bouncer
          namespace: crowdsec
      services:
        - name: netbox-service
          port: 8080
@@ -14,6 +14,8 @@ spec:
 apiVersion: apps/v1
 kind: Deployment
 metadata:
  annotations:
    reloader.stakater.com/auto: "true"
  name: netbox-deployment
  namespace: netbox
  labels:
@@ -97,7 +99,7 @@ spec:
          resources:
            requests:
              cpu: "100m"
-              memory: "1Gi"
+              memory: "512Mi"
            limits:
              cpu: "2"
              memory: "2Gi"
@@ -118,6 +120,8 @@ spec:
 apiVersion: apps/v1
 kind: Deployment
 metadata:
  annotations:
    reloader.stakater.com/auto: "true"
  name: netbox-worker-deployment
  namespace: netbox
  labels:
@@ -17,6 +17,8 @@ spec:
 apiVersion: apps/v1
 kind: StatefulSet
 metadata:
  annotations:
    reloader.stakater.com/auto: "true"
  name: netbox-valkey
  namespace: netbox
  labels:
@@ -1,6 +1,6 @@
 services:
  netronome:
-    image: ghcr.io/autobrr/netronome:v0.14.1
+    image: ghcr.io/autobrr/netronome:v0.15.0
    restart: unless-stopped
    container_name: netronome
    ports:
@@ -9,9 +9,6 @@ spec:
  routes:
    - match: Host(`nm.forust.xyz`)
      kind: Rule
      middlewares:
        - name: crowdsec-bouncer
          namespace: crowdsec
      services:
        - name: netronome-service
          port: 7575
@@ -14,6 +14,8 @@ spec:
 apiVersion: apps/v1
 kind: Deployment
 metadata:
  annotations:
    reloader.stakater.com/auto: "true"
  name: netronome-deployment
  namespace: netronome
  labels:
@@ -23,6 +25,8 @@ spec:
  selector:
    matchLabels:
      app: netronome
  strategy:
    type: Recreate
  template:
    metadata:
      labels:
@@ -30,7 +34,7 @@ spec:
    spec:
      containers:
        - name: netronome
-          image: ghcr.io/autobrr/netronome:v0.14.1
+          image: ghcr.io/autobrr/netronome:v0.15.0
          ports:
            - name: netronome-port
              protocol: TCP
@@ -12,8 +12,6 @@ spec:
      kind: Rule
      middlewares:
        - name: nextcloud-chain@file
        - name: crowdsec-bouncer
          namespace: crowdsec
      services:
        - name: nextcloud-apache
          port: 11000
@@ -32,8 +30,6 @@ spec:
    - match: Host(`nextcloud.workstation.internal`) || Host(`nextcloud.gigaforust.internal`)
      kind: Rule
      middlewares:
        - name: crowdsec-bouncer
          namespace: crowdsec
        - name: nextcloud-chain@file
      services:
        - name: nextcloud-apache
@@ -9,9 +9,6 @@ spec:
  routes:
    - match: Host(`portainer.forust.xyz`)
      kind: Rule
      middlewares:
        - name: crowdsec-bouncer
          namespace: crowdsec
      services:
        - name: portainer-service
          port: 9000
@@ -20,6 +20,8 @@ spec:
  selector:
    matchLabels:
      app: portainer
  strategy:
    type: Recreate
  template:
    metadata:
      labels:
@@ -1,6 +1,6 @@
 services:
  grafana:
-    image: grafana/grafana:13.2.2
+    image: grafana/grafana:13.2.3
    container_name: prometheus-grafana
    restart: unless-stopped
    env_file:
@@ -0,0 +1,41 @@
 apiVersion: monitoring.coreos.com/v1
 kind: PrometheusRule
 metadata:
  name: crowdsec
  namespace: prometheus
  labels:
    release: prometheus-stack
 spec:
  groups:
    - name: crowdsec
      rules:
        - alert: CrowdsecFirewallBouncerStale
          expr: |
            absent(cs_lapi_bouncer_requests_total{bouncer="firewall-workstation"})
            or sum(rate(cs_lapi_bouncer_requests_total{bouncer="firewall-workstation"}[10m])) == 0
          for: 15m
          labels:
            severity: critical
          annotations:
            summary: "Firewall bouncer stopped pulling decisions"
            description: "No LAPI pulls from firewall-workstation for 15 minutes. L3 enforcement is decaying: existing bans expire, new ones never land. Check the systemd unit on the node."
        - alert: CrowdsecDecisionsSpike
          expr: |
            sum(cs_active_decisions) - sum(cs_active_decisions offset 30m) > 20
          for: 5m
          labels:
            severity: warning
          annotations:
            summary: "Spike in active CrowdSec decisions"
            description: "Active decisions grew by more than 20 in 30 minutes (current: {{ $value }}). Possible ban storm or self-ban - check cscli decisions list."
        - alert: CrowdsecLAPIDecisionErrors
          expr: |
            sum(rate(cs_lapi_decisions_ko_total[5m])) > 0
          for: 10m
          labels:
            severity: warning
          annotations:
            summary: "CrowdSec LAPI decision errors"
            description: "LAPI is failing decision lookups. Bouncers may be failing open. Check LAPI logs and DB health."
@@ -9,9 +9,6 @@ spec:
  routes:
    - match: Host(`grafana.forust.xyz`)
      kind: Rule
      middlewares:
        - name: crowdsec-bouncer
          namespace: crowdsec
      services:
        - name: prometheus-stack-grafana
          port: 80
@@ -29,26 +29,34 @@ spec:
        - alert: TraefikServiceHigh5xxRate
          expr: |
-            sum(rate(traefik_service_requests_total{code=~"5.."}[5m])) by (service)
+            sum(rate(traefik_service_requests_total{code=~"5.."}[5m])) by (exported_service)
-              / sum(rate(traefik_service_requests_total[5m])) by (service) * 100 > 5
+              / sum(rate(traefik_service_requests_total[5m])) by (exported_service) * 100 > 5
-              and sum(rate(traefik_service_requests_total[5m])) by (service) > 0
+              and sum(rate(traefik_service_requests_total[5m])) by (exported_service) > 0
          for: 5m
          labels:
            severity: warning
          annotations:
-            summary: "High 5xx error rate for service {{ $labels.service }}"
+            summary: "High 5xx error rate for service {{ $labels.exported_service }}"
-            description: "Service {{ $labels.service }} is returning 5xx errors for more than 5% of requests over the last 5 minutes (current: {{ $value | humanizePercentage }})."
+            description: "Service {{ $labels.exported_service }} is returning 5xx errors for more than 5% of requests over the last 5 minutes (current: {{ $value | humanizePercentage }})."
        # NOTE on `exported_service`: traefik emits per-route series labelled
        # `service`, but the prometheus scrape already carries a target label
        # called `service` (the monitored Service object), and with the
        # default honorLabels=false the scraped value loses the collision and
        # is renamed to `exported_service`. Grouping by `service` therefore
        # measures one global aggregate mislabelled per backend, and any
        # exclusion written against it matches nothing. The generated names
        # below are namespace-routename-hash as traefik builds them.
        - alert: TraefikServiceHighLatency
          expr: |
            histogram_quantile(0.95,
-              sum(rate(traefik_service_request_duration_seconds_bucket{service!~"xui-xui-service-.*"}[5m])) by (le, service)) > 2
+              sum(rate(traefik_service_request_duration_seconds_bucket{exported_service!~"netbird-netbird-(prod|local)-.*|xui-xray-(prod|local)-.*"}[5m])) by (le, exported_service)) > 2
          for: 5m
          labels:
            severity: warning
          annotations:
-            summary: "High latency for service {{ $labels.service }}"
+            summary: "High latency for service {{ $labels.exported_service }}"
-            description: "P95 latency of {{ $labels.service }} exceeded 2 seconds over the last 5 minutes (current: {{ $value | humanizeDuration }})."
+            description: "P95 latency of {{ $labels.exported_service }} exceeded 2 seconds over the last 5 minutes (current: {{ $value | humanizeDuration }})."
        - alert: TraefikCertExpiringSoon
          expr: min(traefik_tls_certs_not_after) - time() < 14 * 24 * 60 * 60
@@ -1,4 +0,0 @@
 {
  "venvPath": "/home/forust/homelab/userbot",
  "venv": ".venv"
 }
@@ -1,11 +1,17 @@
 # Pinned chart: stakater/reloader 2.2.17 (app v1.4.22).
 # Deployed by the deploy workflow, namespace reloader.
 # Restarts pods when a ConfigMap or Secret they consume changes. Opt-in per workload
-# via the reloader.stakater.com/auto: "true" pod annotation; watchGlobally because
+# via the reloader.stakater.com/auto: "true" workload annotation; watchGlobally because
 # the workloads that need it are spread across a few dozen namespaces.
 reloader:
  watchGlobally: true
  # Only opted-in workloads are restarted. Keep scheduled jobs on their schedule.
  autoReloadAll: false
  ignoreJobs: true
  ignoreCronJobs: true
  # Change pod-template annotations rather than injecting STAKATER_* env vars.
  reloadStrategy: annotations
  deployment:
    replicas: 1
@@ -1,4 +1,4 @@
-RENOVATE_ENDPOINT=https://gitea.forust.xyz/api/v1
+RENOVATE_ENDPOINT=https://git.forust.xyz/api/v1
 RENOVATE_TOKEN=
 RENOVATE_REPOSITORIES=forust/homelab
 LOG_LEVEL=info
@@ -160,6 +160,18 @@ data:
        }
      ],
      "packageRules": [
        {
          "description": "Automerge digest and patch updates - safe by definition, review adds nothing, keeps the renovate queue and the deploy line short. Specific no-automerge rules below still override this for playwright, helm and majors.",
          "matchUpdateTypes": ["digest", "patch"],
          "automerge": true
        },
        {
          "description": "Group all minor updates into one reviewable PR - placed before the specific groups below so playwright/node/renovate keep their own lockstep groups (later groupName wins)",
          "matchUpdateTypes": ["minor"],
          "groupName": "all minor updates",
          "groupSlug": "all-minor",
          "automerge": false
        },
        {
          "description": "Keep private homelab images unchanged",
          "matchDatasources": ["docker"],
@@ -202,10 +214,38 @@ data:
          "automerge": false
        },
        {
-          "description": "Group container patch updates",
+          "description": "Group patch updates from all sources - automerge still applies via the digest/patch rule above (helm/playwright stay manual via their own rules)",
          "matchDatasources": ["docker"],
          "matchUpdateTypes": ["patch"],
-          "groupName": "container patch updates"
+          "groupName": "all patch updates",
          "groupSlug": "all-patch"
        },
        {
          "description": "Python Y-bumps break compat (3.11->3.12->3.13->3.14) - keep the base image out of the shared minor/patch groups, review every bump separately. Placed last so its groupName wins.",
          "matchDatasources": ["docker"],
          "matchPackageNames": ["python"],
          "groupName": "python base image",
          "groupSlug": "python",
          "automerge": false
        },
        {
          "description": "Rolling/floating tags (streaming stack, nextcloud beta, kubectl latest) - never automerge, every bump is a manual review. Placed last so automerge:false wins over the shared digest/patch rule.",
          "matchDatasources": ["docker"],
          "matchPackageNames": [
            "lscr.io/linuxserver/jellyfin",
            "lscr.io/linuxserver/qbittorrent",
            "lscr.io/linuxserver/sonarr",
            "lscr.io/linuxserver/radarr",
            "lscr.io/linuxserver/prowlarr",
            "lscr.io/linuxserver/bazarr",
            "ghcr.io/seerr-team/seerr",
            "fallenbagel/jellyseerr",
            "ghcr.io/lampac-nextgen/lampac",
            "ghcr.io/nextcloud-releases/all-in-one",
            "alpine/kubectl"
          ],
          "groupName": "floating images - manual",
          "groupSlug": "floating-manual",
          "automerge": false
        }
      ]
    }
@@ -19,7 +19,7 @@ spec:
          restartPolicy: Never
          containers:
            - name: renovate
-              image: renovate/renovate:44.115.13
+              image: renovate/renovate:44.136.0
              env:
                - name: RENOVATE_PLATFORM
                  value: gitea
@@ -6,6 +6,6 @@ metadata:
 type: Opaque
 stringData:
  RENOVATE_TOKEN: ""
-  RENOVATE_ENDPOINT: "https://gitea.forust.xyz/api/v1"
+  RENOVATE_ENDPOINT: "https://git.forust.xyz/api/v1"
  RENOVATE_REPOSITORIES: "forust/homelab"
  RENOVATE_GITHUB_COM_TOKEN: ""
@@ -149,6 +149,18 @@
    }
  ],
  "packageRules": [
    {
      "description": "Automerge digest and patch updates - safe by definition, review adds nothing, keeps the renovate queue and the deploy line short. Specific no-automerge rules below still override this for playwright, helm and majors.",
      "matchUpdateTypes": ["digest", "patch"],
      "automerge": true
    },
    {
      "description": "Group all minor updates into one reviewable PR - placed before the specific groups below so playwright/node/renovate keep their own lockstep groups (later groupName wins)",
      "matchUpdateTypes": ["minor"],
      "groupName": "all minor updates",
      "groupSlug": "all-minor",
      "automerge": false
    },
    {
      "description": "Keep private homelab images unchanged",
      "matchDatasources": ["docker"],
@@ -191,10 +203,38 @@
      "automerge": false
    },
    {
-      "description": "Group container patch updates",
+      "description": "Group patch updates from all sources - automerge still applies via the digest/patch rule above (helm/playwright stay manual via their own rules)",
      "matchDatasources": ["docker"],
      "matchUpdateTypes": ["patch"],
-      "groupName": "container patch updates"
+      "groupName": "all patch updates",
      "groupSlug": "all-patch"
    },
    {
      "description": "Python Y-bumps break compat (3.11->3.12->3.13->3.14) - keep the base image out of the shared minor/patch groups, review every bump separately. Placed last so its groupName wins.",
      "matchDatasources": ["docker"],
      "matchPackageNames": ["python"],
      "groupName": "python base image",
      "groupSlug": "python",
      "automerge": false
    },
    {
      "description": "Rolling/floating tags (streaming stack, nextcloud beta, kubectl latest) - never automerge, every bump is a manual review. Placed last so automerge:false wins over the shared digest/patch rule.",
      "matchDatasources": ["docker"],
      "matchPackageNames": [
        "lscr.io/linuxserver/jellyfin",
        "lscr.io/linuxserver/qbittorrent",
        "lscr.io/linuxserver/sonarr",
        "lscr.io/linuxserver/radarr",
        "lscr.io/linuxserver/prowlarr",
        "lscr.io/linuxserver/bazarr",
        "ghcr.io/seerr-team/seerr",
        "fallenbagel/jellyseerr",
        "ghcr.io/lampac-nextgen/lampac",
        "ghcr.io/nextcloud-releases/all-in-one",
        "alpine/kubectl"
      ],
      "groupName": "floating images - manual",
      "groupSlug": "floating-manual",
      "automerge": false
    }
  ]
 }
@@ -9,9 +9,6 @@ spec:
  routes:
    - match: Host(`s.forust.xyz`) || Host(`search.forust.xyz`)
      kind: Rule
      middlewares:
        - name: crowdsec-bouncer
          namespace: crowdsec
      services:
        - name: searxng-service
          port: 8080
@@ -13,6 +13,8 @@ spec:
 apiVersion: apps/v1
 kind: Deployment
 metadata:
  annotations:
    reloader.stakater.com/auto: "true"
  name: searxng-deployment
  namespace: searxng
 spec:
@@ -20,6 +22,8 @@ spec:
  selector:
    matchLabels:
      app: searxng
  strategy:
    type: Recreate
  template:
    metadata:
      labels:
@@ -0,0 +1,3 @@
 PUID=1000
 PGID=1000
 TZ=Europe/Berlin
@@ -0,0 +1,133 @@
 services:
  jellyfin:
    image: lscr.io/linuxserver/jellyfin:version-12.1ubu2604
    container_name: jellyfin
    restart: unless-stopped
    environment:
      - PUID=${PUID:-1000}
      - PGID=${PGID:-1000}
      - TZ=${TZ:-Europe/Berlin}
    volumes:
      - jellyfin-cfg:/config
      - movies:/media/movies
      - tv:/media/tv
    devices:
      - /dev/dri:/dev/dri
    ports:
      - "18096:8096"
    networks:
      - streaming
  qbittorrent:
    image: lscr.io/linuxserver/qbittorrent:5.2.4
    container_name: qbittorrent
    restart: unless-stopped
    environment:
      - PUID=${PUID:-1000}
      - PGID=${PGID:-1000}
      - TZ=${TZ:-Europe/Berlin}
      - WEBUI_PORT=8080
    volumes:
      - qbittorrent-cfg:/config
      - downloads:/downloads
    ports:
      - "18180:8080"
      - "6881:6881"
      - "6881:6881/udp"
    networks:
      - streaming
  sonarr:
    image: lscr.io/linuxserver/sonarr:4.0.20
    container_name: sonarr
    restart: unless-stopped
    environment:
      - PUID=${PUID:-1000}
      - PGID=${PGID:-1000}
      - TZ=${TZ:-Europe/Berlin}
    volumes:
      - sonarr-cfg:/config
      - downloads:/downloads
      - tv:/tv
    ports:
      - "18989:8989"
    networks:
      - streaming
  radarr:
    image: lscr.io/linuxserver/radarr:6.4.4
    container_name: radarr
    restart: unless-stopped
    environment:
      - PUID=${PUID:-1000}
      - PGID=${PGID:-1000}
      - TZ=${TZ:-Europe/Berlin}
    volumes:
      - radarr-cfg:/config
      - downloads:/downloads
      - movies:/movies
    ports:
      - "17878:7878"
    networks:
      - streaming
  prowlarr:
    image: lscr.io/linuxserver/prowlarr:2.6.5
    container_name: prowlarr
    restart: unless-stopped
    environment:
      - PUID=${PUID:-1000}
      - PGID=${PGID:-1000}
      - TZ=${TZ:-Europe/Berlin}
    volumes:
      - prowlarr-cfg:/config
    ports:
      - "19696:9696"
    networks:
      - streaming
  jellyseerr:
    image: fallenbagel/jellyseerr:latest
    container_name: jellyseerr
    restart: unless-stopped
    environment:
      - TZ=${TZ:-Europe/Berlin}
    volumes:
      - jellyseerr-cfg:/app/config
    ports:
      - "15055:5055"
    networks:
      - streaming
  bazarr:
    image: lscr.io/linuxserver/bazarr:1.6.2
    container_name: bazarr
    restart: unless-stopped
    environment:
      - PUID=${PUID:-1000}
      - PGID=${PGID:-1000}
      - TZ=${TZ:-Europe/Berlin}
    volumes:
      - bazarr-cfg:/config
      - movies:/movies
      - tv:/tv
    ports:
      - "16767:6767"
    networks:
      - streaming
 volumes:
  jellyfin-cfg:
  qbittorrent-cfg:
  sonarr-cfg:
  radarr-cfg:
  prowlarr-cfg:
  jellyseerr-cfg:
  bazarr-cfg:
  downloads:
  movies:
  tv:
 networks:
  streaming:
    name: streaming