chore(deps): update ghcr.io/c4illin/convertx docker tag to v0.19.0

checker.py initialises last_success to 0, so right after a pod restart
`time() - last_success` equals the current epoch. The rule compared that
against 300, went firing instantly, and humanizeDuration rendered the raw
epoch delta as ~20722d. The last_run > 0 guard did not help because a run
happens long before the first success.

Guard the duration rule on last_success > 0, keeping the duration
expression on the left of `and` so $value stays the real gap, and add a
separate WebinarCheckerNeverSucceeded rule for the zeroed-gauge case so a
checker that has never succeeded is still caught.

.gitea/workflows/deploy-lib.sh

@@ -89,10 +89,27 @@ stage_validate() {
   cd "$REPO"
   select_manifests
   local m k cf
+  # Compose .env files and secret files are gitignored by design, so the
+  # workstation never has real values for them. Validate structure only:
+  # skip interpolation, env-file resolution, and path resolution so that
+  # required-variable guards (:?) and missing local files don't fail CI.
+  # Normalization and consistency checks stay enabled.
+  local compose_validate_flags=()
+  local compose_config_help
+  compose_config_help="$(docker compose config --help 2>/dev/null || true)"
+  if printf '%s' "$compose_config_help" | grep -q -- '--no-interpolate'; then
+    compose_validate_flags+=(--no-interpolate)
+  fi
+  if printf '%s' "$compose_config_help" | grep -q -- '--no-env-resolution'; then
+    compose_validate_flags+=(--no-env-resolution)
+  fi
+  if printf '%s' "$compose_config_help" | grep -q -- '--no-path-resolution'; then
+    compose_validate_flags+=(--no-path-resolution)
+  fi
   log "Validate compose stacks"
   for cf in ${COMPOSE_STACKS[@]+"${COMPOSE_STACKS[@]}"}; do
     echo "  config: $cf"
-    docker compose -f "$cf" config --quiet
+    docker compose -f "$cf" config --quiet "${compose_validate_flags[@]}"
   done
   log "Validate k8s manifests (kubectl dry-run=client)"
   for m in ${K8S_MANIFESTS[@]+"${K8S_MANIFESTS[@]}"}; do

.gitea/workflows/deploy.yaml

@@ -8,7 +8,7 @@ on:
 
 concurrency:
   group: deploy-main
-  cancel-in-progress: false
+  cancel-in-progress: true
 
 env:
   DEPLOY_HOST: ${{ secrets.DEPLOY_HOST }}

cloudflared/k8s/deployment.yaml

@@ -16,7 +16,7 @@ spec:
     spec:
       containers:
         - name: cloudflared
-          image: cloudflare/cloudflared:2026.9.1
+          image: cloudflare/cloudflared:2026.9.3
           imagePullPolicy: IfNotPresent
           args:
             - tunnel

converters/compose.yaml

@@ -1,7 +1,7 @@
 services:
   convertx:
     container_name: convertx
-    image: ghcr.io/c4illin/convertx:v0.18.0
+    image: ghcr.io/c4illin/convertx:v0.19.0
     restart: unless-stopped
     ports:
       - "9992:3000"

converters/k8s/convertx.yaml

@@ -26,7 +26,7 @@ spec:
         app: convertx
     spec:
       containers:
-        - image: ghcr.io/c4illin/convertx:v0.18.0
+        - image: ghcr.io/c4illin/convertx:v0.19.0
           name: convertx
           envFrom:
             - configMapRef:

edu_master/compose.yaml

@@ -1,6 +1,6 @@
 services:
   redis:
-    image: redis:8.10.1-alpine
+    image: redis:8.10.2-alpine
     restart: unless-stopped
     volumes:
       - redis-data:/data

edu_master/k8s/alerts.yaml

@@ -11,9 +11,14 @@ spec:
       rules:
         # No successful webinar check for 5m (~2-3 missed 2-min checks).
         # Catches: playwright hangs/timeouts, version skew, site changes, hung job.
+        # The last_success > 0 guard is mandatory: checker.py initialises
+        # last_success to 0, so without it `time() - 0` equals the current epoch
+        # and humanizeDuration renders ~20722d on every pod restart. Keep the
+        # duration expression on the left so $value stays the real gap.
         - alert: WebinarCheckerNoSuccessfulCheck
           expr: |
-            (time() - webinar_check_last_success_timestamp_seconds > 300)
+            ((time() - webinar_check_last_success_timestamp_seconds) > 300)
+              and (webinar_check_last_success_timestamp_seconds > 0)
               and (webinar_check_last_run_timestamp_seconds > 0)
           for: 2m
           labels:
@@ -22,6 +27,20 @@ spec:
             summary: "Webinar checker has no successful check for 5m"
             description: "edu-master/webinar-checker: last successful webinar check was {{ $value | humanizeDuration }} ago. Checks are failing or hanging (see consecutive failures alert). Notifications about new webinars are NOT being sent."
 
+        # Checks are running but none has ever succeeded since pod start.
+        # Split out from the rule above so a zeroed gauge never feeds
+        # humanizeDuration.
+        - alert: WebinarCheckerNeverSucceeded
+          expr: |
+            (webinar_check_last_success_timestamp_seconds == 0)
+              and (webinar_check_last_run_timestamp_seconds > 0)
+          for: 10m
+          labels:
+            severity: critical
+          annotations:
+            summary: "Webinar checker has never completed a successful check"
+            description: 'edu-master/webinar-checker: checks have been running for 10m but not one has ever succeeded since the pod started, so every check is failing. Check pod logs (Loki: {namespace="edu-master", container="webinar-checker"}).'
+
         # Fast path: 3 consecutive failures (~6+ min at 2-min interval).
         - alert: WebinarCheckerConsecutiveFailures
           expr: |

edu_master/k8s/redis.yaml

@@ -18,7 +18,7 @@ spec:
     spec:
       containers:
         - name: redis
-          image: redis:8.10.1-alpine
+          image: redis:8.10.2-alpine
           imagePullPolicy: IfNotPresent
           ports:
             - containerPort: 6379

edu_master/k8s/session-keeper.yaml

@@ -17,7 +17,7 @@ spec:
     spec:
       initContainers:
         - name: wait-redis
-          image: redis:8.10.1-alpine
+          image: redis:8.10.2-alpine
           command:
             - /bin/sh
             - -ec

edu_master/k8s/webinar-checker.yaml

@@ -19,7 +19,7 @@ spec:
       # redis healthy -> session-keeper healthy (EXISTS EDU_PHPSESSID) -> playwright started
       initContainers:
         - name: wait-deps
-          image: redis:8.10.1-alpine
+          image: redis:8.10.2-alpine
           command:
             - /bin/sh
             - -ec

headscale/compose.yaml

@@ -1,6 +1,6 @@
 services:
   headscale:
-    image: headscale/headscale:0.29.3
+    image: headscale/headscale:v0.29.4
     restart: unless-stopped
     container_name: headscale-server
     command: serve

kener/compose.yaml

@@ -36,7 +36,7 @@ services:
       - proxy
       - kener
   redis:
-    image: redis:8.10.1-alpine
+    image: redis:8.10.2-alpine
     container_name: kener-redis
     restart: unless-stopped
     volumes:

kener/k8s/redis.yaml

@@ -30,7 +30,7 @@ spec:
     spec:
       containers:
         - name: redis
-          image: redis:8.10.1-alpine
+          image: redis:8.10.2-alpine
           ports:
             - containerPort: 6379
           volumeMounts:

metube/compose.yaml

@@ -1,6 +1,6 @@
 services:
   metube:
-    image: ghcr.io/alexta69/metube:2026.09.15
+    image: ghcr.io/alexta69/metube:2026.09.25
     container_name: metube
     restart: unless-stopped
     # ports:

metube/k8s/metube.yaml

@@ -27,7 +27,7 @@ spec:
     spec:
       containers:
         - name: metube
-          image: ghcr.io/alexta69/metube:2026.09.15
+          image: ghcr.io/alexta69/metube:2026.09.25
           envFrom:
             - configMapRef:
                 name: metube-config

n8n/compose.yaml

@@ -1,6 +1,6 @@
 services:
   n8n:
-    image: docker.n8n.io/n8nio/n8n:2.41.0
+    image: docker.n8n.io/n8nio/n8n:2.41.3
     container_name: n8n
     restart: unless-stopped
     environment:

n8n/k8s/n8n.yaml

@@ -27,7 +27,7 @@ spec:
     spec:
       containers:
         - name: n8n
-          image: docker.n8n.io/n8nio/n8n:2.41.0
+          image: docker.n8n.io/n8nio/n8n:2.41.3
           envFrom:
             - configMapRef:
                 name: n8n-config

netbird/compose.yaml

@@ -87,7 +87,7 @@ services:
       - proxy
 
   dashboard:
-    image: netbirdio/dashboard:v2.90.10
+    image: netbirdio/dashboard:v2.93.0
     container_name: netbird-dashboard
     restart: unless-stopped
     environment:

netbird/k8s/netbird.yaml

@@ -137,7 +137,7 @@ spec:
     spec:
       containers:
         - name: dashboard
-          image: netbirdio/dashboard:v2.90.10
+          image: netbirdio/dashboard:v2.93.0
           envFrom:
             - configMapRef:
                 name: netbird-config

netronome/compose.yaml

@@ -1,6 +1,6 @@
 services:
   netronome:
-    image: ghcr.io/autobrr/netronome:v0.14.0
+    image: ghcr.io/autobrr/netronome:v0.14.1
     restart: unless-stopped
     container_name: netronome
     ports:

netronome/k8s/netronome.yaml

@@ -30,7 +30,7 @@ spec:
     spec:
       containers:
         - name: netronome
-          image: ghcr.io/autobrr/netronome:v0.14.0
+          image: ghcr.io/autobrr/netronome:v0.14.1
           ports:
             - name: netronome-port
               protocol: TCP

prometheus-stack/compose.yaml

@@ -30,7 +30,7 @@ services:
       - proxy
 
   prometheus:
-    image: prom/prometheus:v3.14.0
+    image: prom/prometheus:v3.15.0
     container_name: prometheus-prometheus
     restart: unless-stopped
     command:

prometheus-stack/k8s/grafana-values.yaml

@@ -69,3 +69,18 @@ alertmanager:
 defaultRules:
   disabled:
     CPUThrottlingHigh: true
+    KubeControllerManagerDown: true
+    KubeSchedulerDown: true
+    KubeEtcdDown: true
+    KubeEtcdHighCommitDurations: true
+
+# k0s runs controller-manager/scheduler/etcd internally, not as pods with
+# component=kube-controller-manager/kube-scheduler/k8s-app=kube-etcd labels.
+# Their Services get no endpoints, so the targets are permanently down.
+# kube-proxy and kubelet have endpoints on k0s, keep them enabled.
+kubeControllerManager:
+  enabled: false
+kubeScheduler:
+  enabled: false
+kubeEtcd:
+  enabled: false

renovate/k8s/cronjob.yaml

@@ -16,7 +16,7 @@ spec:
           restartPolicy: Never
           containers:
             - name: renovate
-              image: renovate/renovate:44.106.0
+              image: renovate/renovate:44.115.9
               env:
                 - name: RENOVATE_PLATFORM
                   value: gitea

searxng/compose.yaml

@@ -3,7 +3,7 @@
 services:
   core:
     container_name: searxng-core
-    image: docker.io/searxng/searxng:${SEARXNG_VERSION:-2026.09.13-d4ce87c23}
+    image: docker.io/searxng/searxng:${SEARXNG_VERSION:-2026.9.25-12f8b6515}
     restart: unless-stopped
     # ports:
     # - ${SEARXNG_PORT:-8080}

searxng/k8s/searxng.yaml

@@ -27,7 +27,7 @@ spec:
     spec:
       containers:
         - name: searxng
-          image: docker.io/searxng/searxng:2026.09.13-d4ce87c23
+          image: docker.io/searxng/searxng:2026.9.25-12f8b6515
           envFrom:
             - configMapRef:
                 name: searxng-config