chore(deps): update all minor updates

.gitea/tests/deploy-validation.sh

@@ -1,80 +0,0 @@
-#!/usr/bin/env bash
-# Local regressions only: kubectl is mocked and Docker is used for config parsing.
-set -euo pipefail
-repo="$(cd "$(dirname "${BASH_SOURCE[0]}")/../.." && pwd)"
-scratch="$(mktemp -d)"
-trap 'rm -rf "$scratch"' EXIT
-
-mkdir -p "$scratch/repo/app" "$scratch/repo/postgres" "$scratch/repo/netbird" "$scratch/repo/renovate"
-git -C "$scratch/repo" init -q
-for file in app/compose.yaml postgres/shared-compose.yaml netbird/client.compose.yaml renovate/renovate-compose.yaml; do
-  touch "$scratch/repo/$file"
-done
-git -C "$scratch/repo" add .
-# shellcheck source=../workflows/compose-lint.sh
-source "$repo/.gitea/workflows/compose-lint.sh"
-actual="$(cd "$scratch/repo" && compose_files)"
-expected=$'app/compose.yaml\nnetbird/client.compose.yaml\npostgres/shared-compose.yaml\nrenovate/renovate-compose.yaml'
-[ "$actual" = "$expected" ] || { echo 'Compose discovery missed a file' >&2; exit 1; }
-
-cat >"$scratch/compose.yaml" <<'YAML'
-services:
-  example:
-    image: busybox:1.37.0
-    environment:
-      REQUIRED: ${HOMELAB_TEST_REQUIRED:?required for this regression}
-YAML
-unset HOMELAB_TEST_REQUIRED
-if validate_compose_file "$scratch/compose.yaml" >"$scratch/config.log" 2>&1; then
-  echo 'Full Compose validation accepted a missing variable' >&2
-  exit 1
-fi
-grep -q 'required for this regression' "$scratch/config.log"
-HOMELAB_TEST_REQUIRED=present validate_compose_file "$scratch/compose.yaml"
-
-cat >"$scratch/resources.json" <<'JSON'
-{"kind":"List","items":[
-  {"kind":"Deployment","metadata":{"namespace":"app"},"spec":{"template":{"spec":{
-    "containers":[{"envFrom":[{"secretRef":{"name":"credentials"}},{"secretRef":{"name":"optional","optional":true}}],"env":[{"valueFrom":{"secretKeyRef":{"name":"credentials","key":"password"}}}]}],
-    "initContainers":[{"envFrom":[{"secretRef":{"name":"init"}}]}],
-    "imagePullSecrets":[{"name":"registry"}],
-    "volumes":[{"secret":{"secretName":"mounted"}},{"projected":{"sources":[{"secret":{"name":"projected"}},{"secret":{"name":"optional-projected","optional":true}}]}}]
-  }}}},
-  {"kind":"CronJob","metadata":{},"spec":{"jobTemplate":{"spec":{"template":{"spec":{"containers":[{"envFrom":[{"secretRef":{"name":"cron"}}]}]}}}}}},
-  {"kind":"IngressRoute","metadata":{"namespace":"app"},"spec":{"tls":{"secretName":"controller-issued-tls"}}}
-]}
-JSON
-actual="$(jq -r -f "$repo/.gitea/workflows/secret-references.jq" "$scratch/resources.json" | sort)"
-expected=$'app credentials\napp init\napp mounted\napp projected\napp registry\ndefault cron'
-[ "$actual" = "$expected" ] || { echo "Unexpected Secret references: $actual" >&2; exit 1; }
-
-REPO="$repo"
-# shellcheck source=../workflows/deploy-lib.sh
-source "$repo/.gitea/workflows/deploy-lib.sh"
-K8S_MANIFESTS=("$scratch/resources.json")
-KUSTOMIZE_APPS=()
-# No live cluster access. Reject credentials in app even if they exist elsewhere.
-kubectl() {
-  case "$1" in
-    create) cat "$scratch/resources.json" ;;
-    get)
-      if [ "$3" = credentials ] && [ "$5" = app ]; then
-        return 1
-      fi
-      return 0
-      ;;
-    *) echo "Unexpected kubectl invocation: $*" >&2; return 1 ;;
-  esac
-}
-if check_referenced_secrets >"$scratch/secrets.log"; then
-  echo 'Namespace-scoped Secret check accepted a missing Secret' >&2
-  exit 1
-fi
-grep -q 'MISSING OR UNREADABLE: app/credentials' "$scratch/secrets.log"
-# API/rendering errors must not produce an empty reference list and pass.
-kubectl() { return 1; }
-if check_referenced_secrets >"$scratch/secrets.log"; then
-  echo 'Secret check accepted a failed manifest render' >&2
-  exit 1
-fi
-printf '%s\n' 'Deploy validation regressions passed.'

.gitea/workflows/ci.yaml

@@ -88,7 +88,7 @@ jobs:
         shell: bash
         run: |
           set -euo pipefail
-          tools_dir="$(bash .gitea/workflows/install-ci-tools.sh shellcheck jq)"
+          tools_dir="$(bash .gitea/workflows/install-ci-tools.sh shellcheck)"
           export PATH="$tools_dir:$PATH"
           mapfile -t scripts < <(
             git ls-files '*.sh' ':(glob)**/*.bash'
@@ -98,7 +98,6 @@ jobs:
             exit 0
           fi
           shellcheck --external-sources --source-path=SCRIPTDIR --severity=style "${scripts[@]}"
-          bash .gitea/tests/deploy-validation.sh
 
   lint-prettier:
     runs-on: [self-hosted, linux, arch, homelab]

.gitea/workflows/compose-lint.sh

@@ -21,7 +21,8 @@
 # All committed Compose files, including the ones deploy never starts.
 compose_files() {
   git ls-files \
-    '*compose.yaml' '*compose.yml'
+    '*/compose.yaml' '*/compose.yml' 'compose.yaml' 'compose.yml' \
+    '*/docker-compose.yaml' '*/docker-compose.yml'
 }
 
 # Prints the flags that turn `docker compose config` into the general check.

.gitea/workflows/deploy-lib.sh

@@ -686,52 +686,27 @@ stage_preflight() {
   git -C "$REPO" reset --hard "$target"
 }
 
-# Required pod Secrets, scoped to the resource namespace. TLS route Secrets are
-# created by cert-manager and are not prerequisites for applying a Certificate.
-check_referenced_secrets() {
-  local m k objects refs extracted ns name
-  local missing=()
-  refs=""
-  for m in ${K8S_MANIFESTS[@]+"${K8S_MANIFESTS[@]}"}; do
-    objects="$(kubectl create --dry-run=client --validate=false -f "$m" -o json)" || return 1
-    extracted="$(printf '%s' "$objects" | jq -r -f "$REPO/.gitea/workflows/secret-references.jq")" || return 1
-    refs+="$extracted"$'\n'
-  done
-  for k in ${KUSTOMIZE_APPS[@]+"${KUSTOMIZE_APPS[@]}"}; do
-    objects="$(kubectl kustomize "$k" | kubectl create --dry-run=client --validate=false -f - -o json)" || return 1
-    extracted="$(printf '%s' "$objects" | jq -r -f "$REPO/.gitea/workflows/secret-references.jq")" || return 1
-    refs+="$extracted"$'\n'
-  done
-  while read -r ns name; do
-    [ -n "${name:-}" ] || continue
-    if kubectl get secret "$name" -n "$ns" -o name >/dev/null 2>&1; then
-      echo "  ok: $ns/$name"
-    else
-      echo "  MISSING OR UNREADABLE: $ns/$name"
-      missing+=("$ns/$name")
-    fi
-  done < <(printf '%s' "$refs" | sort -u)
-  if [ "${#missing[@]}" -gt 0 ]; then
-    echo "ERROR: required pod Secrets are missing or unreadable:"
-    printf '  - %s\n' "${missing[@]}"
-    echo "Create them in the listed namespaces from the service's secret example."
-    return 1
-  fi
-}
-
 stage_validate() {
   cd "$REPO"
   select_manifests
   local m k cf
-  # The deploy host has the local .env and secret files. Resolve them here so
-  # missing configuration fails before either apply job changes workloads.
-  # CI keeps the structure-only check for inactive stacks.
+  # Compose .env files and secret files are gitignored by design, so the
+  # workstation never has real values for the inactive stacks. This stage only
+  # runs the full check on active stacks; the general structure check for every
+  # committed Compose file (active or not) lives in the ci workflow, which has no
+  # .env at all.
+  #
+  # Active stacks are still validated with interpolation and env-file resolution
+  # off, so required-variable guards (:?) and missing local files do not fail the
+  # deploy. Normalization and consistency checks stay enabled.
   # shellcheck source=compose-lint.sh
   source "$REPO/.gitea/workflows/compose-lint.sh"
+  local compose_validate_flags=()
+  mapfile -t compose_validate_flags < <(compose_safe_flags)
   log "Validate compose stacks"
   for cf in ${COMPOSE_STACKS[@]+"${COMPOSE_STACKS[@]}"}; do
     echo "  config: $cf"
-    validate_compose_file "$cf"
+    validate_compose_file "$cf" ${compose_validate_flags[@]+"${compose_validate_flags[@]}"}
   done
   log "Validate k8s manifests (kubectl dry-run=client)"
   for m in ${K8S_MANIFESTS[@]+"${K8S_MANIFESTS[@]}"}; do
@@ -749,7 +724,33 @@ stage_validate() {
   done
   log "Checking referenced Secrets exist"
   echo "  (deploy never applies *secret*.yaml; create missing ones manually)"
-  check_referenced_secrets
+  local ref_secrets=() missing_secrets=() all_secrets s
+  if [ "${#K8S_MANIFESTS[@]}" -gt 0 ]; then
+    while IFS= read -r s; do
+      [ -n "$s" ] && ref_secrets+=("$s")
+    done < <(
+      {
+        grep -h -A1 -E 'secretRef:|secretKeyRef:' "${K8S_MANIFESTS[@]}" 2>/dev/null || true
+        grep -h -E 'secretName:' "${K8S_MANIFESTS[@]}" 2>/dev/null || true
+      } | grep -E 'name:' | sed -E 's/.*name:[[:space:]]*//' | tr -d '"'"'"' "'"'" | sed -E 's/[[:space:]]*#.*//' | awk 'NF' | sort -u || true
+    )
+  fi
+  all_secrets="$(kubectl get secrets -A --no-headers -o custom-columns=:metadata.name 2>/dev/null || true)"
+  for s in ${ref_secrets[@]+"${ref_secrets[@]}"}; do
+    if printf '%s\n' "$all_secrets" | grep -qx "$s"; then
+      echo "  ok: $s"
+    else
+      echo "  MISSING: $s"
+      missing_secrets+=("$s")
+    fi
+  done
+  if [ "${#missing_secrets[@]}" -gt 0 ]; then
+    echo "ERROR: ${#missing_secrets[@]} referenced Secret(s) not found in the cluster:"
+    printf '  - %s\n' "${missing_secrets[@]}"
+    echo "Create them manually from the laptop, e.g.:"
+    echo "  kubectl apply -f SERVICE/k8s/secrets.yaml  # see SERVICE/k8s/secrets.yaml.example"
+    exit 1
+  fi
 }
 
 stage_apply_k8s() {

.gitea/workflows/install-ci-tools.sh

@@ -120,15 +120,6 @@ install_shellcheck() {
   rm -rf "$tmp"
 }
 
-install_jq() {
-  if at_version jq "${JQ_VERSION}"; then
-    return 0
-  fi
-  fetch "https://github.com/jqlang/jq/releases/download/jq-${JQ_VERSION}/jq-linux-${goarch}" \
-    "$BIN_DIR/jq"
-  chmod 0755 "$BIN_DIR/jq"
-}
-
 install_uv() {
   if at_version uv "${UV_VERSION}"; then
     return 0
@@ -245,7 +236,6 @@ for tool in "${wanted[@]}"; do
   case "$tool" in
     kubeconform) install_kubeconform ;;
     shellcheck) install_shellcheck ;;
-    jq) install_jq ;;
     actionlint) install_actionlint ;;
     prettier) install_prettier ;;
     ruff) install_ruff ;;

.gitea/workflows/secret-references.jq

@@ -1,13 +0,0 @@
-# kubectl emits a List for files containing multiple resources.
-(if .kind == "List" then .items[] else . end)
-| (.metadata.namespace // "default") as $ns
-| [
-    (.. | objects
-      | (.secretRef? // empty), (.secretKeyRef? // empty), (.secret? // empty)
-      | select(.optional != true)
-      | .name // .secretName // empty),
-    (.. | objects | .imagePullSecrets[]?.name)
-  ]
-| unique[]
-| select(. != null and . != "")
-| "\($ns) \(.)"

.gitea/workflows/tool-versions.env

@@ -31,6 +31,3 @@ UV_VERSION="0.12.17"
 # so the tree that gets tested is the tree that gets built. Renovate keeps this
 # in step with the Dockerfile's node: tag via the "node runtime" group.
 NODE_VERSION="22.23.3"
-
-# Secret-reference regression tests parse rendered Kubernetes objects.
-JQ_VERSION="1.8.1"

cloudflared/k8s/deployment.yaml

@@ -18,7 +18,7 @@ spec:
     spec:
       containers:
         - name: cloudflared
-          image: cloudflare/cloudflared:2026.9.3
+          image: cloudflare/cloudflared:2026.10.0
           imagePullPolicy: IfNotPresent
           args:
             - tunnel

edu_master/phpsessid-bot/Dockerfile

@@ -1,4 +1,4 @@
-FROM python:3.11-slim
+FROM python:3.14-slim
 
 WORKDIR /app
 

edu_master/webinar-checker/Dockerfile

@@ -1,4 +1,4 @@
-FROM python:3.11-slim
+FROM python:3.14-slim
 
 WORKDIR /app
 

homarr/.env.example

@@ -1,4 +0,0 @@
-SECRET_ENCRYPTION_KEY="REPLACE_ME"
-TZ="Europe/Bratislava"
-PUID="1000"
-PGID="1000"

homarr/compose.yaml

@@ -1,38 +0,0 @@
-services:
-  homarr:
-    container_name: homarr
-    image: ghcr.io/homarr-labs/homarr:v2.1.2
-    restart: unless-stopped
-    volumes:
-      - ./appdata:/appdata
-      - /var/run/docker.sock:/var/run/docker.sock:ro
-      - ./kubeconfig:/app/config/kubeconfig:ro
-    env_file: .env
-    ports:
-      - 80:7575
-      - 81:3000
-    environment:
-      - TZ=${TZ:-Europe/Bratislava}
-      - TURBO_TELEMETRY_DISABLED=1
-      - KUBECONFIG=/app/config/kubeconfig
-    labels:
-      - "traefik.enable=true"
-      - "traefik.http.services.homarr.loadbalancer.server.port=7575"
-
-      # Prod Router
-      - "traefik.http.routers.homarr.rule=Host(`homarr.forust.xyz`)"
-      - "traefik.http.routers.homarr.entrypoints=websecure"
-      - "traefik.http.routers.homarr.tls.certresolver=letsencrypt"
-      # Local Router
-      - "traefik.http.routers.homarr-local.rule=Host(`homarr.workstation.internal`)"
-      - "traefik.http.routers.homarr-local.entrypoints=websecure"
-      - "traefik.http.routers.homarr-local.tls=true"
-      # Dev Router
-      - "traefik.http.routers.homarr-dev.rule=Host(`homarr.gigaforust.internal`)"
-      - "traefik.http.routers.homarr-dev.entrypoints=websecure"
-      - "traefik.http.routers.homarr-dev.tls=true"
-    networks:
-      - proxy
-networks:
-  proxy:
-    external: true

homarr/k8s/certificates.yaml

@@ -1,28 +0,0 @@
-# apiVersion: cert-manager.io/v1
-# kind: Certificate
-# metadata:
-#   name: home-prod-tls
-#   namespace: homarr
-# spec:
-#   secretName: home-prod-tls
-#   dnsNames:
-#     - home.forust.xyz
-#   issuerRef:
-#     name: letsencrypt-prod
-#     kind: ClusterIssuer
-# ---
-apiVersion: cert-manager.io/v1
-kind: Certificate
-metadata:
-  name: internal-wildcard-tls
-  namespace: homarr
-spec:
-  secretName: internal-wildcard-tls
-  dnsNames:
-    - "*.workstation.internal"
-    - "*.gigaforust.internal"
-    - workstation.internal
-    - gigaforust.internal
-  issuerRef:
-    name: internal-ca
-    kind: ClusterIssuer

homarr/k8s/config.yaml

@@ -1,9 +0,0 @@
-apiVersion: v1
-kind: ConfigMap
-metadata:
-  name: homarr-config
-  namespace: homarr
-data:
-  TZ: "Europe/Bratislava"
-  TURBO_TELEMETRY_DISABLED: "1"
-  ENABLE_KUBERNETES: "true"

homarr/k8s/homarr.yaml

@@ -1,81 +0,0 @@
-apiVersion: v1
-kind: Service
-metadata:
-  name: homarr-service
-  namespace: homarr
-spec:
-  selector:
-    app: homarr
-  ports:
-    - port: 7575
-      targetPort: 7575
----
-apiVersion: apps/v1
-kind: Deployment
-metadata:
-  name: homarr-deployment
-  namespace: homarr
-spec:
-  replicas: 1
-  selector:
-    matchLabels:
-      app: homarr
-  strategy:
-    type: Recreate
-  template:
-    metadata:
-      labels:
-        app: homarr
-    spec:
-      serviceAccountName: homarr
-      containers:
-        - name: homarr
-          image: ghcr.io/homarr-labs/homarr:v2.1.2
-          envFrom:
-            - configMapRef:
-                name: homarr-config
-            - secretRef:
-                name: homarr-secrets
-          ports:
-            - containerPort: 7575
-          readinessProbe:
-            httpGet:
-              path: /
-              port: 7575
-            initialDelaySeconds: 30
-            periodSeconds: 10
-            failureThreshold: 6
-          livenessProbe:
-            httpGet:
-              path: /
-              port: 7575
-            initialDelaySeconds: 60
-            periodSeconds: 30
-            failureThreshold: 3
-          volumeMounts:
-            - name: homarr-data
-              mountPath: /appdata
-          resources:
-            requests:
-              cpu: "250m"
-              memory: "350Mi"
-            limits:
-              cpu: "500m"
-              memory: "700Mi"
-      volumes:
-        - name: homarr-data
-          persistentVolumeClaim:
-            claimName: homarr-pvc
----
-apiVersion: v1
-kind: PersistentVolumeClaim
-metadata:
-  name: homarr-pvc
-  namespace: homarr
-spec:
-  resources:
-    requests:
-      storage: 2Gi
-  volumeMode: Filesystem
-  accessModes:
-    - ReadWriteOnce

homarr/k8s/ingress.yaml

@@ -1,33 +0,0 @@
-# apiVersion: traefik.io/v1alpha1
-# kind: IngressRoute
-# metadata:
-#   name: homarr-prod
-#   namespace: homarr
-# spec:
-#   entryPoints:
-#     - websecure
-#   routes:
-#     - match: Host(`home.forust.xyz`)
-#       kind: Rule
-#       services:
-#         - name: homarr-service
-#           port: 7575
-#   tls:
-#     secretName: home-prod-tls
-# ---
-apiVersion: traefik.io/v1alpha1
-kind: IngressRoute
-metadata:
-  name: homarr-local
-  namespace: homarr
-spec:
-  entryPoints:
-    - websecure
-  routes:
-    - match: Host(`home.workstation.internal`) || Host(`home.gigaforust.internal`)
-      kind: Rule
-      services:
-        - name: homarr-service
-          port: 7575
-  tls:
-    secretName: internal-wildcard-tls

homarr/k8s/namespace.yaml

@@ -1,4 +0,0 @@
-apiVersion: v1
-kind: Namespace
-metadata:
-  name: homarr

homarr/k8s/rbac.yaml

@@ -1,58 +0,0 @@
-apiVersion: v1
-kind: ServiceAccount
-metadata:
-  name: homarr
-  namespace: homarr
----
-apiVersion: rbac.authorization.k8s.io/v1
-kind: ClusterRole
-metadata:
-  name: homarr-readonly
-rules:
-  - apiGroups: [""]
-    resources:
-      - pods
-      - services
-      - endpoints
-      - namespaces
-      - nodes
-      - configmaps
-      - persistentvolumeclaims
-      - events
-    verbs: ["get", "list", "watch"]
-  - apiGroups: ["apps"]
-    resources:
-      - deployments
-      - statefulsets
-      - daemonsets
-      - replicasets
-    verbs: ["get", "list", "watch"]
-  - apiGroups: ["networking.k8s.io"]
-    resources:
-      - ingresses
-    verbs: ["get", "list", "watch"]
-  - apiGroups: ["traefik.io"]
-    resources:
-      - ingressroutes
-      - ingressroutetcps
-      - ingressrouteudps
-      - middlewares
-    verbs: ["get", "list", "watch"]
-  - apiGroups: ["metrics.k8s.io"]
-    resources:
-      - pods
-      - nodes
-    verbs: ["get", "list"]
----
-apiVersion: rbac.authorization.k8s.io/v1
-kind: ClusterRoleBinding
-metadata:
-  name: homarr-readonly
-roleRef:
-  apiGroup: rbac.authorization.k8s.io
-  kind: ClusterRole
-  name: homarr-readonly
-subjects:
-  - kind: ServiceAccount
-    name: homarr
-    namespace: homarr

homarr/k8s/secrets.yaml.example

@@ -1,9 +0,0 @@
-apiVersion: v1
-kind: Secret
-metadata:
-  name: homarr-secrets
-  namespace: homarr
-type: Opaque
-stringData:
-  # openssl rand -hex 32
-  SECRET_ENCRYPTION_KEY: "REPLACE_ME"

netronome/compose.yaml

@@ -1,6 +1,6 @@
 services:
   netronome:
-    image: ghcr.io/autobrr/netronome:v0.15.0
+    image: ghcr.io/autobrr/netronome:v0.16.0
     restart: unless-stopped
     container_name: netronome
     ports:

netronome/k8s/netronome.yaml

@@ -32,7 +32,7 @@ spec:
     spec:
       containers:
         - name: netronome
-          image: ghcr.io/autobrr/netronome:v0.15.0
+          image: ghcr.io/autobrr/netronome:v0.16.0
           ports:
             - name: netronome-port
               protocol: TCP

traefik/k8s/traefik-values.yaml

@@ -94,7 +94,7 @@ ports:
     exposedPort: 8080
     protocol: TCP
     expose:
-      default: true
+      default: false
     http:
       aliasHeadersStrategy: delete
   ssh:

vpn/xui/k8s/xui.yaml

@@ -36,7 +36,7 @@ spec:
     spec:
       containers:
         - name: xui
-          image: ghcr.io/mhsanaei/3x-ui:v3.8.5
+          image: ghcr.io/mhsanaei/3x-ui:v3.9.0
           envFrom:
             - configMapRef:
                 name: xui-config