chore(deps): update renovate/renovate docker tag to v44.90.2

Merge pull request 'chore(deps): update renovate/renovate docker tag to v44.85.0' (#25 ) from renovate/renovate-renovate-44.x into main
Reviewed-on: https://gitea.forust.xyz/forust/homelab/pulls/25
2026-09-15 04:18:03 +00:00 · 2026-09-14 09:48:39 +00:00 · 2026-09-14 09:48:21 +00:00 · 2026-09-14 09:46:49 +00:00 · 2026-09-14 09:46:49 +00:00 · 2026-09-14 09:46:24 +00:00
256 changed files with 13747 additions and 2466 deletions
@@ -0,0 +1,191 @@
 # Инструкция: Анализ хранилища Kubernetes и настройка NFS
 ## Цель
 Проанализировать текущую конфигурацию хранилища Kubernetes и подготовить план внедрения NFS StorageClass для сохранения данных при удалении namespace.
 ## 1. Собрать информацию о кластере
 ### 1.1. Версия Kubernetes и тип дистрибутива
 ```bash
 kubectl version --short
 # или
 kubectl version
 ```
 Определить, используется ли k3s, k8s, microk8s и т.д.:
 ```bash
 # Проверить наличие k3s
 which k3s
 # Проверить процесс
 ps aux | grep -E 'kube|k3s'
 ```
 ### 1.2. StorageClass
 ```bash
 kubectl get storageclass -o wide
 ```
 Запомнить:
 - `PROVISIONER` — какой драйвер используется
 - `RECLAIMPOLICY` — Delete или Retain
 - Какой StorageClass помечен как `(default)`
 ### 1.3. Существующие PV и PVC
 ```bash
 kubectl get pv -o wide
 kubectl get pvc --all-namespaces
 ```
 Посмотреть, какие PVC привязаны к каким PV, и какой reclaimPolicy у PV.
 ### 1.4. Нода и диски
 ```bash
 # Список нод
 kubectl get nodes -o wide
 # На каждой ноде (через ssh или локально):
 lsblk
 df -h
 cat /etc/fstab
 ```
 Определить:
 - Есть ли отдельный раздел/диск для данных
 - Куда смонтированы разделы
 - Сколько свободного места
 - Есть ли монтирование NTFS-разделов (как `/media/forust/Programs`)
 ### 1.5. Где local-path хранит данные (для k3s)
 ```bash
 ls -la /var/lib/rancher/k3s/storage/ 2>/dev/null
 # или для microk8s
 ls -la /var/snap/microk8s/common/ 2>/dev/null
 ```
 ## 2. Анализ: сохраняются ли данные при удалении namespace?
 | Сценарий | Результат |
 |---|---|
 | `kubectl delete ns <ns>` | Все PVC в namespace удаляются |
 | PVC → PV c `reclaimPolicy: Delete` | PV и данные удалены |
 | PVC → PV c `reclaimPolicy: Retain` | PV остаётся (статус Released), данные целы |
 **Вывод:** Если reclaimPolicy в StorageClass = `Delete`, то данные **пропадут**. Если `Retain` — сохранятся.
 ## 3. План внедрения NFS
 ### 3.1. Проверить, установлен ли NFS
 ```bash
 which nfsstat exportfs mount.nfs
 systemctl status nfs-server 2>/dev/null || systemctl status nfs-kernel-server 2>/dev/null
 ```
 ### 3.2. Выбрать директорию для NFS-экспорта
 Варианты (выбрать подходящий):
 - `/var/lib/k8s-nfs/` — на корневом разделе
 - `<путь к отдельному разделу>/k8s-nfs/` — если есть отдельный диск/раздел
 - Не рекомендуется использовать NTFS-раздел (проблемы с правами и производительностью)
 Требования:
 - Файловая система: ext4 или xfs (не ntfs!)
 - Достаточно свободного места
 - Права: `755`, владелец root
 ### 3.3. Установить NFS-сервер
 ```bash
 # Debian/Ubuntu
 apt update && apt install -y nfs-kernel-server
 # RHEL/Fedora
 dnf install -y nfs-utils
 ```
 ### 3.4. Настроить экспорт
 Создать директорию:
 ```bash
 mkdir -p /var/lib/k8s-nfs
 chmod 755 /var/lib/k8s-nfs
 ```
 Добавить в `/etc/exports`:
 ```
 /var/lib/k8s-nfs *(rw,sync,no_subtree_check,no_root_squash)
 ```
 Применить:
 ```bash
 exportfs -rav
 ```
 Проверить:
 ```bash
 showmount -e localhost
 ```
 ### 3.5. Выбрать способ интеграции с Kubernetes
 #### Вариант A: nfs-subdir-external-provisioner (проще)
 ```bash
 helm repo add nfs-subdir-external-provisioner https://kubernetes-sigs.github.io/nfs-subdir-external-provisioner/
 helm install nfs-provisioner nfs-subdir-external-provisioner/nfs-subdir-external-provisioner \
  --namespace kube-system \
  --set nfs.server=127.0.0.1 \
  --set nfs.path=/var/lib/k8s-nfs \
  --set storageClass.name=nfs \
  --set storageClass.defaultClass=false \
  --set storageClass.reclaimPolicy=Retain
 ```
 #### Вариант B: NFS CSI Driver
 ```bash
 helm repo add csi-driver-nfs https://raw.githubusercontent.com/kubernetes-csi/csi-driver-nfs/master/charts
 helm install csi-driver-nfs csi-driver-nfs/csi-driver-nfs --namespace kube-system
 ```
 После установки CSI драйвера создать StorageClass:
 ```yaml
 apiVersion: storage.k8s.io/v1
 kind: StorageClass
 metadata:
  name: nfs
 provisioner: nfs.csi.k8s.io
 parameters:
  server: 127.0.0.1
  share: /var/lib/k8s-nfs
 reclaimPolicy: Retain
 volumeBindingMode: Immediate
 ```
 ### 3.6. Проверить результат
 ```bash
 kubectl get storageclass
 kubectl get pods -n kube-system | grep -E 'nfs|provisioner'
 ```
 ## 4. Итоговая конфигурация
 После внедрения в кластере будет два StorageClass:
 | Имя | Provisioner | ReclaimPolicy | Назначение |
 |---|---|---|---|
 | `local-path` (default) | rancher.io/local-path | Delete | Временные данные, stateless |
 | `nfs` | nfs-subdir-external-provisioner или nfs.csi.k8s.io | Retain | Данные, которые нужно сохранять |
 **Главное преимущество:** PVC c `storageClassName: nfs` при удалении namespace сохраняют данные на диске, так как NFS-провизор использует `reclaimPolicy: Retain` или файлы физически остаются в NFS-экспорте.
 ## 5. Ответы на частые вопросы
 **В:** Не упадёт ли local-path при установке NFS?
 **О:** Нет, они независимы. local-path продолжает работать как обычно.
 **В:** Данные NFS и local-path будут на одном диске?
 **О:** Да, можно настроить оба на одном разделе, в разных каталогах.
 **В:** Что если у меня несколько нод?
 **О:** NFS сервер нужно поднять на одной ноде, а с других нод должна быть доступна шари. Для multi-node лучше использовать отдельный сервер или distributed storage (Longhorn, Rook/Ceph).
 **В:** Можно ли использовать существующий NTFS-раздел для NFS?
 **О:** Не рекомендуется — NTFS не поддерживает права Linux (no_root_squash не сработает корректно), возможны проблемы с блокировками и производительностью.
@@ -0,0 +1,370 @@
 name: ci
 on:
  push:
    branches:
      - "**"
  pull_request:
  workflow_dispatch:
 env:
  REGISTRY: gcr.forust.xyz
 jobs:
  lint-prettier:
    runs-on: [self-hosted, linux, arch, homelab]
    steps:
      - name: Checkout repository
        uses: actions/checkout@v4
      - name: Check formatting with Prettier
        shell: bash
        run: |
          mapfile -t prettier_files < <(
            git ls-files \
              | grep -E '\.(md|json|ya?ml|html|css)$' \
              | grep -Ev '^(\.docs/|\.zed/|errorpages/html/|homepages/(forust_files|xdfnx_files)/)'
          )
          if [ "${#prettier_files[@]}" -eq 0 ]; then
            echo "No Prettier-managed files found."
            exit 0
          fi
          docker run --rm \
            -v "$PWD:/work" \
            -w /work \
            node:22-alpine \
            sh -lc 'npx --yes prettier@3 --check --ignore-unknown "$@"' sh "${prettier_files[@]}"
  lint-ruff:
    runs-on: [self-hosted, linux, arch, homelab]
    steps:
      - name: Checkout repository
        uses: actions/checkout@v4
      - name: Lint Python with Ruff
        shell: bash
        run: |
          docker run --rm \
            -v "$PWD:/work" \
            -w /work \
            ghcr.io/astral-sh/ruff:latest \
            check .
  lint-yaml:
    runs-on: [self-hosted, linux, arch, homelab]
    steps:
      - name: Checkout repository
        uses: actions/checkout@v4
      - name: Lint YAML syntax
        shell: bash
        run: |
          mapfile -t yaml_files < <(
            git ls-files '*.yaml' '*.yml' \
              ':!node_modules/**' \
              ':!**/.venv/**'
          )
          if [ "${#yaml_files[@]}" -eq 0 ]; then
            echo "No YAML files found."
            exit 0
          fi
          docker run --rm \
            -v "$PWD:/work" \
            -w /work \
            cytopia/yamllint:latest \
            -c .yamllint "${yaml_files[@]}"
  lint-dockerfiles:
    runs-on: [self-hosted, linux, arch, homelab]
    steps:
      - name: Checkout repository
        uses: actions/checkout@v4
      - name: Lint Dockerfiles
        shell: bash
        run: |
          mapfile -t dockerfiles < <(
            git ls-files ':(glob)**/Dockerfile' ':(glob)**/Dockerfile.*'
          )
          if [ "${#dockerfiles[@]}" -eq 0 ]; then
            echo "No Dockerfiles found."
            exit 0
          fi
          docker run --rm \
            -v "$PWD:/work" \
            -w /work \
            --entrypoint hadolint \
            hadolint/hadolint:latest-debian \
            -c .hadolint.yaml "${dockerfiles[@]}"
  validate:
    runs-on: [self-hosted, linux, arch, homelab]
    steps:
      - name: Checkout repository
        uses: actions/checkout@v4
      - name: Validate Kubernetes manifests
        shell: bash
        run: |
          mapfile -t manifests < <(
            git ls-files ':(glob)**/k8s/**/*.yaml' ':(glob)**/k8s/**/*.yml' \
              | grep -Ev '(^|/)(kustomization\.ya?ml|.*\.example\.ya?ml|.*values\.ya?ml|patch-.*\.ya?ml)$'
          )
          if [ "${#manifests[@]}" -eq 0 ]; then
            echo "No Kubernetes manifests found."
            exit 0
          fi
          docker run --rm \
            -v "$PWD:/work" \
            -w /work \
            ghcr.io/yannh/kubeconform:latest \
            -strict \
            -ignore-missing-schemas \
            -summary \
            "${manifests[@]}"
  build:
    needs: [lint-prettier, lint-ruff, lint-yaml, lint-dockerfiles, validate]
    if: github.event_name != 'pull_request' && (github.ref_name == 'main' || github.ref_name == 'dev')
    runs-on: [self-hosted, linux, arch, homelab]
    outputs:
      services: ${{ steps.services.outputs.services }}
    steps:
      - name: Checkout repository
        uses: actions/checkout@v4
        with:
          fetch-depth: 0
      - name: Detect changed docker-built services
        id: services
        shell: bash
        run: |
          base="${{ github.event.before }}"
          if [ -z "$base" ] || [ "$base" = "0000000000000000000000000000000000000000" ]; then
            base="$(git rev-list --max-parents=0 HEAD)"
          fi
          mapfile -t changed_files < <(git diff --name-only "$base" "${GITHUB_SHA}")
          services=()
          add_service() {
            local name="$1"
            local seen=0
            for existing in "${services[@]}"; do
              if [ "$existing" = "$name" ]; then
                seen=1
                break
              fi
            done
            if [ "$seen" -eq 0 ]; then
              services+=("$name")
            fi
          }
          for file in "${changed_files[@]}"; do
            case "$file" in
              dtek_notif/*)
                add_service dtek_notif
                ;;
              errorpages/*)
                add_service errorpages
                ;;
              userbot/*)
                add_service userbot
                ;;
              homepages/*)
                add_service homepages
                ;;
              edu_master/phpsessid-bot/*|edu_master/webinar-checker/*|edu_master/compose.yaml)
                add_service edu_master
                ;;
            esac
          done
          if [ "${#services[@]}" -eq 0 ]; then
            echo "No docker-built services changed."
            echo "services=" >> "$GITHUB_OUTPUT"
            exit 0
          fi
          printf '%s\n' "${services[@]}" | tee /tmp/services.txt
          echo "services=$(paste -sd, /tmp/services.txt)" >> "$GITHUB_OUTPUT"
      - name: Log in to registry
        if: steps.services.outputs.services != ''
        shell: bash
        run: |
          echo "${{ secrets.REGISTRY_PASSWORD }}" | docker login "${REGISTRY}" \
            -u "${{ secrets.REGISTRY_USERNAME }}" \
            --password-stdin
      - name: Build and push changed images
        if: steps.services.outputs.services != ''
        shell: bash
        run: |
          IFS=, read -r -a services <<< "${{ steps.services.outputs.services }}"
          for service in "${services[@]}"; do
            case "$service" in
              dtek_notif)
                image="${REGISTRY}/forust/dtek-notif"
                tags=("latest")
                case "${GITHUB_REF_NAME}" in
                  main)
                    tags+=("main" "prod")
                    ;;
                  dev)
                    tags+=("dev")
                    ;;
                esac
                build_args=()
                for tag in "${tags[@]}"; do
                  build_args+=(-t "${image}:${tag}")
                done
                docker build "${build_args[@]}" dtek_notif
                for tag in "${tags[@]}"; do
                  docker push "${image}:${tag}"
                done
                ;;
              errorpages)
                image="${REGISTRY}/forust/error-pages"
                tags=("latest")
                case "${GITHUB_REF_NAME}" in
                  main)
                    tags+=("main" "prod")
                    ;;
                  dev)
                    tags+=("dev")
                    ;;
                esac
                build_args=()
                for tag in "${tags[@]}"; do
                  build_args+=(-t "${image}:${tag}")
                done
                docker build "${build_args[@]}" errorpages
                for tag in "${tags[@]}"; do
                  docker push "${image}:${tag}"
                done
                ;;
              userbot)
                tags=("latest")
                case "${GITHUB_REF_NAME}" in
                  main)
                    tags+=("main" "prod")
                    ;;
                  dev)
                    tags+=("dev")
                    ;;
                esac
                for target in runtime panel; do
                  case "$target" in
                    runtime)
                      context="userbot"
                      image="${REGISTRY}/forust/userbot"
                      ;;
                    panel)
                      context="userbot/panel"
                      image="${REGISTRY}/forust/userbot-panel"
                      ;;
                  esac
                  build_args=()
                  for tag in "${tags[@]}"; do
                    build_args+=(-t "${image}:${tag}")
                  done
                  docker build "${build_args[@]}" "$context"
                  for tag in "${tags[@]}"; do
                    docker push "${image}:${tag}"
                  done
                done
                ;;
              homepages)
                for service in forust xdfnx; do
                  case "$service" in
                    forust)
                      image="${REGISTRY}/forust/forust-homepage"
                      ;;
                    xdfnx)
                      image="${REGISTRY}/forust/xdfnx-homepage"
                      ;;
                  esac
                  tags=("latest")
                  case "${GITHUB_REF_NAME}" in
                    main)
                      tags+=("main" "prod")
                      ;;
                    dev)
                      tags+=("dev")
                      ;;
                  esac
                  build_args=()
                  for tag in "${tags[@]}"; do
                    build_args+=(-t "${image}:${tag}")
                  done
                  docker build "${build_args[@]}" -f "homepages/Dockerfile.${service}" homepages
                  for tag in "${tags[@]}"; do
                    docker push "${image}:${tag}"
                  done
                done
                ;;
              edu_master)
                for service in session-keeper webinar-checker; do
                  case "$service" in
                    session-keeper)
                      context="edu_master/phpsessid-bot"
                      image="${REGISTRY}/forust/session-keeper"
                      ;;
                    webinar-checker)
                      context="edu_master/webinar-checker"
                      image="${REGISTRY}/forust/webinar-checker"
                      ;;
                  esac
                  tags=("latest")
                  case "${GITHUB_REF_NAME}" in
                    main)
                      tags+=("main" "prod")
                      ;;
                    dev)
                      tags+=("dev")
                      ;;
                  esac
                  build_args=()
                  for tag in "${tags[@]}"; do
                    build_args+=(-t "${image}:${tag}")
                  done
                  docker build "${build_args[@]}" "$context"
                  for tag in "${tags[@]}"; do
                    docker push "${image}:${tag}"
                  done
                done
                ;;
            esac
          done
  deploy-userbot-panel:
    needs: build
    if: github.ref_name == 'main' && contains(needs.build.outputs.services, 'userbot')
    runs-on: [self-hosted, linux, arch, homelab, prod]
    steps:
      - name: Checkout repository
        uses: actions/checkout@v4
      - name: Apply and roll out userbot panel
        shell: bash
        run: |
          kubectl apply -f userbot/k8s/base/panel.yaml
          kubectl get secret userbot-common-secrets -n default -o json \
            | jq 'del(.metadata.annotations,.metadata.creationTimestamp,.metadata.resourceVersion,.metadata.uid,.metadata.managedFields) | .metadata.namespace = "userbot"' \
            | kubectl apply -f -
          # Keep legacy deployments (forust/anna) in sync with manifests; they have no replicas field, so apply leaves scaling to the user manager only.
          kubectl apply -f userbot/k8s/base/userbots.yaml
          kubectl rollout restart deployment/userbot-panel -n userbot
          kubectl rollout status deployment/userbot-panel -n userbot --timeout=180s
@@ -0,0 +1,152 @@
 name: deploy
 on:
  workflow_dispatch:
 concurrency:
  group: deploy-main
  cancel-in-progress: false
 jobs:
  redeploy:
    runs-on: [self-hosted, linux, arch, homelab, prod]
    steps:
      - name: Redeploy workstation
        shell: bash
        env:
          DEPLOY_HOST: ${{ secrets.DEPLOY_HOST }}
          DEPLOY_PORT: ${{ secrets.DEPLOY_PORT }}
          DEPLOY_USER: ${{ secrets.DEPLOY_USER }}
          DEPLOY_PATH: ${{ secrets.DEPLOY_PATH }}
          DEPLOY_KEY: ${{ secrets.DEPLOY_SSH_KEY }}
          # Set APPLY_PRUNE=true to enable kubectl apply --prune. Requires every
          # manifest to carry label app.kubernetes.io/managed-by=homelab-deploy,
          # otherwise previously applied resources get deleted on the next run.
          APPLY_PRUNE: ${{ vars.APPLY_PRUNE }}
        run: |
          set -euo pipefail
          : "${DEPLOY_HOST:?missing DEPLOY_HOST}"
          : "${DEPLOY_USER:?missing DEPLOY_USER}"
          : "${DEPLOY_KEY:?missing DEPLOY_SSH_KEY}"
          deploy_port="${DEPLOY_PORT:-22}"
          deploy_path="${DEPLOY_PATH:-/srv/homelab}"
          ssh_key="$RUNNER_TEMP/deploy_key"
          mkdir -p "$RUNNER_TEMP"
          printf '%s\n' "$DEPLOY_KEY" > "$ssh_key"
          chmod 600 "$ssh_key"
          ssh_opts=(
            -i "$ssh_key"
            -p "$deploy_port"
            -o BatchMode=yes
            -o StrictHostKeyChecking=accept-new
          )
          ssh "${ssh_opts[@]}" "${DEPLOY_USER}@${DEPLOY_HOST}" \
            "DEPLOY_PATH=$(printf '%q' \"$deploy_path\") APPLY_PRUNE=$(printf '%q' \"${APPLY_PRUNE:-false}\") bash -se" <<'EOF'
          set -euo pipefail
          repo="${DEPLOY_PATH:-/srv/homelab}"
          if [ ! -d "$repo/.git" ]; then
            echo "Repository not found at $repo"
            exit 1
          fi
          git -C "$repo" fetch origin main
          git -C "$repo" reset --hard origin/main
          # Runtime selection: a service is k8s-managed when $SERVICE/k8s/active
          # exists. Otherwise it is compose-managed, and only k8s/routing/*
          # manifests (external Services / EndpointSlices / ServersTransport /
          # Ingresses that route to docker backends) are applied.
          #   migrate:   touch SERVICE/k8s/active   (+ move routing files up)
          #   rollback:  rm SERVICE/k8s/active
          collect_k8s() {
            find "$1" -type f \( -name '*.yaml' -o -name '*.yml' \) \
              ! -path '*/routing/*' ! -path '*/overlays/*' \
              ! -name 'kustomization.y*ml' ! -name '*.example.y*ml' \
              ! -name '*values.y*ml' ! -name 'patch-*.y*ml' \
              | sort
          }
          collect_k8s_inactive() {
            find "$1" -type f \( -name '*.yaml' -o -name '*.yml' \) \
              \( -name 'namespace.y*ml' -o -path '*/routing/*' \) \
              ! -path '*/overlays/*' ! -name '*.example.y*ml' \
              | sort
          }
          mapfile -t compose_stacks < <(
            find "$repo" -type f \( -name 'compose.yaml' -o -name 'compose.yml' \) | sort
          )
          mapfile -t k8s_manifests < <(
            for kd in $(find "$repo" -type d -name k8s ! -path '*/.git/*' | sort); do
              if [ -f "$kd/active" ]; then
                collect_k8s "$kd"
              else
                collect_k8s_inactive "$kd"
              fi
            done
          )
          echo "== Validate compose stacks =="
          for cf in "${compose_stacks[@]}"; do
            dir=$(dirname "$cf")
            if [ -f "$dir/k8s/active" ]; then
              echo "  skip (k8s-managed): $dir"
              continue
            fi
            echo "  config: $cf"
            docker compose -f "$cf" config --quiet
          done
          echo "== Validate k8s manifests (kubectl dry-run) =="
          for m in "${k8s_manifests[@]}"; do
            echo "  apply --dry-run=client $m"
            kubectl apply --dry-run=client -f "$m" >/dev/null
          done
          echo "== Applying Kubernetes manifests =="
          ns_files=()
          other_files=()
          for m in "${k8s_manifests[@]}"; do
            case "$m" in
              */namespace.y?ml) ns_files+=("$m") ;;
              *) other_files+=("$m") ;;
            esac
          done
          prune_opts=()
          if [ "${APPLY_PRUNE:-false}" = "true" ]; then
            prune_opts=(--prune -l app.kubernetes.io/managed-by=homelab-deploy)
          fi
          if [ "${#ns_files[@]}" -gt 0 ]; then
            echo "  namespaces first: ${ns_files[*]}"
            kubectl apply -f "${ns_files[@]}"
          fi
          if [ "${#other_files[@]}" -gt 0 ]; then
            echo "  resources: ${other_files[*]}"
            kubectl apply "${prune_opts[@]}" -f "${other_files[@]}"
          fi
          echo "== Redeploying docker compose stacks =="
          for cf in "${compose_stacks[@]}"; do
            dir=$(dirname "$cf")
            if [ -f "$dir/k8s/active" ]; then
              echo "  skip (k8s-managed): $dir"
              continue
            fi
            echo "  compose: $dir"
            if grep -Eq '^\s+pull_policy:\s*build\b' "$cf"; then
              docker compose -f "$cf" build
              docker compose -f "$cf" push
            fi
            docker compose -f "$cf" up -d --pull always --remove-orphans
          done
          EOF
@@ -1,39 +0,0 @@
 name: Deploy to Server
 run-name: Deploying to ${{ runner.os}} server on ${{ gitea.ref }}
 on:
  push:
    branches:
      - main
      - ci/gitea-actions
 jobs:
  deploy:
    runs-on: prod
    steps:
      - name: Fetch and Diff Analysis
        id: diff
        run: |
          cd ${{ secrets.PROD_DIR }}
          git fetch origin main
          CHANGES=$(git diff --name-only HEAD origin/main | cut -d/ -f1 | sort -u | tr '\n' ' ')
          echo "dirs=$CHANGES" >> $GITHUB_OUTPUT
          echo "Changed dirs: $CHANGES"
      - name: Sync Server Files
        run: |
          cd ${{ secrets.PROD_DIR }}
          git reset --hard origin/main
          echo "Server files synced with origin/main"
      - name: Deploy Services
        run: |
          cd ${{ secrets.PROD_DIR }}
          for dir in ${{ steps.diff.outputs.dirs }}; do
            if [ -d "$dir" ] && ([ -f "$dir/compose.yaml" ] || [ -f "$dir/docker-compose.yaml" ]); then
              echo ">>> Deploying $dir"
              cd "$dir"
              DOCKER_BUILDKIT=1 BUILDKIT_PROGRESS=plain docker compose up -d --build --no-color
              cd ..
            else
              echo ">>> Skipping $dir: no compose file found"
            fi
          done
@@ -0,0 +1,52 @@
 name: renovate-ci
 on:
  pull_request:
  push:
    branches:
      - main
  workflow_dispatch:
 jobs:
  validate-renovate:
    runs-on: [self-hosted, linux, arch, homelab]
    steps:
      - name: Checkout repository
        uses: actions/checkout@v4
      - name: Validate Renovate Compose draft
        shell: bash
        run: |
          set -euo pipefail
          trap 'rm -f renovate/.env' EXIT
          printf '%s\n' \
            'RENOVATE_ENDPOINT=https://gitea.example/api/v1' \
            'RENOVATE_TOKEN=test-token' \
            'RENOVATE_REPOSITORIES=forust/homelab' \
            > renovate/.env
          docker compose -f renovate/renovate-compose.yaml config --quiet
      - name: Validate Kubernetes manifests
        shell: bash
        run: |
          set -euo pipefail
          docker run --rm \
            -v "$PWD:/work" \
            -w /work \
            ghcr.io/yannh/kubeconform:latest \
            -strict \
            -ignore-missing-schemas \
            -summary \
            renovate/k8s/namespace.yaml \
            renovate/k8s/configmap.yaml \
            renovate/k8s/cronjob.yaml
      - name: Validate Renovate repository config
        shell: bash
        run: |
          set -euo pipefail
          docker run --rm \
            -v "$PWD:/work" \
            -w /work \
            renovate/renovate:44.83.2 \
            renovate-config-validator renovate.json
@@ -0,0 +1,370 @@
 name: ci
 on:
  push:
    branches:
      - "**"
  pull_request:
  workflow_dispatch:
 env:
  REGISTRY: gcr.forust.xyz
 jobs:
  lint-prettier:
    runs-on: [self-hosted, linux, arch, homelab]
    steps:
      - name: Checkout repository
        uses: actions/checkout@v4
      - name: Check formatting with Prettier
        shell: bash
        run: |
          mapfile -t prettier_files < <(
            git ls-files \
              | grep -E '\.(md|json|ya?ml|html|css)$' \
              | grep -Ev '^(\.docs/|\.zed/|errorpages/html/|homepages/(forust_files|xdfnx_files)/)'
          )
          if [ "${#prettier_files[@]}" -eq 0 ]; then
            echo "No Prettier-managed files found."
            exit 0
          fi
          docker run --rm \
            -v "$PWD:/work" \
            -w /work \
            node:22-alpine \
            sh -lc 'npx --yes prettier@3 --check --ignore-unknown "$@"' sh "${prettier_files[@]}"
  lint-ruff:
    runs-on: [self-hosted, linux, arch, homelab]
    steps:
      - name: Checkout repository
        uses: actions/checkout@v4
      - name: Lint Python with Ruff
        shell: bash
        run: |
          docker run --rm \
            -v "$PWD:/work" \
            -w /work \
            ghcr.io/astral-sh/ruff:latest \
            check .
  lint-yaml:
    runs-on: [self-hosted, linux, arch, homelab]
    steps:
      - name: Checkout repository
        uses: actions/checkout@v4
      - name: Lint YAML syntax
        shell: bash
        run: |
          mapfile -t yaml_files < <(
            git ls-files '*.yaml' '*.yml' \
              ':!node_modules/**' \
              ':!**/.venv/**'
          )
          if [ "${#yaml_files[@]}" -eq 0 ]; then
            echo "No YAML files found."
            exit 0
          fi
          docker run --rm \
            -v "$PWD:/work" \
            -w /work \
            cytopia/yamllint:latest \
            -c .yamllint "${yaml_files[@]}"
  lint-dockerfiles:
    runs-on: [self-hosted, linux, arch, homelab]
    steps:
      - name: Checkout repository
        uses: actions/checkout@v4
      - name: Lint Dockerfiles
        shell: bash
        run: |
          mapfile -t dockerfiles < <(
            git ls-files ':(glob)**/Dockerfile' ':(glob)**/Dockerfile.*'
          )
          if [ "${#dockerfiles[@]}" -eq 0 ]; then
            echo "No Dockerfiles found."
            exit 0
          fi
          docker run --rm \
            -v "$PWD:/work" \
            -w /work \
            --entrypoint hadolint \
            hadolint/hadolint:latest-debian \
            -c .hadolint.yaml "${dockerfiles[@]}"
  validate:
    runs-on: [self-hosted, linux, arch, homelab]
    steps:
      - name: Checkout repository
        uses: actions/checkout@v4
      - name: Validate Kubernetes manifests
        shell: bash
        run: |
          mapfile -t manifests < <(
            git ls-files ':(glob)**/k8s/**/*.yaml' ':(glob)**/k8s/**/*.yml' \
              | grep -Ev '(^|/)(kustomization\.ya?ml|.*\.example\.ya?ml|.*values\.ya?ml|patch-.*\.ya?ml)$'
          )
          if [ "${#manifests[@]}" -eq 0 ]; then
            echo "No Kubernetes manifests found."
            exit 0
          fi
          docker run --rm \
            -v "$PWD:/work" \
            -w /work \
            ghcr.io/yannh/kubeconform:latest \
            -strict \
            -ignore-missing-schemas \
            -summary \
            "${manifests[@]}"
  build:
    needs: [lint-prettier, lint-ruff, lint-yaml, lint-dockerfiles, validate]
    if: github.event_name != 'pull_request' && (github.ref_name == 'main' || github.ref_name == 'dev')
    runs-on: [self-hosted, linux, arch, homelab]
    outputs:
      services: ${{ steps.services.outputs.services }}
    steps:
      - name: Checkout repository
        uses: actions/checkout@v4
        with:
          fetch-depth: 0
      - name: Detect changed docker-built services
        id: services
        shell: bash
        run: |
          base="${{ github.event.before }}"
          if [ -z "$base" ] || [ "$base" = "0000000000000000000000000000000000000000" ]; then
            base="$(git rev-list --max-parents=0 HEAD)"
          fi
          mapfile -t changed_files < <(git diff --name-only "$base" "${GITHUB_SHA}")
          services=()
          add_service() {
            local name="$1"
            local seen=0
            for existing in "${services[@]}"; do
              if [ "$existing" = "$name" ]; then
                seen=1
                break
              fi
            done
            if [ "$seen" -eq 0 ]; then
              services+=("$name")
            fi
          }
          for file in "${changed_files[@]}"; do
            case "$file" in
              dtek_notif/*)
                add_service dtek_notif
                ;;
              errorpages/*)
                add_service errorpages
                ;;
              userbot/*)
                add_service userbot
                ;;
              homepages/*)
                add_service homepages
                ;;
              edu_master/phpsessid-bot/*|edu_master/webinar-checker/*|edu_master/compose.yaml)
                add_service edu_master
                ;;
            esac
          done
          if [ "${#services[@]}" -eq 0 ]; then
            echo "No docker-built services changed."
            echo "services=" >> "$GITHUB_OUTPUT"
            exit 0
          fi
          printf '%s\n' "${services[@]}" | tee /tmp/services.txt
          echo "services=$(paste -sd, /tmp/services.txt)" >> "$GITHUB_OUTPUT"
      - name: Log in to registry
        if: steps.services.outputs.services != ''
        shell: bash
        run: |
          echo "${{ secrets.REGISTRY_PASSWORD }}" | docker login "${REGISTRY}" \
            -u "${{ secrets.REGISTRY_USERNAME }}" \
            --password-stdin
      - name: Build and push changed images
        if: steps.services.outputs.services != ''
        shell: bash
        run: |
          IFS=, read -r -a services <<< "${{ steps.services.outputs.services }}"
          for service in "${services[@]}"; do
            case "$service" in
              dtek_notif)
                image="${REGISTRY}/forust/dtek-notif"
                tags=("latest")
                case "${GITHUB_REF_NAME}" in
                  main)
                    tags+=("main" "prod")
                    ;;
                  dev)
                    tags+=("dev")
                    ;;
                esac
                build_args=()
                for tag in "${tags[@]}"; do
                  build_args+=(-t "${image}:${tag}")
                done
                docker build "${build_args[@]}" dtek_notif
                for tag in "${tags[@]}"; do
                  docker push "${image}:${tag}"
                done
                ;;
              errorpages)
                image="${REGISTRY}/forust/error-pages"
                tags=("latest")
                case "${GITHUB_REF_NAME}" in
                  main)
                    tags+=("main" "prod")
                    ;;
                  dev)
                    tags+=("dev")
                    ;;
                esac
                build_args=()
                for tag in "${tags[@]}"; do
                  build_args+=(-t "${image}:${tag}")
                done
                docker build "${build_args[@]}" errorpages
                for tag in "${tags[@]}"; do
                  docker push "${image}:${tag}"
                done
                ;;
              userbot)
                tags=("latest")
                case "${GITHUB_REF_NAME}" in
                  main)
                    tags+=("main" "prod")
                    ;;
                  dev)
                    tags+=("dev")
                    ;;
                esac
                for target in runtime panel; do
                  case "$target" in
                    runtime)
                      context="userbot"
                      image="${REGISTRY}/forust/userbot"
                      ;;
                    panel)
                      context="userbot/panel"
                      image="${REGISTRY}/forust/userbot-panel"
                      ;;
                  esac
                  build_args=()
                  for tag in "${tags[@]}"; do
                    build_args+=(-t "${image}:${tag}")
                  done
                  docker build "${build_args[@]}" "$context"
                  for tag in "${tags[@]}"; do
                    docker push "${image}:${tag}"
                  done
                done
                ;;
              homepages)
                for service in forust xdfnx; do
                  case "$service" in
                    forust)
                      image="${REGISTRY}/forust/forust-homepage"
                      ;;
                    xdfnx)
                      image="${REGISTRY}/forust/xdfnx-homepage"
                      ;;
                  esac
                  tags=("latest")
                  case "${GITHUB_REF_NAME}" in
                    main)
                      tags+=("main" "prod")
                      ;;
                    dev)
                      tags+=("dev")
                      ;;
                  esac
                  build_args=()
                  for tag in "${tags[@]}"; do
                    build_args+=(-t "${image}:${tag}")
                  done
                  docker build "${build_args[@]}" -f "homepages/Dockerfile.${service}" homepages
                  for tag in "${tags[@]}"; do
                    docker push "${image}:${tag}"
                  done
                done
                ;;
              edu_master)
                for service in session-keeper webinar-checker; do
                  case "$service" in
                    session-keeper)
                      context="edu_master/phpsessid-bot"
                      image="${REGISTRY}/forust/session-keeper"
                      ;;
                    webinar-checker)
                      context="edu_master/webinar-checker"
                      image="${REGISTRY}/forust/webinar-checker"
                      ;;
                  esac
                  tags=("latest")
                  case "${GITHUB_REF_NAME}" in
                    main)
                      tags+=("main" "prod")
                      ;;
                    dev)
                      tags+=("dev")
                      ;;
                  esac
                  build_args=()
                  for tag in "${tags[@]}"; do
                    build_args+=(-t "${image}:${tag}")
                  done
                  docker build "${build_args[@]}" "$context"
                  for tag in "${tags[@]}"; do
                    docker push "${image}:${tag}"
                  done
                done
                ;;
            esac
          done
  deploy-userbot-panel:
    needs: build
    if: github.ref_name == 'main' && contains(needs.build.outputs.services, 'userbot')
    runs-on: [self-hosted, linux, arch, homelab, prod]
    steps:
      - name: Checkout repository
        uses: actions/checkout@v4
      - name: Apply and roll out userbot panel
        shell: bash
        run: |
          kubectl apply -f userbot/k8s/base/panel.yaml
          kubectl get secret userbot-common-secrets -n default -o json \
            | jq 'del(.metadata.annotations,.metadata.creationTimestamp,.metadata.resourceVersion,.metadata.uid,.metadata.managedFields) | .metadata.namespace = "userbot"' \
            | kubectl apply -f -
          # Keep legacy deployments (forust/anna) in sync with manifests; they have no replicas field, so apply leaves scaling to the user manager only.
          kubectl apply -f userbot/k8s/base/userbots.yaml
          kubectl rollout restart deployment/userbot-panel -n userbot
          kubectl rollout status deployment/userbot-panel -n userbot --timeout=180s
@@ -0,0 +1,161 @@
 name: deploy
 on:
  workflow_dispatch:
 concurrency:
  group: deploy-main
  cancel-in-progress: false
 jobs:
  redeploy:
    runs-on: [self-hosted, linux, arch, homelab, prod]
    steps:
      - name: Redeploy workstation
        shell: bash
        env:
          DEPLOY_HOST: ${{ secrets.DEPLOY_HOST }}
          DEPLOY_PORT: ${{ secrets.DEPLOY_PORT }}
          DEPLOY_USER: ${{ secrets.DEPLOY_USER }}
          DEPLOY_PATH: ${{ secrets.DEPLOY_PATH }}
          DEPLOY_KEY: ${{ secrets.DEPLOY_SSH_KEY }}
          # Set APPLY_PRUNE=true to enable kubectl apply --prune. Requires every
          # manifest to carry label app.kubernetes.io/managed-by=homelab-deploy,
          # otherwise previously applied resources get deleted on the next run.
          APPLY_PRUNE: ${{ vars.APPLY_PRUNE }}
        run: |
          set -euo pipefail
          : "${DEPLOY_HOST:?missing DEPLOY_HOST}"
          : "${DEPLOY_USER:?missing DEPLOY_USER}"
          : "${DEPLOY_KEY:?missing DEPLOY_SSH_KEY}"
          deploy_port="${DEPLOY_PORT:-22}"
          deploy_path="${DEPLOY_PATH:-/srv/homelab}"
          ssh_key="$RUNNER_TEMP/deploy_key"
          mkdir -p "$RUNNER_TEMP"
          printf '%s\n' "$DEPLOY_KEY" > "$ssh_key"
          chmod 600 "$ssh_key"
          ssh_opts=(
            -i "$ssh_key"
            -p "$deploy_port"
            -o BatchMode=yes
            -o StrictHostKeyChecking=accept-new
          )
          ssh "${ssh_opts[@]}" "${DEPLOY_USER}@${DEPLOY_HOST}" \
            "DEPLOY_PATH=$(printf '%q' \"$deploy_path\") APPLY_PRUNE=$(printf '%q' \"${APPLY_PRUNE:-false}\") bash -se" <<'EOF'
          set -euo pipefail
          repo="${DEPLOY_PATH:-/srv/homelab}"
          if [ ! -d "$repo/.git" ]; then
            echo "Repository not found at $repo"
            exit 1
          fi
          git -C "$repo" fetch origin main
          git -C "$repo" reset --hard origin/main
          # Runtime selection: a service is k8s-managed when $SERVICE/k8s/active
          # exists. Otherwise it is compose-managed, and only k8s/routing/*
          # manifests (external Services / EndpointSlices / ServersTransport /
          # Ingresses that route to docker backends) are applied.
          #   migrate:   touch SERVICE/k8s/active   (+ move routing files up)
          #   rollback:  rm SERVICE/k8s/active
          collect_k8s() {
            find "$1" -type f \( -name '*.yaml' -o -name '*.yml' \) \
              ! -path '*/routing/*' ! -path '*/overlays/*' \
              ! -name 'kustomization.y*ml' ! -name '*.example.y*ml' \
              ! -name '*values.y*ml' ! -name 'patch-*.y*ml' \
              | sort
          }
          collect_k8s_inactive() {
            find "$1" -type f \( -name '*.yaml' -o -name '*.yml' \) \
              \( -name 'namespace.y*ml' -o -path '*/routing/*' \) \
              ! -path '*/overlays/*' ! -name '*.example.y*ml' \
              | sort
          }
          mapfile -t compose_stacks < <(
            find "$repo" -type f \( -name 'compose.yaml' -o -name 'compose.yml' \) | sort
          )
          mapfile -t k8s_manifests < <(
            for kd in $(find "$repo" -type d -name k8s ! -path '*/.git/*' | sort); do
              if [ -f "$kd/active" ]; then
                collect_k8s "$kd"
              else
                collect_k8s_inactive "$kd"
              fi
            done
          )
          echo "== Validate compose stacks =="
          for cf in "${compose_stacks[@]}"; do
            dir=$(dirname "$cf")
            if [ -f "$dir/k8s/active" ]; then
              echo "  skip (k8s-managed): $dir"
              continue
            fi
            echo "  config: $cf"
            docker compose -f "$cf" config --quiet
          done
          echo "== Validate k8s manifests (kubectl dry-run) =="
          for m in "${k8s_manifests[@]}"; do
            echo "  apply --dry-run=client $m"
            kubectl apply --dry-run=client -f "$m" >/dev/null
          done
          echo "== Applying Kubernetes manifests =="
          ns_files=()
          other_files=()
          for m in "${k8s_manifests[@]}"; do
            case "$m" in
              */namespace.y?ml) ns_files+=("$m") ;;
              *) other_files+=("$m") ;;
            esac
          done
          prune_opts=()
          if [ "${APPLY_PRUNE:-false}" = "true" ]; then
            prune_opts=(--prune -l app.kubernetes.io/managed-by=homelab-deploy)
          fi
          if [ "${#ns_files[@]}" -gt 0 ]; then
            echo "  namespaces first: ${ns_files[*]}"
            kubectl apply -f "${ns_files[@]}"
          fi
          if [ -f "$repo/prometheus-stack/k8s/active" ]; then
            echo "== Upgrading kube-prometheus-stack =="
            helm upgrade --install prometheus-stack prometheus-community/kube-prometheus-stack \
              --namespace prometheus \
              --version 86.2.3 \
              --values "$repo/prometheus-stack/k8s/grafana-values.yaml" \
              --wait
          fi
          if [ "${#other_files[@]}" -gt 0 ]; then
            echo "  resources: ${other_files[*]}"
            kubectl apply "${prune_opts[@]}" -f "${other_files[@]}"
          fi
          echo "== Redeploying docker compose stacks =="
          for cf in "${compose_stacks[@]}"; do
            dir=$(dirname "$cf")
            if [ -f "$dir/k8s/active" ]; then
              echo "  skip (k8s-managed): $dir"
              continue
            fi
            echo "  compose: $dir"
            if grep -Eq '^\s+pull_policy:\s*build\b' "$cf"; then
              docker compose -f "$cf" build
              docker compose -f "$cf" push
            fi
            docker compose -f "$cf" up -d --pull always --remove-orphans
          done
          EOF
@@ -1,41 +0,0 @@
 ## BINARY MODE, USE WITH THE GITHUB RUNNER BINARY INSTALLED ON THE SERVER
 name: Deploy to Server
 run-name: Deploying onto server on ${{ github.ref }}
 on:
  push:
    branches:
      - main
      - ci/actions
 jobs:
  deploy:
    runs-on: [prod, self-hosted]
    steps:
      - name: Fetch and Diff Analysis
        id: diff
        run: |
          cd ${{ secrets.PROD_DIR }}
          git fetch origin main
          CHANGES=$(git diff --name-only HEAD origin/main | cut -d/ -f1 | sort -u | tr '\n' ' ')
          echo "dirs=$CHANGES" >> $GITHUB_OUTPUT
          echo "Changed dirs: $CHANGES"
      - name: Sync Server Files
        run: |
          cd ${{ secrets.PROD_DIR }}
          git reset --hard origin/main
          echo "Server files synced with origin/main"
      - name: Deploy Services
        run: |
          cd ${{ secrets.PROD_DIR }}
          for dir in ${{ steps.diff.outputs.dirs }}; do
            if [ -d "$dir" ] && ([ -f "$dir/compose.yaml" ] || [ -f "$dir/docker-compose.yaml" ]); then
              echo ">>> Deploying $dir"
              cd "$dir"
              DOCKER_BUILDKIT=1 BUILDKIT_PROGRESS=plain docker compose up -d --build --no-color
              cd ..
            else
              echo ">>> Skipping $dir: no compose file found"
            fi
          done
@@ -40,7 +40,8 @@ traefik/letsencrypt/acme.json
 traefik/dynamic/fileservers.yml
 traefik/dynamic/*.local.y*ml.*
 traefik/dynamic/*.external.y*ml
-
+traefik/k8s/fileservers.y*ml
 traefik/k8s/aliasHeadersStrategy.md
 traefik/logs/*
@@ -106,4 +107,3 @@ temp/*
 traefik/k8s/local-tls.yaml
 converters/k8s/config.yaml
 convertx/k8s/config.yaml
 traefik/k8s/crowdsec-middleware.yaml
@@ -9,31 +9,32 @@
      "hard_tabs": false,
      "format_on_save": "on",
      "formatter": {
-        "language_server": { "name": "yaml-language-server" }
+        "language_server": { "name": "yaml-language-server" },
-      }
+      },
    },
    "Python": {
      "tab_size": 4,
      "format_on_save": "on",
      "language_servers": ["pyright", "ruff"],
      "formatter": {
-        "language_server": { "name": "ruff" }
+        "language_server": { "name": "ruff" },
-      }
+      },
-    }
+    },
  },
  "lsp": {
    "yaml-language-server": {
      "settings": {
        "yaml": {
          "schemas": {
-            "kubernetes": ["**/k8s/*.yaml", "**/k8s/*.yml"]
+            "kubernetes": ["**/k8s/*.yaml", "**/k8s/*.yml"],
          },
          "validate": true,
          "completion": true,
          "format": {
-            "enable": true
+            "enable": true,
-          }
+          },
-        }
+        },
-      }
+      },
-    }
+    },
-  }
+  },
 }
@@ -1,6 +1,6 @@
 services:
  adguard:
-    image: adguard/adguardhome:latest
+    image: adguard/adguardhome:v0.107.79
    container_name: adguardhome
    restart: unless-stopped
    ports:
@@ -65,7 +65,7 @@ spec:
    spec:
      containers:
        - name: adguard
-          image: adguard/adguardhome:latest
+          image: adguard/adguardhome:v0.107.79
          resources:
            limits:
              memory: "1.5Gi"
@@ -10,7 +10,13 @@ spec:
    - match: Host(`adguard.forust.xyz`) || Host(`dns.forust.xyz`)
      kind: Rule
      middlewares:
-        - name: "crowdsec-crowdsec-bouncer@kubernetescrd"
+        - name: crowdsec-bouncer
          namespace: crowdsec
      services:
        - name: adguard-service
          port: 3000
    - match: (Host(`adguard.forust.xyz`) || Host(`dns.forust.xyz`)) && PathPrefix(`/dns-query`)
      kind: Rule
      services:
        - name: adguard-service
          port: 3000
@@ -31,22 +37,8 @@ spec:
      services:
        - name: adguard-service
          port: 3000
---
+    - match: (Host(`adguard.workstation.internal`) || Host(`dns.workstation.internal`) || Host(`adguard.gigaforust.internal`) || Host(`dns.gigaforust.internal`)) && PathPrefix(`/dns-query`)
 apiVersion: traefik.io/v1alpha1
 kind: IngressRoute
 metadata:
  name: adguard-doh
  namespace: adguard
 spec:
  entryPoints:
    - websecure
  routes:
    - match: (Host(`adguard.forust.xyz`) || Host(`dns.forust.xyz`)) && PathPrefix(`/dns-query`)
      kind: Rule
      middlewares:
        - name: "crowdsec-crowdsec-bouncer@kubernetescrd"
      services:
        - name: adguard-service
          port: 3000
  tls:
    certResolver: letsencrypt
@@ -1,6 +1,6 @@
 services:
  postgresql:
-    image: docker.io/library/postgres:15-alpine
+    image: docker.io/library/postgres:15.19-alpine
    restart: unless-stopped
    env_file:
      - .env
@@ -41,7 +41,7 @@ spec:
    spec:
      containers:
        - name: authentik-server
-          image: ghcr.io/goauthentik/server:2025.10.2
+          image: ghcr.io/goauthentik/server:2026.8.2
          args: ["server"]
          envFrom:
            - configMapRef:
@@ -75,7 +75,7 @@ spec:
    spec:
      containers:
        - name: authentik-worker
-          image: ghcr.io/goauthentik/server:2025.10.2
+          image: ghcr.io/goauthentik/server:2026.8.2
          args: ["worker"]
          securityContext:
            runAsUser: 0
@@ -10,7 +10,8 @@ spec:
    - match: Host(`auth.forust.xyz`)
      kind: Rule
      middlewares:
-        - name: "crowdsec-crowdsec-bouncer@kubernetescrd"
+        - name: crowdsec-bouncer
          namespace: crowdsec
      services:
        - name: authentik-server-service
          port: 9000
@@ -29,7 +29,7 @@ spec:
    spec:
      containers:
        - name: postgres
-          image: docker.io/library/postgres:15-alpine
+          image: docker.io/library/postgres:15.19-alpine
          env:
            - name: POSTGRES_DB
              value: authentik
@@ -1,6 +1,6 @@
 services:
  cloudflare-ddns:
-    image: timothyjmiller/cloudflare-ddns:latest
+    image: timothyjmiller/cloudflare-ddns:2.2.0
    container_name: cloudflare-ddns
    restart: unless-stopped
    security_opt:
@@ -7,7 +7,7 @@
      "api_key": {
        "api_key": "api_key_here",
        "account_email": "your_email_here"
-      }
+      },
      "zone_id": "your_zone-id",
      "subdomains": [
        { "name": "", "proxied": true },
@@ -18,7 +18,7 @@ spec:
      dnsPolicy: ClusterFirstWithHostNet
      containers:
        - name: cloudflare-ddns
-          image: timothyjmiller/cloudflare-ddns:latest
+          image: timothyjmiller/cloudflare-ddns:2.2.0
          imagePullPolicy: Always
          resources:
            requests:
@@ -1,6 +1,6 @@
 services:
  checkmk:
-    image: "checkmk/check-mk-raw:2.4.0-latest"
+    image: "checkmk/check-mk-raw:2.4.0-2026.09.14"
    container_name: "checkmk"
    restart: unless-stopped
    # ports:
@@ -7,8 +7,12 @@ spec:
  selector:
    app: checkmk
  ports:
-    - port: 5000
+    - name: web
      port: 5000
      targetPort: 5000
    - name: agent-receiver
      port: 8000
      targetPort: 8000
 ---
 apiVersion: apps/v1
 kind: Deployment
@@ -27,14 +31,17 @@ spec:
    spec:
      containers:
        - name: checkmk
-          image: checkmk/check-mk-raw:2.4.0-latest
+          image: checkmk/check-mk-raw:2.4.0-2026.09.14
          envFrom:
            - secretRef:
                name: checkmk-secrets
            - configMapRef:
                name: checkmk-config
          ports:
-            - containerPort: 5000
+            - name: web
              containerPort: 5000
            - name: agent-receiver
              containerPort: 8000
          volumeMounts:
            - name: sites
              mountPath: /omd/sites
@@ -10,7 +10,8 @@ spec:
    - match: Host(`cmk.forust.xyz`)
      kind: Rule
      middlewares:
-        - name: crowdsec-crowdsec-bouncer@kubernetescrd
+        - name: crowdsec-bouncer
          namespace: crowdsec
      services:
        - name: checkmk-service
          port: 5000
@@ -18,6 +19,22 @@ spec:
    certResolver: letsencrypt
 ---
 apiVersion: traefik.io/v1alpha1
 kind: IngressRouteTCP
 metadata:
  name: checkmk-agent-receiver
  namespace: checkmk
 spec:
  entryPoints:
    - checkmk-agent
  routes:
    - match: HostSNI(`*`)
      services:
        - name: checkmk-service
          port: 8000
  tls:
    passthrough: true
 ---
 apiVersion: traefik.io/v1alpha1
 kind: IngressRoute
 metadata:
  name: checkmk-local
@@ -1,7 +1,7 @@
 services:
  convertx:
    container_name: convertx
-    image: ghcr.io/c4illin/convertx:latest
+    image: ghcr.io/c4illin/convertx:v0.18.0
    restart: unless-stopped
    ports:
      - "9992:3000"
@@ -42,7 +42,7 @@ services:
  bentopdf:
    container_name: bentopdf
-    image: bentopdf/bentopdf:latest
+    image: bentopdf/bentopdf@sha256:4eb4ec8f5030faf87c29a73d3d5a2781f28a597cf440c3ab111eb96aee550871
    restart: unless-stopped
    labels:
      - "traefik.enable=true"
@@ -26,7 +26,7 @@ spec:
        app: bentopdf
    spec:
      containers:
-        - image: bentopdf/bentopdf:latest
+        - image: bentopdf/bentopdf@sha256:4eb4ec8f5030faf87c29a73d3d5a2781f28a597cf440c3ab111eb96aee550871
          imagePullPolicy: Always
          name: bentopdf
          ports:
@@ -26,7 +26,7 @@ spec:
        app: convertx
    spec:
      containers:
-        - image: ghcr.io/c4illin/convertx:latest
+        - image: ghcr.io/c4illin/convertx:v0.18.0
          name: convertx
          envFrom:
            - configMapRef:
@@ -2,23 +2,9 @@ container_runtime: containerd
 agent:
  env:
    - name: COLLECTIONS
-      value: "crowdsecurity/traefik crowdsecurity/base-http-scenarios crowdsecurity/sshd"
+      value: "crowdsecurity/traefik crowdsecurity/base-http-scenarios"
-  extraVolumes:
+    - name: DISABLE_COLLECTIONS
-    - name: journal-dir
+      value: "crowdsecurity/linux crowdsecurity/sshd"
      hostPath:
        path: /var/log/journal
        type: DirectoryOrCreate
    - name: run-journal-dir
      hostPath:
        path: /run/log/journal
        type: DirectoryOrCreate
  extraVolumeMounts:
    - name: journal-dir
      mountPath: /var/log/journal
      readOnly: true
    - name: run-journal-dir
      mountPath: /run/log/journal
      readOnly: true
  acquisition:
    - namespace: traefik
@@ -26,13 +12,6 @@ agent:
      program: traefik
      poll_without_inotify: true
  acquisitionCustom: |
    - source: journalctl
      journalctl_filter:
        - _SYSTEMD_UNIT=sshd.service
      labels:
        type: syslog
  resources:
    requests:
      cpu: 50m
@@ -44,14 +23,35 @@ agent:
 lapi:
  env:
    - name: COLLECTIONS
-      value: "crowdsecurity/traefik crowdsecurity/base-http-scenarios crowdsecurity/sshd"
+      value: "crowdsecurity/traefik crowdsecurity/base-http-scenarios"
    - name: DISABLE_COLLECTIONS
      value: "crowdsecurity/linux crowdsecurity/sshd"
  service:
-    type: NodePort
+    type: ClusterIP
-    nodePort: 30011
+  persistentVolume:
    data:
      enabled: true
      storageClassName: local-path-retain
      size: 1Gi
    config:
      enabled: true
      storageClassName: local-path-retain
      size: 100Mi
  storeLAPICscliCredentialsInSecret: true
  resources:
    requests:
      cpu: 50m
      memory: 150Mi
    limits:
-      cpu: 200m
+      cpu: 400m
      memory: 500Mi
 metrics:
  enabled: true
  serviceMonitor:
    additionalLabels:
      release: prometheus-stack
    enabled: true
    interval: 30s
    scrapeTimeout: 10s
    namespace: prometheus
@@ -0,0 +1,6 @@
 apiVersion: v1
 kind: Namespace
 metadata:
  name: crowdsec
  labels:
    app.kubernetes.io/part-of: crowdsec
@@ -0,0 +1,27 @@
 apiVersion: networking.k8s.io/v1
 kind: NetworkPolicy
 metadata:
  name: crowdsec-lapi
  namespace: crowdsec
 spec:
  podSelector:
    matchLabels:
      k8s-app: crowdsec
      type: lapi
  policyTypes:
    - Ingress
  ingress:
    - from:
        - namespaceSelector:
            matchLabels:
              kubernetes.io/metadata.name: traefik
          podSelector:
            matchLabels:
              app.kubernetes.io/name: traefik
        - podSelector:
            matchLabels:
              k8s-app: crowdsec
              type: agent
      ports:
        - protocol: TCP
          port: 8080
@@ -1,6 +1,6 @@
 services:
  dockmon:
-    image: darthnorse/dockmon:latest
+    image: darthnorse/dockmon:2.4.5
    container_name: dockmon
    restart: unless-stopped
    # ports:
@@ -29,7 +29,7 @@ spec:
    spec:
      containers:
        - name: dockmon
-          image: darthnorse/dockmon:latest
+          image: darthnorse/dockmon:2.4.5
          ports:
            - containerPort: 443
          volumeMounts:
@@ -18,7 +18,8 @@ spec:
    - match: Host(`dockmon.forust.xyz`)
      kind: Rule
      middlewares:
-        - name: crowdsec-crowdsec-bouncer@kubernetescrd
+        - name: crowdsec-bouncer
          namespace: crowdsec
        - name: security-headers@file
      services:
        - name: dockmon-service
@@ -1,7 +1,7 @@
 services:
  downtify:
    container_name: downtify
-    image: ghcr.io/henriquesebastiao/downtify:latest
+    image: ghcr.io/henriquesebastiao/downtify:2.12.0
    restart: unless-stopped
    # ports:
    #   - '7077:8000'
@@ -27,7 +27,7 @@ spec:
    spec:
      containers:
        - name: downtify
-          image: ghcr.io/henriquesebastiao/downtify:latest
+          image: ghcr.io/henriquesebastiao/downtify:2.12.0
          ports:
            - containerPort: 8000
          volumeMounts:
@@ -10,7 +10,8 @@ spec:
    - match: Host(`downtify.forust.xyz`)
      kind: Rule
      middlewares:
-        - name: crowdsec-crowdsec-bouncer@kubernetescrd
+        - name: crowdsec-bouncer
          namespace: crowdsec
        - name: security-chain@file
      services:
        - name: downtify-service
@@ -9,5 +9,6 @@ WEBINAR_CHECK_INTERVAL=60
 REDIS_HOST=redis
 REDIS_PORT=6379
 PLAYWRIGHT_WS=ws://playwright-service:3000/ws
 TZ=Europe/Kyiv
 WEBINAR_TELEGRAM_TOKEN=your_telegram_bot_token_here
 WEBINAR_ADMIN_ID=123456789
@@ -1,6 +1,6 @@
 services:
  redis:
-    image: redis:alpine
+    image: redis:8.10.1-alpine
    restart: unless-stopped
    volumes:
      - redis-data:/data
@@ -11,7 +11,7 @@ services:
      retries: 5
  playwright-service:
-    image: mcr.microsoft.com/playwright:v1.56.0-jammy
+    image: mcr.microsoft.com/playwright:v1.63.0-jammy
    restart: unless-stopped
    command: npx -y playwright@1.56.0 run-server --port 3000 --path /ws
@@ -0,0 +1,4 @@
 apiVersion: v1
 kind: Namespace
 metadata:
  name: edu-master
@@ -0,0 +1,57 @@
 apiVersion: apps/v1
 kind: Deployment
 metadata:
  name: playwright-service
  namespace: edu-master
  labels:
    app: edu-master-playwright
 spec:
  replicas: 1
  selector:
    matchLabels:
      app: edu-master-playwright
  template:
    metadata:
      labels:
        app: edu-master-playwright
    spec:
      containers:
        - name: playwright
          image: mcr.microsoft.com/playwright:v1.63.0-jammy
          imagePullPolicy: IfNotPresent
          command:
            - npx
            - -y
            - playwright@1.56.0
            - run-server
            - --port
            - "3000"
            - --path
            - /ws
          ports:
            - containerPort: 3000
          readinessProbe:
            tcpSocket:
              port: 3000
            initialDelaySeconds: 5
            periodSeconds: 10
            timeoutSeconds: 3
          livenessProbe:
            tcpSocket:
              port: 3000
            initialDelaySeconds: 15
            periodSeconds: 20
            timeoutSeconds: 3
 ---
 apiVersion: v1
 kind: Service
 metadata:
  name: playwright-service
  namespace: edu-master
 spec:
  selector:
    app: edu-master-playwright
  ports:
    - name: ws
      port: 3000
      targetPort: 3000
@@ -0,0 +1,75 @@
 apiVersion: apps/v1
 kind: StatefulSet
 metadata:
  name: redis
  namespace: edu-master
  labels:
    app: edu-master-redis
 spec:
  serviceName: redis
  replicas: 1
  selector:
    matchLabels:
      app: edu-master-redis
  template:
    metadata:
      labels:
        app: edu-master-redis
    spec:
      containers:
        - name: redis
          image: redis:8.10.1-alpine
          imagePullPolicy: IfNotPresent
          ports:
            - containerPort: 6379
          volumeMounts:
            - name: redis-data
              mountPath: /data
          resources:
            requests:
              cpu: 25m
              memory: 64Mi
            limits:
              cpu: 250m
              memory: 256Mi
          readinessProbe:
            exec:
              command: ["redis-cli", "ping"]
            initialDelaySeconds: 5
            periodSeconds: 5
            timeoutSeconds: 3
          livenessProbe:
            exec:
              command: ["redis-cli", "ping"]
            initialDelaySeconds: 10
            periodSeconds: 10
            timeoutSeconds: 3
      volumes:
        - name: redis-data
          persistentVolumeClaim:
            claimName: redis-data-pvc
 ---
 apiVersion: v1
 kind: PersistentVolumeClaim
 metadata:
  name: redis-data-pvc
  namespace: edu-master
 spec:
  accessModes:
    - ReadWriteOnce
  resources:
    requests:
      storage: 1Gi
 ---
 apiVersion: v1
 kind: Service
 metadata:
  name: redis
  namespace: edu-master
 spec:
  selector:
    app: edu-master-redis
  ports:
    - name: redis
      port: 6379
      targetPort: 6379
@@ -0,0 +1,50 @@
 # One-time Job to migrate redis state from docker compose to k8s (maintenance window).
 # The .example file is not applied by the deploy pipeline (mask *.example.yaml).
 #
 # Runbook:
 #   1. docker compose -f <repo>/edu_master/compose.yaml stop        # SIGTERM -> redis will flush dump.rdb
 #   2. docker run --rm -v edu_master_redis-data:/data \
 #        -v /tmp/edu-master-backup:/backup \
 #        redis:alpine sh -c "cp /data/dump.rdb /backup/ && ls -la /backup"
 #   3. kubectl apply -f edu_master/k8s/namespace.yaml
 #   4. kubectl apply -f <only the PVC from redis.yaml>              # seed must come BEFORE redis pod starts
 #   5. kubectl apply -f edu_master/k8s/restore-seed-job.yaml.example
 #      kubectl wait --for=condition=complete job/redis-restore-seed -n edu-master --timeout=120s
 #   6. kubectl delete job redis-restore-seed -n edu-master
 #   7. kubectl apply -f edu_master/k8s/ -R                           # apply remaining manifests
 apiVersion: batch/v1
 kind: Job
 metadata:
  name: redis-restore-seed
  namespace: edu-master
 spec:
  backoffLimit: 2
  ttlSecondsAfterFinished: 3600
  template:
    spec:
      restartPolicy: Never
      containers:
        - name: seed
          image: redis:alpine
          command:
            - /bin/sh
            - -ec
            - |
              ls -la /backup
              cp /backup/dump.rdb /data/dump.rdb
              chmod 644 /data/dump.rdb
              ls -la /data
          volumeMounts:
            - name: redis-data
              mountPath: /data
            - name: backup
              mountPath: /backup
              readOnly: true
      volumes:
        - name: redis-data
          persistentVolumeClaim:
            claimName: redis-data-pvc
        - name: backup
          hostPath:
            path: /tmp/edu-master-backup
            type: DirectoryOrCreate
@@ -0,0 +1,27 @@
 apiVersion: v1
 kind: Secret
 metadata:
  name: edu-master-secrets
  namespace: edu-master
 type: Opaque
 stringData:
  # Session keeper credentials
  KEEPER_LOGIN: ""
  KEEPER_PASSWORD: ""
  KEEPER_INTERVAL: "10"
  # EDU links
  EDU_URL_BASE: "https://edu.edu.vn.ua"
  EDU_URL_LOGIN: "/user/login"
  EDU_URL_COURSES: "/course/userlist"
  EDU_URL_WEBINAR: "/webinar/useractive"
  # Playwright
  USER_AGENT: ""
  PLAYWRIGHT_WS: "ws://playwright-service:3000/ws"
  # Webinar-checker
  WEBINAR_TELEGRAM_TOKEN: ""
  WEBINAR_ADMIN_ID: ""
  WEBINAR_CHECK_INTERVAL: "60"
  # Database
  REDIS_HOST: "redis"
  REDIS_PORT: "6379"
  TZ: "Europe/Kyiv"
@@ -0,0 +1,52 @@
 apiVersion: apps/v1
 kind: Deployment
 metadata:
  name: session-keeper
  namespace: edu-master
  labels:
    app: edu-master-session-keeper
 spec:
  replicas: 1
  selector:
    matchLabels:
      app: edu-master-session-keeper
  template:
    metadata:
      labels:
        app: edu-master-session-keeper
    spec:
      initContainers:
        - name: wait-redis
          image: redis:8.10.1-alpine
          command:
            - /bin/sh
            - -ec
            - |
              i=0
              until redis-cli -h redis ping | grep -q PONG; do
                i=$((i+1))
                [ "$i" -ge 300 ] && echo "TIMEOUT: redis not ready" && exit 1
                sleep 2
              done
              echo "redis is ready"
      containers:
        - name: session-keeper
          image: gcr.forust.xyz/forust/session-keeper:latest
          imagePullPolicy: Always
          envFrom:
            - secretRef:
                name: edu-master-secrets
          resources:
            requests:
              cpu: 25m
              memory: 96Mi
            limits:
              cpu: 250m
              memory: 256Mi
          readinessProbe:
            exec:
              command: ["/bin/sh", "-ec", "redis-cli -h redis EXISTS EDU_PHPSESSID | grep -q 1"]
            initialDelaySeconds: 15
            periodSeconds: 30
            timeoutSeconds: 5
            failureThreshold: 10
@@ -0,0 +1,62 @@
 apiVersion: apps/v1
 kind: Deployment
 metadata:
  name: webinar-checker
  namespace: edu-master
  labels:
    app: edu-master-webinar-checker
 spec:
  replicas: 1
  selector:
    matchLabels:
      app: edu-master-webinar-checker
  template:
    metadata:
      labels:
        app: edu-master-webinar-checker
    spec:
      # Enforces dependency order like compose depends_on:
      # redis healthy -> session-keeper healthy (EXISTS EDU_PHPSESSID) -> playwright started
      initContainers:
        - name: wait-deps
          image: redis:8.10.1-alpine
          command:
            - /bin/sh
            - -ec
            - |
              i=0
              until redis-cli -h redis ping | grep -q PONG; do
                i=$((i+1))
                [ "$i" -ge 300 ] && echo "TIMEOUT: redis not ready" && exit 1
                sleep 2
              done
              echo "redis ok"
              until [ "$(redis-cli -h redis EXISTS EDU_PHPSESSID)" = "1" ]; do
                i=$((i+1))
                [ "$i" -ge 300 ] && echo "TIMEOUT: no PHPSESSID (session-keeper down?)" && exit 1
                sleep 2
              done
              echo "PHPSESSID ok"
              until nc -z playwright-service 3000; do
                i=$((i+1))
                [ "$i" -ge 300 ] && echo "TIMEOUT: playwright-service not reachable" && exit 1
                sleep 2
              done
              echo "playwright ok"
      containers:
        - name: webinar-checker
          image: gcr.forust.xyz/forust/webinar-checker:latest
          imagePullPolicy: Always
          envFrom:
            - secretRef:
                name: edu-master-secrets
          env:
            - name: TZ
              value: "Europe/Kyiv"
          resources:
            requests:
              cpu: "50m"
              memory: "128Mi"
            limits:
              cpu: "600m"
              memory: "512Mi"
@@ -3,10 +3,10 @@ FROM python:3.11-slim
 WORKDIR /app
 # Install system dependencies
-RUN apt-get update && apt-get install -y redis-tools && rm -rf /var/lib/apt/lists/*
+RUN apt-get update && apt-get install -y --no-install-recommends redis-tools && rm -rf /var/lib/apt/lists/*
 # Install dependencies
-RUN pip install requests redis
+RUN pip install --no-cache-dir requests==2.32.3 redis==5.2.1
 # Copy application code
 COPY . .
@@ -1,17 +1,16 @@
 import logging
 import os
 import time
 import requests
 import logging
 import redis
 from datetime import datetime
 import redis
 import requests
 # Configure logging
-logging.basicConfig(
+logging.basicConfig(level=logging.INFO, format='%(asctime)s - %(levelname)s - %(message)s')
    level=logging.INFO,
    format='%(asctime)s - %(levelname)s - %(message)s'
 )
 logger = logging.getLogger(__name__)
 # Load configuration (adapted to .env keys)
 def _env(key, default=None):
    v = os.getenv(key, default)
@@ -19,21 +18,26 @@ def _env(key, default=None):
        return v[1:-1]
    return v
 LOGIN = _env('KEEPER_LOGIN')
 PASSWORD = _env('KEEPER_PASSWORD')
 EDU_BASE = _env('EDU_URL_BASE', 'https://edu.edu.vn.ua')
 EDU_LOGIN_PATH = _env('EDU_URL_LOGIN', '/user/login')
 EDU_COURSES_PATH = _env('EDU_URL_COURSES', '/course/userlist')
-URL_LOGIN = f"{EDU_BASE.rstrip('/')}/{EDU_LOGIN_PATH.lstrip('/')}"
+URL_LOGIN = f'{EDU_BASE.rstrip("/")}/{EDU_LOGIN_PATH.lstrip("/")}'
-URL_VERIFY = f"{EDU_BASE.rstrip('/')}/{EDU_COURSES_PATH.lstrip('/')}"
+URL_VERIFY = f'{EDU_BASE.rstrip("/")}/{EDU_COURSES_PATH.lstrip("/")}'
 INTERVAL = int(_env('KEEPER_INTERVAL', 10))
-USER_AGENT = _env('USER_AGENT', 'Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36')
+USER_AGENT = _env(
    'USER_AGENT',
    'Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36',
 )
 REDIS_HOST = _env('REDIS_HOST', 'redis')
 REDIS_PORT = int(_env('REDIS_PORT', 6379))
-SUCCESS_FILE = '/tmp/last_success'
+SUCCESS_FILE = '/tmp/last_success'  # noqa: S108
 def touch_success_file():
    """Updates the timestamp of the success file for healthchecks."""
@@ -41,18 +45,19 @@ def touch_success_file():
        with open(SUCCESS_FILE, 'w') as f:
            f.write(str(datetime.now().timestamp()))
    except Exception as e:
-        logger.error(f"Failed to touch success file: {e}")
+        logger.error(f'Failed to touch success file: {e}')
 def main():
-    logger.info("Starting Session Keeper Bot")
+    logger.info('Starting Session Keeper Bot')
    # Connect to Redis
    try:
        redis_client = redis.Redis(host=REDIS_HOST, port=REDIS_PORT, decode_responses=True)
        redis_client.ping()
-        logger.info(f"Connected to Redis at {REDIS_HOST}:{REDIS_PORT}")
+        logger.info(f'Connected to Redis at {REDIS_HOST}:{REDIS_PORT}')
    except Exception as e:
-        logger.error(f"Failed to connect to Redis: {e}")
+        logger.error(f'Failed to connect to Redis: {e}')
        return
    session = requests.Session()
@@ -72,19 +77,16 @@ def main():
        'Sec-Ch-Ua-Mobile': '?0',
        'Sec-Ch-Ua-Platform': '"Linux"',
        'Accept-Encoding': 'gzip, deflate, br',
-        'Priority': 'u=0, i'
+        'Priority': 'u=0, i',
    }
    session.headers.update(headers)
    while True:
        try:
-            logger.info("Attempting login...")
+            logger.info('Attempting login...')
            # Login payload
-            payload = {
+            payload = {'login': LOGIN, 'password': PASSWORD}
                'login': LOGIN,
                'password': PASSWORD
            }
            # Perform Login
            # Note: The user request shows a POST to /user/login with form data
@@ -93,17 +95,17 @@ def main():
            login_response = session.post(URL_LOGIN, data=payload, allow_redirects=True)
-            logger.info(f"Login Response Status: {login_response.status_code}")
+            logger.info(f'Login Response Status: {login_response.status_code}')
-            logger.info(f"Cookies after login: {session.cookies.get_dict()}")
+            logger.info(f'Cookies after login: {session.cookies.get_dict()}')
            # Verify Session
-            logger.info("Verifying session...")
+            logger.info('Verifying session...')
            verify_response = session.get(URL_VERIFY, allow_redirects=False)
-            logger.info(f"Verify Response Status: {verify_response.status_code}")
+            logger.info(f'Verify Response Status: {verify_response.status_code}')
            if verify_response.status_code == 200:
-                logger.info("Session verification SUCCESS (200 OK).")
+                logger.info('Session verification SUCCESS (200 OK).')
                touch_success_file()
                # Save PHPSESSID to Redis
@@ -111,19 +113,20 @@ def main():
                if phpsessid:
                    try:
                        redis_client.set('EDU_PHPSESSID', phpsessid)
-                        logger.info(f"Saved PHPSESSID to Redis: {phpsessid}")
+                        logger.info(f'Saved PHPSESSID to Redis: {phpsessid}')
                    except Exception as e:
-                        logger.error(f"Failed to save PHPSESSID to Redis: {e}")
+                        logger.error(f'Failed to save PHPSESSID to Redis: {e}')
            elif verify_response.status_code == 302:
-                logger.warning("Session verification FAILED (302 Redirect). Session might be invalid.")
+                logger.warning('Session verification FAILED (302 Redirect). Session might be invalid.')
            else:
-                logger.warning(f"Session verification returned unexpected status: {verify_response.status_code}")
+                logger.warning(f'Session verification returned unexpected status: {verify_response.status_code}')
        except Exception as e:
-            logger.error(f"An error occurred: {e}")
+            logger.error(f'An error occurred: {e}')
-        logger.info(f"Sleeping for {INTERVAL} minutes...")
+        logger.info(f'Sleeping for {INTERVAL} minutes...')
        time.sleep(INTERVAL * 60)
-if __name__ == "__main__":
+
 if __name__ == '__main__':
    main()
@@ -3,7 +3,7 @@ FROM python:3.11-slim
 WORKDIR /app
 # Install dependencies
-RUN pip install --upgrade pip && pip install playwright==1.56.0 redis requests "python-telegram-bot[job-queue]"
+RUN pip install --no-cache-dir pip==25.0.1 && pip install --no-cache-dir playwright==1.56.0 redis==5.2.1 requests==2.32.3 "python-telegram-bot[job-queue]==21.10"
 COPY checker.py .
@@ -1,6 +1,6 @@
 services:
  server:
-    image: docker.gitea.com/gitea:1.26
+    image: docker.gitea.com/gitea:1.27.3
    container_name: gitea
    restart: always
    environment:
@@ -61,7 +61,7 @@ services:
    depends_on:
      - db
  db:
-    image: docker.io/library/postgres:14
+    image: docker.io/library/postgres:14.24-alpine
    restart: always
    environment:
      - POSTGRES_USER=gitea
@@ -16,5 +16,7 @@ data:
  GITEA__security__REVERSE_PROXY_TRUSTED_PROXIES: "*"
  GITEA__mailer__ENABLED: "false"
  GITEA__log__logger__access__MODE: "console, file"
  USER_UID: "1000"
  USER_GID: "1000"
@@ -31,7 +31,7 @@ spec:
    spec:
      containers:
        - name: gitea
-          image: docker.gitea.com/gitea:1.26
+          image: docker.gitea.com/gitea:1.27.3
          envFrom:
            - configMapRef:
                name: gitea-config
@@ -10,7 +10,16 @@ spec:
    - match: Host(`gitea.forust.xyz`)
      kind: Rule
      middlewares:
-        - name: "crowdsec-crowdsec-bouncer@kubernetescrd"
+        - name: crowdsec-bouncer
          namespace: crowdsec
      services:
        - name: gitea-service
          port: 3000
    - match: Host(`gcr.forust.xyz`) && PathPrefix(`/v2`)
      kind: Rule
      middlewares:
        - name: crowdsec-bouncer
          namespace: crowdsec
      services:
        - name: gitea-service
          port: 3000
@@ -31,23 +40,11 @@ spec:
      services:
        - name: gitea-service
          port: 3000
---
+    - match: (Host(`gcr.workstation.internal`) || Host(`gcr.gigaforust.internal`)) && PathPrefix(`/v2`)
 apiVersion: traefik.io/v1alpha1
 kind: IngressRoute
 metadata:
  name: gitea-registry
  namespace: gitea
 spec:
  entryPoints:
    - websecure
  routes:
    - match: Host(`gcr.forust.xyz`) && PathPrefix(`/v2`)
      kind: Rule
      services:
        - name: gitea-service
          port: 3000
  tls:
    certResolver: letsencrypt
 ---
 apiVersion: traefik.io/v1alpha1
 kind: IngressRouteTCP
@@ -29,7 +29,7 @@ spec:
    spec:
      containers:
        - name: gitea-postgres
-          image: postgres:14
+          image: postgres:14.24-alpine
          env:
            - name: POSTGRES_USER
              valueFrom:
@@ -45,7 +45,7 @@ spec:
              valueFrom:
                secretKeyRef:
                  name: gitea-secrets
-                  key: GITEA__database__USER
+                  key: GITEA__database__NAME
          ports:
            - containerPort: 5432
              name: postgres
@@ -7,3 +7,4 @@ type: Opaque
 stringData:
  GITEA__database__USER: "gitea"
  GITEA__database__PASSWD: "gitea"
  GITEA__database__NAME: "gitea"
@@ -1,7 +1,7 @@
 services:
  glance:
    container_name: glance
-    image: glanceapp/glance
+    image: glanceapp/glance:v0.8.6
    restart: unless-stopped
    volumes:
      - ./config:/app/config:ro
@@ -27,7 +27,7 @@ spec:
    spec:
      containers:
        - name: glance
-          image: glanceapp/glance
+          image: glanceapp/glance:v0.8.6
          envFrom:
            - secretRef:
                name: glance-secrets
@@ -56,11 +56,11 @@ spec:
              readOnly: true
          resources:
            requests:
              memory: "30Mi"
              cpu: "20m"
            limits:
              memory: "100Mi"
              cpu: "50m"
              memory: "64Mi"
            limits:
              cpu: "200m"
              memory: "256Mi"
      volumes:
        - name: glance-config
          configMap:
@@ -1,6 +1,6 @@
 services:
  headscale:
-    image: headscale/headscale:latest
+    image: headscale/headscale:0.29.3
    restart: unless-stopped
    container_name: headscale-server
    command: serve
@@ -53,7 +53,7 @@ services:
      - "traefik.http.routers.headscale-metrics-dev.service=headscale-metrics"
      - "traefik.http.routers.headscale-metrics-dev.tls=true"
  headplane:
-    image: ghcr.io/tale/headplane:latest
+    image: ghcr.io/tale/headplane:0.7.1
    container_name: headplane
    restart: unless-stopped
    ports:
@@ -65,8 +65,42 @@ services:
      - /var/run/docker.sock:/var/run/docker.sock:ro
    networks:
      - proxy
    labels:
      - "traefik.enable=true"
      - "traefik.http.services.headplane.loadbalancer.server.port=3000"
      # Middleware: add /admin prefix for root requests
      - "traefik.http.middlewares.headplane-prefix.addPrefix.prefix=/admin"
      # Prod Root Router
      - "traefik.http.routers.headplane-root.rule=Host(`hp.forust.xyz`)"
      - "traefik.http.routers.headplane-root.entrypoints=websecure"
      - "traefik.http.routers.headplane-root.middlewares=headplane-prefix"
      - "traefik.http.routers.headplane-root.tls.certresolver=letsencrypt"
      # Prod Router
      - "traefik.http.routers.headplane.rule=Host(`hp.forust.xyz`) && PathPrefix(`/admin`)"
      - "traefik.http.routers.headplane.entrypoints=websecure"
      - "traefik.http.routers.headplane.tls.certresolver=letsencrypt"
      # Local Root Router
      - "traefik.http.routers.headplane-root-local.rule=Host(`hp.workstation.internal`)"
      - "traefik.http.routers.headplane-root-local.entrypoints=websecure"
      - "traefik.http.routers.headplane-root-local.middlewares=headplane-prefix"
      - "traefik.http.routers.headplane-root-local.tls=true"
      # Local Router
      - "traefik.http.routers.headplane-local.rule=Host(`hp.workstation.internal`) && PathPrefix(`/admin`)"
      - "traefik.http.routers.headplane-local.entrypoints=websecure"
      - "traefik.http.routers.headplane-local.tls=true"
      # Dev Root Router
      - "traefik.http.routers.headplane-root-dev.rule=Host(`hp.gigaforust.internal`)"
      - "traefik.http.routers.headplane-root-dev.entrypoints=websecure"
      - "traefik.http.routers.headplane-root-dev.middlewares=headplane-prefix"
      - "traefik.http.routers.headplane-root-dev.tls=true"
      # Dev Router
      - "traefik.http.routers.headplane-dev.rule=Host(`hp.gigaforust.internal`) && PathPrefix(`/admin`)"
      - "traefik.http.routers.headplane-dev.entrypoints=websecure"
      - "traefik.http.routers.headplane-dev.tls=true"
  web:
-    image: goodieshq/headscale-admin:latest
+    image: goodieshq/headscale-admin:0.28.0
    restart: unless-stopped
    ports:
      - 10080:80
@@ -1,26 +1,20 @@
 {
  "groups": {
-        "group:admin": [
+    "group:admin": ["admin@"],
            "admin@"
        ],
    "group:users": []
  },
  "tagOwners": {},
  "hosts": {},
  "acls": [
-{
+    {
      "randomizeClientPort": false,
      "#ha-meta": {
        "name": "users",
        "open": true
      },
      "action": "accept",
-            "src": [
+      "src": ["autogroup:member"],
-                "autogroup:member"
+      "dst": ["autogroup:self:*"]
            ],
            "dst": [
                "autogroup:self:*"
            ]
    }
  ],
  "ssh": []
@@ -57,3 +57,30 @@ ports:
 endpoints:
  - addresses:
      - "192.168.88.100"
 ---
 apiVersion: v1
 kind: Service
 metadata:
  name: headplane-external
  namespace: headscale
 spec:
  ports:
    - port: 3000
      targetPort: 13000
      name: http
 ---
 apiVersion: discovery.k8s.io/v1
 kind: EndpointSlice
 metadata:
  name: headplane-external
  namespace: headscale
  labels:
    kubernetes.io/service-name: headplane-external
 addressType: IPv4
 ports:
  - port: 13000
    protocol: TCP
    name: http
 endpoints:
  - addresses:
      - "192.168.88.100"
@@ -1,7 +1,16 @@
 apiVersion: traefik.io/v1alpha1
 kind: Middleware
 metadata:
  name: headplane-prefix
  namespace: headscale
 spec:
  addPrefix:
    prefix: "/admin"
 ---
 apiVersion: traefik.io/v1alpha1
 kind: IngressRoute
 metadata:
-  name: headscale-server-prod
+  name: headscale-prod
  namespace: headscale
 spec:
  entryPoints:
@@ -9,18 +18,58 @@ spec:
  routes:
    - match: Host(`hs.forust.xyz`)
      kind: Rule
      middlewares:
        - name: crowdsec-crowdsec-bouncer@kubernetescrd
      services:
        - name: headscale-server-external
          port: 8080
    - match: Host(`hs.forust.xyz`) && PathPrefix(`/admin`)
      kind: Rule
      middlewares:
        - name: crowdsec-bouncer
          namespace: crowdsec
      services:
        - name: headscale-ui-external
          port: 80
    - match: Host(`hs.forust.xyz`) && PathPrefix(`/metrics`)
      kind: Rule
      middlewares:
        - name: crowdsec-bouncer
          namespace: crowdsec
      services:
        - name: headscale-server-external
          port: 9090
  tls:
    certResolver: letsencrypt
 ---
 apiVersion: traefik.io/v1alpha1
 kind: IngressRoute
 metadata:
-  name: headscale-server-local
+  name: headplane-prod
  namespace: headscale
 spec:
  entryPoints:
    - websecure
  routes:
    - match: Host(`hp.forust.xyz`)
      kind: Rule
      middlewares:
        - name: headplane-prefix
        - name: crowdsec-bouncer
          namespace: crowdsec
      services:
        - name: headplane-external
          port: 3000
    - match: Host(`hp.forust.xyz`) && PathPrefix(`/admin`)
      kind: Rule
      services:
        - name: headplane-external
          port: 3000
  tls:
    certResolver: letsencrypt
 ---
 apiVersion: traefik.io/v1alpha1
 kind: IngressRoute
 metadata:
  name: headscale-local
  namespace: headscale
 spec:
  entryPoints:
@@ -31,76 +80,33 @@ spec:
      services:
        - name: headscale-server-external
          port: 8080
-
+    - match: (Host(`hs.workstation.internal`) || Host(`hs.gigaforust.internal`)) && PathPrefix(`/admin`)
 ---
 apiVersion: traefik.io/v1alpha1
 kind: IngressRoute
 metadata:
  name: headscale-ui-prod
  namespace: headscale
 spec:
  entryPoints:
    - websecure
  routes:
    - match: Host(`hs.forust.xyz`) && PathPrefix(`/admin`)
      kind: Rule
      middlewares:
        - name: crowdsec-crowdsec-bouncer@kubernetescrd
        - name: security-chain@file
      services:
        - name: headscale-ui-external
          port: 80
  tls:
    certResolver: letsencrypt
 ---
 apiVersion: traefik.io/v1alpha1
 kind: IngressRoute
 metadata:
  name: headscale-ui-local
  namespace: headscale
 spec:
  entryPoints:
    - websecure
  routes:
    - match: HostRegexp(`^hs\.(workstation|gigaforust)\.internal$`) && PathPrefix(`/admin`)
      kind: Rule
      services:
        - name: headscale-ui-external
          port: 80
-
+    - match: (Host(`hs.workstation.internal`) || Host(`hs.gigaforust.internal`)) && PathPrefix(`/metrics`)
      kind: Rule
      services:
        - name: headscale-server-external
          port: 9090
 ---
 apiVersion: traefik.io/v1alpha1
 kind: IngressRoute
 metadata:
-  name: headscale-metrics-prod
+  name: headplane-local
  namespace: headscale
 spec:
  entryPoints:
    - websecure
  routes:
-    - match: Host(`hs.forust.xyz`) && PathPrefix(`/metrics`)
+    - match: Host(`hp.workstation.internal`) || Host(`hp.gigaforust.internal`)
      kind: Rule
      middlewares:
-        - name: crowdsec-crowdsec-bouncer@kubernetescrd
+        - name: headplane-prefix
      services:
-        - name: headscale-server-external
+        - name: headplane-external
-          port: 9090
+          port: 3000
-  tls:
+    - match: (Host(`hp.workstation.internal`) || Host(`hp.gigaforust.internal`)) && PathPrefix(`/admin`)
    certResolver: letsencrypt
    domains:
      - main: hs.forust.xyz
 ---
 apiVersion: traefik.io/v1alpha1
 kind: IngressRoute
 metadata:
  name: headscale-metrics-local
  namespace: headscale
 spec:
  entryPoints:
    - websecure
  routes:
    - match: HostRegexp(`^hs\.(workstation|gigaforust)\.internal$`) && PathPrefix(`/metrics`)
      kind: Rule
      services:
-        - name: headscale-server-external
+        - name: headplane-external
-          port: 9090
+          port: 3000
@@ -1,28 +1,26 @@
-<!DOCTYPE html>
+<!doctype html>
 <html lang="en">
-
+  <head>
-<head>
+    <meta charset="UTF-8" />
-    <meta charset="UTF-8">
+    <meta name="viewport" content="width=device-width, initial-scale=1.0" />
    <meta name="viewport" content="width=device-width, initial-scale=1.0">
    <title>MrForust // XRock</title>
    <script src="https://kit.fontawesome.com/a076d05399.js" crossorigin="anonymous"></script>
-    <link rel="stylesheet" href="https://cdnjs.cloudflare.com/ajax/libs/font-awesome/6.4.0/css/all.min.css">
+    <link rel="stylesheet" href="https://cdnjs.cloudflare.com/ajax/libs/font-awesome/6.4.0/css/all.min.css" />
-    <link rel="stylesheet" href="assets/css/style.css">
+    <link rel="stylesheet" href="assets/css/style.css" />
-</head>
+  </head>
 <body>
  <body>
    <div class="container">
      <header>
        <h1 class="glitch" data-text="MrForust">Mr-Forust</h1>
        <p class="subtitle">> CTF Player / XRock_Team / Just Signal.</p>
      </header>
-        <hr>
+      <hr />
      <div class="grid-2">
-            <section id="socials">
+        <section id="contacts">
-                <h2>./socials</h2>
+          <h2>./contacts</h2>
          <ul class="link-list">
            <li>
              <i class="fab fa-github"></i>
@@ -60,14 +58,17 @@
            <li>
              <i class="fa fa-pie-chart"></i>
              <a href="https://forust.xyz/glance" target="_blank">forust/dashboard</a>
              <p class="comment"># Glance dashboard</p>
            </li>
            <li>
              <i class="fa fa-refresh"></i>
              <a href="https://forust.xyz/convert" target="_blank">forust/converter</a>
              <p class="comment"># ConvertX instance</p>
            </li>
            <li>
              <i class="fa-solid fa-file-pdf"></i>
              <a href="https://pdf.forust.xyz" target="_blank">pdf.forust.xyz</a>
              <p class="comment"># BentoPDF instance</p>
            </li>
          </ul>
        </section>
@@ -81,44 +82,23 @@
              <span>ArchLinux # btw</span>
              <span class="level">[#######...]</span>
            </div>
            <div class="skill-item"><span>Kubernetes</span> <span class="level">[###.......]</span></div>
            <div class="skill-item"><span>Docker</span> <span class="level">[####......]</span></div>
            <div class="skill-item">
-                        <span>Kubernetes</span> <span class="level">[###.......]</span>
+              <span>Docker Compose</span>
-                    </div>
+              <span class="level">[#####.....]</span>
                    <div class="skill-item">
                        <span>Docker</span> <span class="level">[####......]</span>
                    </div>
                    <div class="skill-item">
                        <span>Docker Compose</span> <span class="level">[#####.....]</span>
                    </div>
                    <div class="skill-item">
                        <span>Web Pentest</span> <span class="level">[#####.....]</span>
                    </div>
                    <div class="skill-item">
                        <span>Burpsuite</span> <span class="level">[#####.....]</span>
                    </div>
                    <div class="skill-item">
                        <span>Steganography</span> <span class="level">[####......]</span>
            </div>
            <div class="skill-item"><span>Web Pentest</span> <span class="level">[#####.....]</span></div>
            <div class="skill-item"><span>Burpsuite</span> <span class="level">[#####.....]</span></div>
            <div class="skill-item"><span>Steganography</span> <span class="level">[####......]</span></div>
          </div>
          <div>
-                    <div class="skill-item">
+            <div class="skill-item"><span>Cryptography</span> <span class="level">[####......]</span></div>
-                        <span>Cryptography</span> <span class="level">[####......]</span>
+            <div class="skill-item"><span>OSINT</span> <span class="level">[####......]</span></div>
-                    </div>
+            <div class="skill-item"><span>Python</span> <span class="level">[###.......]</span></div>
-                    <div class="skill-item">
+            <div class="skill-item"><span>HTML</span> <span class="level">[###.......]</span></div>
-                        <span>OSINT</span> <span class="level">[####......]</span>
+            <div class="skill-item"><span>Bash</span> <span class="level">[##........]</span></div>
-                    </div>
+            <div class="skill-item"><span>Golang</span> <span class="level">[#.........]</span></div>
                    <div class="skill-item">
                        <span>Python</span> <span class="level">[###.......]</span>
                    </div>
                    <div class="skill-item">
                        <span>HTML</span> <span class="level">[###.......]</span>
                    </div>
                    <div class="skill-item">
                        <span>Bash</span> <span class="level">[##........]</span>
                    </div>
                    <div class="skill-item">
                        <span>Golang</span> <span class="level">[#.........]</span>
                    </div>
          </div>
        </div>
      </section>
@@ -129,42 +109,77 @@
        <div class="team-grid">
          <div class="member">
-                    <div class="avatar"
+            <div
-                        style="background-image: url('assets/images/team/mrforust.jpg'); background-size: cover; background-position: center;">
+              class="avatar"
-                    </div>
+              style="
                background-image: url(&quot;assets/images/team/mrforust.jpg&quot;);
                background-size: cover;
                background-position: center;
              "
            ></div>
            <a href="https://github.com/mr-forust" target="_blank">MrForust</a>
          </div>
          <div class="member">
-                    <div class="avatar"
+            <div
-                        style="background-image: url('assets/images/team/anna.jpg'); background-size: cover; background-position: center;">
+              class="avatar"
-                    </div>
+              style="
                background-image: url(&quot;assets/images/team/anna.jpg&quot;);
                background-size: cover;
                background-position: center;
              "
            ></div>
            <a href="./assets/images/love.png" target="_blank">Anna~</a>
          </div>
          <div class="member">
-                    <div class="avatar"
+            <div
-                        style="background-image: url('assets/images/team/chernuha.jpg'); background-size: cover; background-position: center;">
+              class="avatar"
-                    </div>
+              style="
                background-image: url(&quot;assets/images/team/chernuha.jpg&quot;);
                background-size: cover;
                background-position: center;
              "
            ></div>
            <a href="https://chernuha.space" target="_blank">Chernuha</a>
          </div>
          <div class="member">
-                    <div class="avatar"
+            <div
-                        style="background-image: url('assets/images/team/hudan.jpg'); background-size: cover; background-position: center;">
+              class="avatar"
-                    </div>
+              style="
                background-image: url(&quot;assets/images/team/hudan.jpg&quot;);
                background-size: cover;
                background-position: center;
              "
            ></div>
            <a href="https://hudan.xyz" target="_blank">p1ngvi</a>
          </div>
          <div class="member">
-                    <div class="avatar"
+            <div
-                        style="background-image: url('assets/images/team/xdfnx.jpg'); background-size: cover; background-position: center;">
+              class="avatar"
-                    </div>
+              style="
                background-image: url(&quot;assets/images/team/xdfnx.jpg&quot;);
                background-size: cover;
                background-position: center;
              "
            ></div>
            <a href="https://xdfnx.cfd" target="_blank">xdfnx</a>
          </div>
        </div>
      </section>
      <section id="projects">
        <h2>./projects</h2>
        <ul class="repo-list">
          <li>
            <a href="https://gitea.forust.xyz/forust/gosleep" target="_blank">forust/gosleep</a>
            <span class="comment">// linux sleep timer written in rust (originally in go)</span>
          </li>
        </ul>
      </section>
      <section id="repos">
        <h2>./favorite_repos</h2>
        <ul class="repo-list">
@@ -206,7 +221,5 @@
        <p>&copy; XRock - Just Signal.</p>
      </footer>
    </div>
-
+  </body>
 </body>
 </html>
@@ -10,7 +10,8 @@ spec:
    - match: Host(`forust.xyz`) || Host(`www.forust.xyz`)
      kind: Rule
      middlewares:
-        - name: crowdsec-crowdsec-bouncer@kubernetescrd
+        - name: crowdsec-bouncer
          namespace: crowdsec
      priority: 10
      services:
        - name: forust-homepage-service
@@ -43,10 +44,11 @@ spec:
  entryPoints:
    - websecure
  routes:
-    - match: Host(`xdfnx.cfd`) || Host(`www.xdfnx.cfd`)
+    - match: Host(`xdfnx.cfd`)
      kind: Rule
      middlewares:
-        - name: crowdsec-crowdsec-bouncer@kubernetescrd
+        - name: crowdsec-bouncer
          namespace: crowdsec
      services:
        - name: xdfnx-homepage-service
          port: 80
@@ -1,6 +1,6 @@
 services:
  kener:
-    image: rajnandan1/kener:4.0.23
+    image: rajnandan1/kener:4.1.5
    container_name: kener
    restart: unless-stopped
    # ports:
@@ -36,7 +36,7 @@ services:
      - proxy
      - kener
  redis:
-    image: redis:7-alpine
+    image: redis:8.10.1-alpine
    container_name: kener-redis
    restart: unless-stopped
    volumes:
@@ -10,7 +10,8 @@ spec:
    - match: Host(`status.forust.xyz`)
      kind: Rule
      middlewares:
-        - name: crowdsec-crowdsec-bouncer@kubernetescrd
+        - name: crowdsec-bouncer
          namespace: crowdsec
      services:
        - name: kener-service
          port: 3000
@@ -27,7 +27,7 @@ spec:
    spec:
      containers:
        - name: kener
-          image: rajnandan1/kener:4.1.0
+          image: rajnandan1/kener:4.1.5
          envFrom:
            - configMapRef:
                name: kener-config
@@ -30,7 +30,7 @@ spec:
    spec:
      containers:
        - name: redis
-          image: redis:7-alpine
+          image: redis:8.10.1-alpine
          ports:
            - containerPort: 6379
          volumeMounts:
@@ -1,6 +1,6 @@
 services:
  metube:
-    image: ghcr.io/alexta69/metube
+    image: ghcr.io/alexta69/metube:2026.08.28
    container_name: metube
    restart: unless-stopped
    # ports:
@@ -27,7 +27,7 @@ spec:
    spec:
      containers:
        - name: metube
-          image: ghcr.io/alexta69/metube
+          image: ghcr.io/alexta69/metube:2026.08.28
          envFrom:
            - configMapRef:
                name: metube-config
@@ -1,6 +1,6 @@
 services:
  n8n:
-    image: docker.n8n.io/n8nio/n8n
+    image: docker.n8n.io/n8nio/n8n:2.39.5
    container_name: n8n
    restart: unless-stopped
    environment:
@@ -10,7 +10,8 @@ spec:
    - match: Host(`n8n.forust.xyz`)
      kind: Rule
      middlewares:
-        - name: "crowdsec-crowdsec-bouncer@kubernetescrd"
+        - name: crowdsec-bouncer
          namespace: crowdsec
      services:
        - name: n8n-service
          port: 5678
@@ -27,7 +27,7 @@ spec:
    spec:
      containers:
        - name: n8n
-          image: docker.n8n.io/n8nio/n8n
+          image: docker.n8n.io/n8nio/n8n:2.39.5
          envFrom:
            - configMapRef:
                name: n8n-config
@@ -1,6 +1,6 @@
 services:
  netronome:
-    image: ghcr.io/autobrr/netronome:latest
+    image: ghcr.io/autobrr/netronome:v0.14.0
    restart: unless-stopped
    container_name: netronome
    ports:
@@ -33,7 +33,7 @@ services:
        condition: service_healthy
  postgres:
    container_name: netronome-postgres
-    image: postgres:17-alpine
+    image: postgres:17.11-alpine
    environment:
      - POSTGRES_USER=netronome
      - POSTGRES_PASSWORD=netronome
@@ -10,7 +10,8 @@ spec:
    - match: Host(`nm.forust.xyz`)
      kind: Rule
      middlewares:
-        - name: "crowdsec-crowdsec-bouncer@kubernetescrd"
+        - name: crowdsec-bouncer
          namespace: crowdsec
      services:
        - name: netronome-service
          port: 7575
@@ -30,7 +30,7 @@ spec:
    spec:
      containers:
        - name: netronome
-          image: ghcr.io/autobrr/netronome:latest
+          image: ghcr.io/autobrr/netronome:v0.14.0
          ports:
            - name: netronome-port
              protocol: TCP
@@ -29,7 +29,7 @@ spec:
    spec:
      containers:
        - name: netronome-postgres
-          image: postgres:17-alpine
+          image: postgres:17.11-alpine
          ports:
            - name: postgres-port
              protocol: TCP
@@ -12,7 +12,8 @@ spec:
      kind: Rule
      middlewares:
        - name: nextcloud-chain@file
-        - name: crowdsec-crowdsec-bouncer@kubernetescrd
+        - name: crowdsec-bouncer
          namespace: crowdsec
      services:
        - name: nextcloud-apache
          port: 11000
@@ -31,7 +32,8 @@ spec:
    - match: Host(`nextcloud.workstation.internal`) || Host(`nextcloud.gigaforust.internal`)
      kind: Rule
      middlewares:
-        - name: "crowdsec-crowdsec-bouncer@kubernetescrd"
+        - name: crowdsec-bouncer
          namespace: crowdsec
        - name: nextcloud-chain@file
      services:
        - name: nextcloud-apache
@@ -84,7 +84,7 @@ services:
  #     - "443:443"
  penpot-frontend:
-    image: "penpotapp/frontend:${PENPOT_VERSION:-latest}"
+    image: "penpotapp/frontend:${PENPOT_VERSION:-2.17.2}"
    restart: always
    # ports:
    #   - 9001:8080
@@ -119,7 +119,7 @@ services:
    environment:
      <<: [*penpot-flags, *penpot-http-body-size]
  penpot-backend:
-    image: "penpotapp/backend:${PENPOT_VERSION:-latest}"
+    image: "penpotapp/backend:${PENPOT_VERSION:-2.17.2}"
    restart: always
    volumes:
@@ -189,7 +189,7 @@ services:
      # PENPOT_SMTP_SSL: false
  penpot-exporter:
-    image: "penpotapp/exporter:${PENPOT_VERSION:-latest}"
+    image: "penpotapp/exporter:${PENPOT_VERSION:-2.17.2}"
    restart: always
    depends_on:
@@ -209,7 +209,7 @@ services:
      PENPOT_REDIS_URI: redis://penpot-valkey/0
  penpot-postgres:
-    image: "postgres:15"
+    image: "postgres:15.19-alpine"
    restart: always
    stop_signal: SIGINT
@@ -233,7 +233,7 @@ services:
      - POSTGRES_PASSWORD=penpot
  penpot-valkey:
-    image: valkey/valkey:8.1
+    image: valkey/valkey:9.1.2
    restart: always
    healthcheck:
@@ -1,6 +1,6 @@
 services:
  portainer:
-    image: portainer/portainer-ce:2.41.0
+    image: portainer/portainer-ce:2.45.0
    container_name: portainer
    restart: always
    volumes:
@@ -10,7 +10,8 @@ spec:
    - match: Host(`portainer.forust.xyz`)
      kind: Rule
      middlewares:
-        - name: "crowdsec-crowdsec-bouncer@kubernetescrd"
+        - name: crowdsec-bouncer
          namespace: crowdsec
      services:
        - name: portainer-service
          port: 9000
@@ -27,7 +27,7 @@ spec:
    spec:
      containers:
        - name: portainer
-          image: portainer/portainer-ce:2.41.0
+          image: portainer/portainer-ce:2.45.0
          ports:
            - containerPort: 9000
          volumeMounts:
@@ -1,6 +1,6 @@
 services:
  grafana:
-    image: grafana/grafana:11.6.0
+    image: grafana/grafana:13.2.1
    container_name: prometheus-grafana
    restart: unless-stopped
    env_file:
@@ -30,7 +30,7 @@ services:
      - proxy
  prometheus:
-    image: prom/prometheus:v3.2.1
+    image: prom/prometheus:v3.14.0
    container_name: prometheus-prometheus
    restart: unless-stopped
    command:
@@ -44,7 +44,7 @@ services:
      - proxy
  alertmanager:
-    image: prom/alertmanager:v0.28.1
+    image: prom/alertmanager:v0.34.0
    container_name: prometheus-alertmanager
    restart: unless-stopped
    command: