chore(deps): update renovate/renovate docker tag to v44.115.4

.gitignore

@@ -21,9 +21,6 @@ checkmk/checkmk/*
 downtify/Downtify_downloads
 headscale/config/*
 headscale/data/*
-# NetBird local hostnames and generated secrets
-netbird/.env
-netbird/secrets/
 searxng/core-config/*
 
 # Steaming services files

cloudflared/k8s/deployment.yaml

@@ -16,7 +16,7 @@ spec:
     spec:
       containers:
         - name: cloudflared
-          image: cloudflare/cloudflared:2026.9.3
+          image: cloudflare/cloudflared:2026.9.1
           imagePullPolicy: IfNotPresent
           args:
             - tunnel

edu_master/compose.yaml

@@ -1,6 +1,6 @@
 services:
   redis:
-    image: redis:8.10.2-alpine
+    image: redis:8.10.1-alpine
     restart: unless-stopped
     volumes:
       - redis-data:/data

edu_master/k8s/redis.yaml

@@ -18,7 +18,7 @@ spec:
     spec:
       containers:
         - name: redis
-          image: redis:8.10.2-alpine
+          image: redis:8.10.1-alpine
           imagePullPolicy: IfNotPresent
           ports:
             - containerPort: 6379

edu_master/k8s/session-keeper.yaml

@@ -17,7 +17,7 @@ spec:
     spec:
       initContainers:
         - name: wait-redis
-          image: redis:8.10.2-alpine
+          image: redis:8.10.1-alpine
           command:
             - /bin/sh
             - -ec

edu_master/k8s/webinar-checker.yaml

@@ -19,7 +19,7 @@ spec:
       # redis healthy -> session-keeper healthy (EXISTS EDU_PHPSESSID) -> playwright started
       initContainers:
         - name: wait-deps
-          image: redis:8.10.2-alpine
+          image: redis:8.10.1-alpine
           command:
             - /bin/sh
             - -ec

headscale/compose.yaml

@@ -1,6 +1,6 @@
 services:
   headscale:
-    image: headscale/headscale:v0.29.4
+    image: headscale/headscale:0.29.3
     restart: unless-stopped
     container_name: headscale-server
     command: serve

kener/compose.yaml

@@ -36,7 +36,7 @@ services:
       - proxy
       - kener
   redis:
-    image: redis:8.10.2-alpine
+    image: redis:8.10.1-alpine
     container_name: kener-redis
     restart: unless-stopped
     volumes:

kener/k8s/redis.yaml

@@ -30,7 +30,7 @@ spec:
     spec:
       containers:
         - name: redis
-          image: redis:8.10.2-alpine
+          image: redis:8.10.1-alpine
           ports:
             - containerPort: 6379
           volumeMounts:

metube/compose.yaml

@@ -1,6 +1,6 @@
 services:
   metube:
-    image: ghcr.io/alexta69/metube:2026.09.25
+    image: ghcr.io/alexta69/metube:2026.09.15
     container_name: metube
     restart: unless-stopped
     # ports:

metube/k8s/metube.yaml

@@ -27,7 +27,7 @@ spec:
     spec:
       containers:
         - name: metube
-          image: ghcr.io/alexta69/metube:2026.09.25
+          image: ghcr.io/alexta69/metube:2026.09.15
           envFrom:
             - configMapRef:
                 name: metube-config

n8n/compose.yaml

@@ -1,6 +1,6 @@
 services:
   n8n:
-    image: docker.n8n.io/n8nio/n8n:2.41.3
+    image: docker.n8n.io/n8nio/n8n:2.41.0
     container_name: n8n
     restart: unless-stopped
     environment:

n8n/k8s/n8n.yaml

@@ -27,7 +27,7 @@ spec:
     spec:
       containers:
         - name: n8n
-          image: docker.n8n.io/n8nio/n8n:2.41.3
+          image: docker.n8n.io/n8nio/n8n:2.41.0
           envFrom:
             - configMapRef:
                 name: n8n-config

netbird/.env.example

@@ -1,13 +0,0 @@
-# Public hostname advertised to NetBird clients and used for TLS/OAuth.
-NETBIRD_DOMAIN=nb.forust.xyz
-
-# Internal-only aliases routed by the existing Traefik instance.
-NETBIRD_LOCAL_DOMAIN=netbird.workstation.internal
-NETBIRD_DEV_DOMAIN=netbird.gigaforust.internal
-
-NETBIRD_PROXY_SUBNET=auto
-
-NETBIRD_CLIENT_HOSTNAME=hostname
-
-# Add a dashboard-generated setup key before starting client.compose.yaml.
-# NB_SETUP_KEY=

netbird/README.md

@@ -1,123 +0,0 @@
-# NetBird
-
-Self-hosted NetBird with the combined management, signal, relay, and STUN server. The dashboard and server run behind the repository's existing external Traefik instance on the Docker `proxy` network. Only STUN UDP `3478` is published directly.
-
-The deployment uses SQLite for a single-instance homelab server. The persistent `netbird_data` volume and the datastore encryption key are both required to recover the installation.
-
-## Files
-
-- `compose.yaml`: dashboard and combined server; selected by the marker-driven deploy workflow through `active`.
-- `config.template.yaml`: non-secret server configuration rendered at startup.
-- `entrypoint.sh`: injects Docker secrets into an in-memory runtime configuration.
-- `client.compose.yaml`: optional host-network peer using a dashboard-generated setup key.
-- `.env`: ignored local hostnames, the detected Traefik Docker-network subnet, and optional client setup key.
-- `secrets/`: ignored relay secret and datastore encryption key.
-
-## First deployment
-
-Run these commands on the Docker host before merging the activating branch. The deploy preflight resets tracked files but preserves ignored local state.
-
-```bash
-cd /srv/homelab/netbird
-./setup.sh
-$EDITOR .env
-docker compose config --quiet
-docker compose up -d
-```
-
-Review the values in `.env` before starting. The example public hostname is `netbird.forust.xyz`; change it if a different public domain was selected. `setup.sh` replaces `NETBIRD_PROXY_SUBNET=auto` with the first IPv4 subnet of the external Docker `proxy` network. Keep that value synchronized with the network; set an explicit CIDR instead if the network is managed elsewhere.
-
-`setup.sh` is idempotent and never replaces existing secrets. Do not delete or regenerate `secrets/datastore-encryption-key` after the first successful start unless all encrypted setup keys and API tokens are intentionally being invalidated.
-
-## Network prerequisites
-
-- Point the public hostname directly to the Docker host. Do not proxy UDP `3478` through Cloudflare or another CDN.
-- Allow inbound TCP `80`, TCP `443`, and UDP `3478` through the host firewall and upstream router.
-- Ensure the external `proxy` Docker network exists and Traefik uses its `websecure` entrypoint and `letsencrypt` resolver. `NETBIRD_PROXY_SUBNET` must describe that network; it is used to trust only forwarded client addresses from Traefik.
-- Ensure the internal names in `.env` resolve where the local and development aliases are needed.
-- Keep Traefik's `websecure` read timeout disabled for long-lived gRPC and WebSocket sessions. This repository configures `--entrypoints.websecure.transport.respondingTimeouts.readTimeout=0` in `traefik/compose.yaml`.
-
-After startup, verify OIDC discovery through the public TLS endpoint:
-
-```bash
-curl -fsS "https://${NETBIRD_DOMAIN}/oauth2/.well-known/openid-configuration"
-```
-
-Open `https://${NETBIRD_DOMAIN}` immediately and complete the initial owner setup. Treat the initial setup flow as public until the owner exists.
-
-## Optional host client
-
-The client intentionally lives in a separate Compose project. Normal server deploys use `--remove-orphans`, so keeping the client in the server project would cause it to be removed.
-
-1. Create a reusable or ephemeral setup key in the NetBird dashboard.
-2. Put `NB_SETUP_KEY=<key>` in the ignored `netbird/.env` file.
-3. Set `NETBIRD_CLIENT_HOSTNAME` to this machine's desired peer name.
-4. Start and inspect the client:
-
-```bash
-cd /srv/homelab/netbird
-docker compose -f client.compose.yaml config --quiet
-docker compose -f client.compose.yaml up -d
-docker compose -f client.compose.yaml exec netbird-client netbird status
-```
-
-The client uses host networking and requires `NET_ADMIN`, `SYS_ADMIN`, `SYS_RESOURCE`, and `/dev/net/tun`. Remove it without affecting the server stack:
-
-```bash
-docker compose -f client.compose.yaml down
-```
-
-## Operations
-
-Inspect status and logs:
-
-```bash
-docker compose ps
-docker compose logs --tail=200 netbird-server dashboard
-```
-
-Stop or remove containers without deleting data:
-
-```bash
-docker compose down
-```
-
-Do not add `-v` to `docker compose down`; it would delete the NetBird datastore.
-
-## Backup and restore
-
-Back up both the persistent volume and the ignored secret files. For a consistent SQLite backup, briefly stop the server first and store the resulting archive and `datastore-encryption-key` in an encrypted backup:
-
-```bash
-cd /srv/homelab/netbird
-mkdir -p backups
-docker compose stop netbird-server
-docker run --rm \
-  -v netbird_data:/data:ro \
-  -v "$PWD/backups:/backup" \
-  busybox:1.37.0 \
-  tar -C /data -czf "/backup/netbird-data-$(date -u +%Y%m%dT%H%M%SZ).tar.gz" .
-docker compose start netbird-server
-```
-
-Also securely back up:
-
-- `secrets/datastore-encryption-key` — required to decrypt stored secrets.
-- `secrets/relay-auth-secret` — keeps issued relay credentials valid across restoration.
-- `netbird/.env` — optional, but it records the public and internal hostnames.
-
-Test a restore in an isolated Docker host before relying on a backup.
-
-## Upgrade
-
-1. Take and verify a backup.
-2. Review NetBird release notes for server, client, and dashboard compatibility.
-3. Update the pinned tags in `compose.yaml`; update `client.compose.yaml` separately when deploying the client.
-4. Pull and recreate the selected services:
-
-```bash
-docker compose pull
-docker compose up -d
-```
-
-The image tags are intentionally pinned instead of using `latest`, matching this repository's pull-on-deploy policy.

netbird/client.compose.yaml

@@ -1,31 +0,0 @@
-name: netbird-client
-
-services:
-  netbird-client:
-    image: netbirdio/netbird:0.79.0
-    container_name: netbird-client
-    hostname: "${NETBIRD_CLIENT_HOSTNAME:?Set NETBIRD_CLIENT_HOSTNAME in netbird/.env}"
-    restart: unless-stopped
-    cap_add:
-      - NET_ADMIN
-      - SYS_ADMIN
-      - SYS_RESOURCE
-    devices:
-      - /dev/net/tun
-    network_mode: host
-    environment:
-      NB_SETUP_KEY: "${NB_SETUP_KEY:?Set NB_SETUP_KEY in netbird/.env after creating a peer setup key}"
-      NB_MANAGEMENT_URL: "https://${NETBIRD_DOMAIN:?Set NETBIRD_DOMAIN in netbird/.env}"
-    volumes:
-      - netbird-client:/var/lib/netbird
-    healthcheck:
-      test: ["CMD", "/usr/local/bin/netbird", "status", "--check", "live"]
-      interval: 30s
-      timeout: 5s
-      retries: 5
-      start_period: 30s
-    stop_grace_period: 30s
-
-volumes:
-  netbird-client:
-    name: netbird-client

netbird/compose.yaml

@@ -1,152 +0,0 @@
-name: netbird
-
-services:
-  netbird-server:
-    image: netbirdio/netbird-server:0.79.0
-    container_name: netbird-server
-    restart: unless-stopped
-    environment:
-      NETBIRD_DOMAIN: "${NETBIRD_DOMAIN:?Set NETBIRD_DOMAIN in netbird/.env}"
-      NETBIRD_PROXY_SUBNET: "${NETBIRD_PROXY_SUBNET:?Set NETBIRD_PROXY_SUBNET in netbird/.env (run setup.sh)}"
-    entrypoint:
-      - /bin/sh
-      - /opt/netbird/entrypoint.sh
-    command:
-      - --config
-      - /run/netbird/config.yaml
-    ports:
-      - "3478:3478/udp"
-    volumes:
-      - netbird_data:/var/lib/netbird
-      - ./config.template.yaml:/opt/netbird/config.template.yaml:ro
-      - ./entrypoint.sh:/opt/netbird/entrypoint.sh:ro
-    secrets:
-      - relay_auth_secret
-      - datastore_encryption_key
-    tmpfs:
-      - /run/netbird:mode=0700
-    healthcheck:
-      test:
-        - CMD
-        - bash
-        - -ec
-        - exec 3<>/dev/tcp/127.0.0.1/80
-      interval: 30s
-      timeout: 5s
-      retries: 5
-      start_period: 30s
-    stop_grace_period: 30s
-    labels:
-      - "traefik.enable=true"
-      - "traefik.http.services.netbird-server.loadbalancer.server.port=80"
-      - "traefik.http.services.netbird-server-h2c.loadbalancer.server.port=80"
-      - "traefik.http.services.netbird-server-h2c.loadbalancer.server.scheme=h2c"
-
-      # gRPC routers
-      # Prod Router
-      - "traefik.http.routers.netbird-grpc.rule=Host(`${NETBIRD_DOMAIN:?Set NETBIRD_DOMAIN in netbird/.env}`) && (PathPrefix(`/signalexchange.SignalExchange/`) || PathPrefix(`/management.ManagementService/`) || PathPrefix(`/management.ProxyService/`))"
-      - "traefik.http.routers.netbird-grpc.entrypoints=websecure"
-      - "traefik.http.routers.netbird-grpc.service=netbird-server-h2c"
-      - "traefik.http.routers.netbird-grpc.priority=100"
-      - "traefik.http.routers.netbird-grpc.tls=true"
-      - "traefik.http.routers.netbird-grpc.tls.certresolver=letsencrypt"
-      # Local Router
-      - "traefik.http.routers.netbird-grpc-local.rule=Host(`${NETBIRD_LOCAL_DOMAIN:?Set NETBIRD_LOCAL_DOMAIN in netbird/.env}`) && (PathPrefix(`/signalexchange.SignalExchange/`) || PathPrefix(`/management.ManagementService/`) || PathPrefix(`/management.ProxyService/`))"
-      - "traefik.http.routers.netbird-grpc-local.entrypoints=websecure"
-      - "traefik.http.routers.netbird-grpc-local.service=netbird-server-h2c"
-      - "traefik.http.routers.netbird-grpc-local.priority=100"
-      - "traefik.http.routers.netbird-grpc-local.tls=true"
-      # Dev Router
-      - "traefik.http.routers.netbird-grpc-dev.rule=Host(`${NETBIRD_DEV_DOMAIN:?Set NETBIRD_DEV_DOMAIN in netbird/.env}`) && (PathPrefix(`/signalexchange.SignalExchange/`) || PathPrefix(`/management.ManagementService/`) || PathPrefix(`/management.ProxyService/`))"
-      - "traefik.http.routers.netbird-grpc-dev.entrypoints=websecure"
-      - "traefik.http.routers.netbird-grpc-dev.service=netbird-server-h2c"
-      - "traefik.http.routers.netbird-grpc-dev.priority=100"
-      - "traefik.http.routers.netbird-grpc-dev.tls=true"
-
-      # Backend routers
-      # Prod Router
-      - "traefik.http.routers.netbird-backend.rule=Host(`${NETBIRD_DOMAIN:?Set NETBIRD_DOMAIN in netbird/.env}`) && (PathPrefix(`/relay`) || PathPrefix(`/ws-proxy/`) || PathPrefix(`/api`) || PathPrefix(`/oauth2`))"
-      - "traefik.http.routers.netbird-backend.entrypoints=websecure"
-      - "traefik.http.routers.netbird-backend.service=netbird-server"
-      - "traefik.http.routers.netbird-backend.priority=100"
-      - "traefik.http.routers.netbird-backend.tls=true"
-      - "traefik.http.routers.netbird-backend.tls.certresolver=letsencrypt"
-      # Local Router
-      - "traefik.http.routers.netbird-backend-local.rule=Host(`${NETBIRD_LOCAL_DOMAIN:?Set NETBIRD_LOCAL_DOMAIN in netbird/.env}`) && (PathPrefix(`/relay`) || PathPrefix(`/ws-proxy/`) || PathPrefix(`/api`) || PathPrefix(`/oauth2`))"
-      - "traefik.http.routers.netbird-backend-local.entrypoints=websecure"
-      - "traefik.http.routers.netbird-backend-local.service=netbird-server"
-      - "traefik.http.routers.netbird-backend-local.priority=100"
-      - "traefik.http.routers.netbird-backend-local.tls=true"
-      # Dev Router
-      - "traefik.http.routers.netbird-backend-dev.rule=Host(`${NETBIRD_DEV_DOMAIN:?Set NETBIRD_DEV_DOMAIN in netbird/.env}`) && (PathPrefix(`/relay`) || PathPrefix(`/ws-proxy/`) || PathPrefix(`/api`) || PathPrefix(`/oauth2`))"
-      - "traefik.http.routers.netbird-backend-dev.entrypoints=websecure"
-      - "traefik.http.routers.netbird-backend-dev.service=netbird-server"
-      - "traefik.http.routers.netbird-backend-dev.priority=100"
-      - "traefik.http.routers.netbird-backend-dev.tls=true"
-    networks:
-      - proxy
-
-  dashboard:
-    image: netbirdio/dashboard:v2.90.10
-    container_name: netbird-dashboard
-    restart: unless-stopped
-    environment:
-      NETBIRD_MGMT_API_ENDPOINT: "https://${NETBIRD_DOMAIN:?Set NETBIRD_DOMAIN in netbird/.env}"
-      NETBIRD_MGMT_GRPC_API_ENDPOINT: "https://${NETBIRD_DOMAIN:?Set NETBIRD_DOMAIN in netbird/.env}"
-      AUTH_AUDIENCE: netbird-dashboard
-      AUTH_CLIENT_ID: netbird-dashboard
-      AUTH_CLIENT_SECRET: ""
-      AUTH_AUTHORITY: "https://${NETBIRD_DOMAIN:?Set NETBIRD_DOMAIN in netbird/.env}/oauth2"
-      AUTH_SUPPORTED_SCOPES: openid profile email groups
-      AUTH_REDIRECT_URI: /nb-auth
-      AUTH_SILENT_REDIRECT_URI: /nb-silent-auth
-      USE_AUTH0: "false"
-      LETSENCRYPT_DOMAIN: none
-    depends_on:
-      netbird-server:
-        condition: service_healthy
-    healthcheck:
-      test: ["CMD", "curl", "--fail", "--silent", "--show-error", "http://127.0.0.1/"]
-      interval: 30s
-      timeout: 5s
-      retries: 5
-      start_period: 15s
-    labels:
-      - "traefik.enable=true"
-      - "traefik.http.services.netbird-dashboard.loadbalancer.server.port=80"
-      # Dashboard catch-all routers
-      # Prod Router
-      - "traefik.http.routers.netbird-dashboard.rule=Host(`${NETBIRD_DOMAIN:?Set NETBIRD_DOMAIN in netbird/.env}`)"
-      - "traefik.http.routers.netbird-dashboard.entrypoints=websecure"
-      - "traefik.http.routers.netbird-dashboard.service=netbird-dashboard"
-      - "traefik.http.routers.netbird-dashboard.priority=1"
-      - "traefik.http.routers.netbird-dashboard.tls=true"
-      - "traefik.http.routers.netbird-dashboard.tls.certresolver=letsencrypt"
-      # Local Router
-      - "traefik.http.routers.netbird-dashboard-local.rule=Host(`${NETBIRD_LOCAL_DOMAIN:?Set NETBIRD_LOCAL_DOMAIN in netbird/.env}`)"
-      - "traefik.http.routers.netbird-dashboard-local.entrypoints=websecure"
-      - "traefik.http.routers.netbird-dashboard-local.service=netbird-dashboard"
-      - "traefik.http.routers.netbird-dashboard-local.priority=1"
-      - "traefik.http.routers.netbird-dashboard-local.tls=true"
-      # Dev Router
-      - "traefik.http.routers.netbird-dashboard-dev.rule=Host(`${NETBIRD_DEV_DOMAIN:?Set NETBIRD_DEV_DOMAIN in netbird/.env}`)"
-      - "traefik.http.routers.netbird-dashboard-dev.entrypoints=websecure"
-      - "traefik.http.routers.netbird-dashboard-dev.service=netbird-dashboard"
-      - "traefik.http.routers.netbird-dashboard-dev.priority=1"
-      - "traefik.http.routers.netbird-dashboard-dev.tls=true"
-    networks:
-      - proxy
-
-networks:
-  proxy:
-    external: true
-
-volumes:
-  netbird_data:
-    name: netbird_data
-
-secrets:
-  relay_auth_secret:
-    file: ./secrets/relay-auth-secret
-  datastore_encryption_key:
-    file: ./secrets/datastore-encryption-key

netbird/config.template.yaml

@@ -1,26 +0,0 @@
-server:
-  listenAddress: ":80"
-  exposedAddress: "https://__NETBIRD_DOMAIN__:443"
-  stunPorts:
-    - 3478
-  metricsPort: 9090
-  healthcheckAddress: ":9000"
-  logLevel: info
-  logFile: console
-  authSecret: "__NETBIRD_AUTH_SECRET__"
-  dataDir: "/var/lib/netbird"
-  disableAnonymousMetrics: true
-  auth:
-    issuer: "https://__NETBIRD_DOMAIN__/oauth2"
-    signKeyRefreshEnabled: true
-    dashboardRedirectURIs:
-      - "https://__NETBIRD_DOMAIN__/nb-auth"
-      - "https://__NETBIRD_DOMAIN__/nb-silent-auth"
-  reverseProxy:
-    trustedHTTPProxies:
-      - "__NETBIRD_PROXY_SUBNET__"
-    trustedPeers:
-      - "__NETBIRD_PROXY_SUBNET__"
-  store:
-    engine: sqlite
-    encryptionKey: "__NETBIRD_ENCRYPTION_KEY__"

netbird/k8s/certificates.yaml

@@ -1,28 +0,0 @@
-apiVersion: cert-manager.io/v1
-kind: Certificate
-metadata:
-  name: netbird-prod-tls
-  namespace: netbird
-spec:
-  secretName: netbird-prod-tls
-  dnsNames:
-    - nb.forust.xyz
-  issuerRef:
-    name: letsencrypt-prod
-    kind: ClusterIssuer
----
-apiVersion: cert-manager.io/v1
-kind: Certificate
-metadata:
-  name: internal-wildcard-tls
-  namespace: netbird
-spec:
-  secretName: internal-wildcard-tls
-  dnsNames:
-    - "*.workstation.internal"
-    - "*.gigaforust.internal"
-    - workstation.internal
-    - gigaforust.internal
-  issuerRef:
-    name: internal-ca
-    kind: ClusterIssuer

netbird/k8s/config.yaml

@@ -1,160 +0,0 @@
-apiVersion: v1
-kind: ConfigMap
-metadata:
-  name: netbird-config
-  namespace: netbird
-data:
-  # Public hostname, rendered into the server config by entrypoint.sh.
-  NETBIRD_DOMAIN: "nb.forust.xyz"
-  NETBIRD_PROXY_SUBNET: "10.244.0.0/16"
-
-  NETBIRD_MGMT_API_ENDPOINT: "https://nb.forust.xyz"
-  NETBIRD_MGMT_GRPC_API_ENDPOINT: "https://nb.forust.xyz"
-  AUTH_AUDIENCE: "netbird-dashboard"
-  AUTH_CLIENT_ID: "netbird-dashboard"
-  AUTH_CLIENT_SECRET: ""
-  AUTH_AUTHORITY: "https://nb.forust.xyz/oauth2"
-  AUTH_SUPPORTED_SCOPES: "openid profile email groups"
-  AUTH_REDIRECT_URI: "/nb-auth"
-  AUTH_SILENT_REDIRECT_URI: "/nb-silent-auth"
-  USE_AUTH0: "false"
-  LETSENCRYPT_DOMAIN: "none"
-
-  config.template.yaml: |
-    server:
-      listenAddress: ":80"
-      exposedAddress: "https://__NETBIRD_DOMAIN__:443"
-      stunPorts:
-        - 3478
-      metricsPort: 9090
-      healthcheckAddress: ":9000"
-      logLevel: info
-      logFile: console
-      authSecret: "__NETBIRD_AUTH_SECRET__"
-      dataDir: "/var/lib/netbird"
-      disableAnonymousMetrics: true
-      auth:
-        issuer: "https://__NETBIRD_DOMAIN__/oauth2"
-        signKeyRefreshEnabled: true
-        dashboardRedirectURIs:
-          - "https://__NETBIRD_DOMAIN__/nb-auth"
-          - "https://__NETBIRD_DOMAIN__/nb-silent-auth"
-      reverseProxy:
-        trustedHTTPProxies:
-          - "__NETBIRD_PROXY_SUBNET__"
-        trustedPeers:
-          - "__NETBIRD_PROXY_SUBNET__"
-      store:
-        engine: sqlite
-        encryptionKey: "__NETBIRD_ENCRYPTION_KEY__"
-
-  entrypoint.sh: |
-    #!/bin/sh
-    set -eu
-
-    umask 077
-
-    TEMPLATE_PATH=/opt/netbird/config.template.yaml
-    RENDERED_PATH=/run/netbird/config.yaml
-    RELAY_SECRET_PATH=/run/secrets/relay_auth_secret
-    ENCRYPTION_KEY_PATH=/run/secrets/datastore_encryption_key
-
-    is_valid_proxy_subnet() {
-      candidate="$1"
-      case "$candidate" in
-        0.0.0.0/0)
-          return 1
-          ;;
-        */*)
-          address="${candidate%%/*}"
-          prefix="${candidate#*/}"
-          ;;
-        *)
-          return 1
-          ;;
-      esac
-
-      case "$prefix" in
-        0|[1-9]|[1-2][0-9]|3[0-2]) ;;
-        *)
-          return 1
-          ;;
-      esac
-
-      old_ifs="$IFS"
-      IFS=.
-      # shellcheck disable=SC2086
-      set -- $address
-      IFS="$old_ifs"
-      [ "$#" -eq 4 ] || return 1
-
-      for octet do
-        case "$octet" in
-          0|[1-9]|[1-9][0-9]|1[0-9][0-9]|2[0-4][0-9]|25[0-5]) ;;
-          *)
-            return 1
-            ;;
-        esac
-      done
-    }
-
-    read_secret() {
-      secret_path="$1"
-
-      if [ ! -r "$secret_path" ]; then
-        echo "Required secret is not readable: $secret_path" >&2
-        exit 1
-      fi
-
-      secret_value="$(cat "$secret_path")"
-      if [ -z "$secret_value" ]; then
-        echo "Required secret is empty: $secret_path" >&2
-        exit 1
-      fi
-
-      printf '%s' "$secret_value"
-    }
-
-    if [ -z "${NETBIRD_DOMAIN:-}" ]; then
-      echo "NETBIRD_DOMAIN must be set" >&2
-      exit 1
-    fi
-
-    case "$NETBIRD_DOMAIN" in
-      *[!A-Za-z0-9.-]*)
-        echo "NETBIRD_DOMAIN contains unsupported characters" >&2
-        exit 1
-        ;;
-    esac
-
-    if [ -z "${NETBIRD_PROXY_SUBNET:-}" ] || [ "$NETBIRD_PROXY_SUBNET" = "auto" ]; then
-      echo "NETBIRD_PROXY_SUBNET must be an explicit IPv4 CIDR; run netbird/setup.sh first" >&2
-      exit 1
-    fi
-    if ! is_valid_proxy_subnet "$NETBIRD_PROXY_SUBNET"; then
-      echo "NETBIRD_PROXY_SUBNET must be a non-default IPv4 CIDR, for example 172.20.0.0/16" >&2
-      exit 1
-    fi
-
-    if [ "$#" -ne 2 ] || [ "$1" != "--config" ] || [ "$2" != "$RENDERED_PATH" ]; then
-      echo "Expected: --config $RENDERED_PATH" >&2
-      exit 1
-    fi
-
-    relay_secret="$(read_secret "$RELAY_SECRET_PATH")"
-    encryption_key="$(read_secret "$ENCRYPTION_KEY_PATH")"
-
-    mkdir -p "$(dirname "$RENDERED_PATH")"
-    sed \
-      -e "s|__NETBIRD_DOMAIN__|${NETBIRD_DOMAIN}|g" \
-      -e "s|__NETBIRD_AUTH_SECRET__|${relay_secret}|g" \
-      -e "s|__NETBIRD_ENCRYPTION_KEY__|${encryption_key}|g" \
-      -e "s|__NETBIRD_PROXY_SUBNET__|${NETBIRD_PROXY_SUBNET}|g" \
-      "$TEMPLATE_PATH" >"$RENDERED_PATH"
-
-    if grep -q '__NETBIRD_' "$RENDERED_PATH"; then
-      echo "Rendered NetBird configuration still contains unresolved placeholders" >&2
-      exit 1
-    fi
-
-    exec /go/bin/netbird-server "$@"

netbird/k8s/ingress.yaml

@@ -1,83 +0,0 @@
-apiVersion: traefik.io/v1alpha1
-kind: IngressRoute
-metadata:
-  name: netbird-prod
-  namespace: netbird
-spec:
-  entryPoints:
-    - websecure
-  routes:
-    - match: Host(`nb.forust.xyz`) && (PathPrefix(`/signalexchange.SignalExchange/`) || PathPrefix(`/management.ManagementService/`) || PathPrefix(`/management.ProxyService/`))
-      kind: Rule
-      priority: 100
-      middlewares:
-        - name: crowdsec-bouncer
-          namespace: crowdsec
-      services:
-        - name: netbird-server-service
-          port: 80
-          scheme: h2c
-    - match: Host(`nb.forust.xyz`) && (PathPrefix(`/relay`) || PathPrefix(`/ws-proxy/`) || PathPrefix(`/api`) || PathPrefix(`/oauth2`))
-      kind: Rule
-      priority: 100
-      middlewares:
-        - name: crowdsec-bouncer
-          namespace: crowdsec
-      services:
-        - name: netbird-server-service
-          port: 80
-    - match: Host(`nb.forust.xyz`)
-      kind: Rule
-      priority: 1
-      middlewares:
-        - name: crowdsec-bouncer
-          namespace: crowdsec
-      services:
-        - name: netbird-dashboard-service
-          port: 80
-  tls:
-    secretName: netbird-prod-tls
----
-apiVersion: traefik.io/v1alpha1
-kind: IngressRoute
-metadata:
-  name: netbird-local
-  namespace: netbird
-spec:
-  entryPoints:
-    - websecure
-  routes:
-    - match: (Host(`netbird.workstation.internal`) || Host(`netbird.gigaforust.internal`)) && (PathPrefix(`/signalexchange.SignalExchange/`) || PathPrefix(`/management.ManagementService/`) || PathPrefix(`/management.ProxyService/`))
-      kind: Rule
-      priority: 100
-      services:
-        - name: netbird-server-service
-          port: 80
-          scheme: h2c
-    - match: (Host(`netbird.workstation.internal`) || Host(`netbird.gigaforust.internal`)) && (PathPrefix(`/relay`) || PathPrefix(`/ws-proxy/`) || PathPrefix(`/api`) || PathPrefix(`/oauth2`))
-      kind: Rule
-      priority: 100
-      services:
-        - name: netbird-server-service
-          port: 80
-    - match: Host(`netbird.workstation.internal`) || Host(`netbird.gigaforust.internal`)
-      kind: Rule
-      priority: 1
-      services:
-        - name: netbird-dashboard-service
-          port: 80
-  tls:
-    secretName: internal-wildcard-tls
----
-apiVersion: traefik.io/v1alpha1
-kind: IngressRouteUDP
-metadata:
-  name: netbird-stun
-  namespace: netbird
-spec:
-  entryPoints:
-    - netbird-stun
-  routes:
-    - services:
-        - name: netbird-server-service
-          port: 3478

netbird/k8s/namespace.yaml

@@ -1,4 +0,0 @@
-apiVersion: v1
-kind: Namespace
-metadata:
-  name: netbird

netbird/k8s/netbird.yaml

@@ -1,181 +0,0 @@
-apiVersion: v1
-kind: Service
-metadata:
-  name: netbird-server-service
-  namespace: netbird
-spec:
-  selector:
-    app: netbird-server
-  ports:
-    - port: 80
-      name: http
-      targetPort: 80
-      protocol: TCP
-    - port: 3478
-      name: stun
-      targetPort: 3478
-      protocol: UDP
----
-apiVersion: v1
-kind: Service
-metadata:
-  name: netbird-dashboard-service
-  namespace: netbird
-spec:
-  selector:
-    app: netbird-dashboard
-  ports:
-    - port: 80
-      name: http
-      targetPort: 80
----
-apiVersion: apps/v1
-kind: Deployment
-metadata:
-  name: netbird-server-deployment
-  namespace: netbird
-spec:
-  replicas: 1
-  selector:
-    matchLabels:
-      app: netbird-server
-  template:
-    metadata:
-      labels:
-        app: netbird-server
-    spec:
-      containers:
-        - name: netbird-server
-          image: netbirdio/netbird-server:0.79.0
-          command: ["/bin/sh", "/opt/netbird/entrypoint.sh", "--config", "/run/netbird/config.yaml"]
-          envFrom:
-            - configMapRef:
-                name: netbird-config
-          ports:
-            - containerPort: 80
-              name: http
-              protocol: TCP
-            - containerPort: 3478
-              name: stun
-              protocol: UDP
-          volumeMounts:
-            - name: netbird-data
-              mountPath: /var/lib/netbird
-            - name: netbird-files
-              mountPath: /opt/netbird
-              readOnly: true
-            - name: netbird-secrets
-              mountPath: /run/secrets/relay_auth_secret
-              subPath: relay_auth_secret
-              readOnly: true
-            - name: netbird-secrets
-              mountPath: /run/secrets/datastore_encryption_key
-              subPath: datastore_encryption_key
-              readOnly: true
-            - name: netbird-run
-              mountPath: /run/netbird
-          readinessProbe:
-            tcpSocket:
-              port: 80
-            initialDelaySeconds: 30
-            periodSeconds: 30
-            timeoutSeconds: 5
-            failureThreshold: 5
-          livenessProbe:
-            tcpSocket:
-              port: 80
-            initialDelaySeconds: 60
-            periodSeconds: 30
-            timeoutSeconds: 5
-            failureThreshold: 5
-          resources:
-            requests:
-              memory: "256Mi"
-              cpu: "250m"
-            limits:
-              memory: "1Gi"
-              cpu: "1000m"
-      volumes:
-        - name: netbird-data
-          persistentVolumeClaim:
-            claimName: netbird-pvc
-        - name: netbird-files
-          configMap:
-            name: netbird-config
-            defaultMode: 0755
-            items:
-              - key: config.template.yaml
-                path: config.template.yaml
-              - key: entrypoint.sh
-                path: entrypoint.sh
-        - name: netbird-secrets
-          secret:
-            secretName: netbird-secrets
-            items:
-              - key: relay_auth_secret
-                path: relay_auth_secret
-              - key: datastore_encryption_key
-                path: datastore_encryption_key
-        - name: netbird-run
-          emptyDir:
-            medium: Memory
----
-apiVersion: apps/v1
-kind: Deployment
-metadata:
-  name: netbird-dashboard-deployment
-  namespace: netbird
-spec:
-  replicas: 1
-  selector:
-    matchLabels:
-      app: netbird-dashboard
-  template:
-    metadata:
-      labels:
-        app: netbird-dashboard
-    spec:
-      containers:
-        - name: dashboard
-          image: netbirdio/dashboard:v2.90.10
-          envFrom:
-            - configMapRef:
-                name: netbird-config
-          ports:
-            - containerPort: 80
-              name: http
-          readinessProbe:
-            httpGet:
-              path: /
-              port: 80
-            initialDelaySeconds: 15
-            periodSeconds: 30
-            timeoutSeconds: 5
-            failureThreshold: 5
-          livenessProbe:
-            httpGet:
-              path: /
-              port: 80
-            initialDelaySeconds: 30
-            periodSeconds: 30
-            timeoutSeconds: 5
-            failureThreshold: 5
-          resources:
-            requests:
-              memory: "64Mi"
-              cpu: "50m"
-            limits:
-              memory: "256Mi"
-              cpu: "300m"
----
-apiVersion: v1
-kind: PersistentVolumeClaim
-metadata:
-  name: netbird-pvc
-  namespace: netbird
-spec:
-  accessModes:
-    - ReadWriteOnce
-  resources:
-    requests:
-      storage: 2Gi

netbird/k8s/secrets.yaml.example

@@ -1,11 +0,0 @@
-apiVersion: v1
-kind: Secret
-metadata:
-  name: netbird-secrets
-  namespace: netbird
-type: Opaque
-stringData:
-  # hex, 64 chars: openssl rand -hex 32
-  relay_auth_secret: "REPLACE_ME"
-  # base64, 44 chars: openssl rand -base64 32
-  datastore_encryption_key: "REPLACE_ME"

netbox/.env.example

@@ -1,32 +0,0 @@
-POSTGRES_DB=netbox
-POSTGRES_USER=netbox
-POSTGRES_PASSWORD=CHANGE_ME_POSTGRES_PASSWORD
-
-DB_NAME=netbox
-DB_USER=netbox
-DB_PASSWORD=CHANGE_ME_POSTGRES_PASSWORD
-DB_HOST=postgres
-DB_PORT=5432
-DB_SSLMODE=disable
-
-REDIS_HOST=redis
-REDIS_PORT=6379
-REDIS_PASSWORD=CHANGE_ME_REDIS_PASSWORD
-REDIS_DATABASE=0
-REDIS_CACHE_HOST=redis-cache
-REDIS_CACHE_PORT=6379
-REDIS_CACHE_PASSWORD=CHANGE_ME_REDIS_CACHE_PASSWORD
-REDIS_CACHE_DATABASE=1
-
-ALLOWED_HOSTS=localhost,127.0.0.1,[::1],netbox.forust.xyz,netbox.workstation.internal
-CSRF_TRUSTED_ORIGINS=https://netbox.forust.xyz,https://netbox.workstation.internal
-
-SECRET_KEY=CHANGE_ME_DJANGO_SECRET_KEY
-API_TOKEN_PEPPER_1=CHANGE_ME_API_TOKEN_PEPPER
-TIME_ZONE=Europe/Bratislava
-TZ=Europe/Bratislava
-
-SKIP_SUPERUSER=false
-SUPERUSER_NAME=admin
-SUPERUSER_EMAIL=admin@example.com
-SUPERUSER_PASSWORD=CHANGE_ME_SUPERUSER_PASSWORD

netbox/README.md

@@ -1,96 +0,0 @@
-# NetBox
-
-NetBox for homelab documentation and visualization. Two runtimes are available:
-
-| Runtime | Manifest       | Purpose                                                        |
-| ------- | -------------- | -------------------------------------------------------------- |
-| Docker  | `compose.yaml` | Local stand on `127.0.0.1:8000` (no public exposure)           |
-| k8s     | `k8s/`         | Homelab service on `netbox.forust.xyz` (and the internal name) |
-
-Both use the same image (`netboxcommunity/netbox:v4.7-5.1.1`) and Valkey for tasks
-plus a second logical database for caching. The Docker stand keeps its own
-PostgreSQL container, while the k8s deployment uses the shared `database` cluster
-(`postgres.database.svc.cluster.local:5432`, role/database `netbox`); only Valkey
-stays a per-service StatefulSet.
-
-## Docker Compose
-
-```bash
-cp .env.example .env
-# replace CHANGE_ME
-docker compose up -d
-```
-
-The UI is available at <http://localhost:8000>. The port is bound to `127.0.0.1`
-intentionally, so this stand is not exposed on the LAN or public interfaces.
-
-The `netbox` service is also attached to the external `proxy` network and carries
-Traefik labels for `netbox.forust.xyz` and `netbox.workstation.internal`. Those
-labels only take effect while the Docker Traefik stack is running; it is currently
-stopped, and the live ingress path in this homelab is the k8s Traefik.
-
-Inspect startup and health with:
-
-```bash
-docker compose ps
-docker compose logs -f netbox
-```
-
-Stop it with `docker compose down`; data is kept in the named volumes
-`netbox-postgres`, `netbox-media-files`, `netbox-reports-files`,
-`netbox-scripts-files` and `netbox-redis-data`.
-
-## Kubernetes
-
-`k8s/` is deployed in the homelab cluster and serves `netbox.forust.xyz` publicly
-plus `netbox.workstation.internal` / `netbox.gigaforust.internal` internally. To
-rebuild it from scratch:
-
-```bash
-# 1. shared PostgreSQL: the password lives in the shared secret, NetBox keeps a copy
-kubectl -n database patch secret postgres-shared-secrets \
-  --type merge -p '{"stringData":{"NETBOX_DB_PASSWORD":"<same value>"}}'
-kubectl -n database exec postgres17-0 -- psql -U postgres -d postgres \
-  -c 'CREATE ROLE netbox LOGIN PASSWORD ...' -c 'CREATE DATABASE netbox OWNER netbox'
-
-# 2. secrets first: the deploy workflow never applies *secret*.yaml
-cp k8s/secrets.yaml.example k8s/secrets.yaml   # replace CHANGE_ME
-kubectl apply -f k8s/secrets.yaml
-
-# 3. manifests
-kubectl apply -f k8s/
-```
-
-The shared cluster is reached at `postgres.database.svc.cluster.local:5432`. Its
-NetworkPolicy (`postgres/k8s/network-policy.yaml`) must list the `netbox` namespace
-or connections are dropped, and `postgres/initdb/01-create-databases.sh` already
-creates the role and database on a fresh data directory. NetBox has no PostgreSQL
-StatefulSet of its own — only `netbox-valkey`.
-
-`netbox.forust.xyz` resolves to this host (`78.98.72.122`) through the `DOMAINS`
-list in the `default/cfddns` secret. cert-manager issues `netbox-prod-tls` with the
-`letsencrypt-prod` issuer, the internal route uses `internal-wildcard-tls`.
-
-Resources are permanent again now that the first-boot migrations are complete:
-the web container reserves `100m`/`512Mi` and is capped at `2` CPU/`2Gi`, the
-worker reserves `50m`/`256Mi` and is capped at `1` CPU/`1Gi`, and Valkey reserves
-`25m`/`64Mi` and is capped at `250m`/`256Mi`. The deliberately generous CPU caps
-leave enough headroom for future schema migrations without letting one process
-consume the whole node.
-
-The first start applies ~810 migrations, each in its own transaction with DDL and
-a commit; every later start is a no-op. The startup probe allows 15 minutes and
-`progressDeadlineSeconds` is 1800 for the same reason. Probes run inside the pod
-and explicitly set `Host: netbox.forust.xyz`; a kubelet `httpGet.host` field would
-replace the probe destination with that public hostname and bypass the pod.
-
-## Secrets
-
-- `netbox/.env` (compose) and `netbox/k8s/secrets.yaml` (k8s) are gitignored. Only
-  `.env.example` and `k8s/secrets.yaml.example` are committed.
-- `netbox/configuration/configuration.py` is env-driven: hosts, database, Redis and
-  the Django keys all come from the environment, so the same settings file works in
-  both runtimes. The k8s copy lives in the `netbox-settings` ConfigMap
-  (`k8s/settings.yaml`) and must be kept in sync with the file.
-- Rotating `SECRET_KEY` invalidates all sessions; rotating `API_TOKEN_PEPPER_1`
-  invalidates every API token.

netbox/compose.yaml

@@ -1,137 +0,0 @@
-services:
-  netbox:
-    image: docker.io/netboxcommunity/netbox:v4.7-5.1.1
-    container_name: netbox
-    restart: unless-stopped
-    user: "netbox:root"
-    ports:
-      - "127.0.0.1:8000:8080"
-    env_file:
-      - .env
-    environment:
-      GRANIAN_WORKERS: "2"
-    depends_on:
-      postgres:
-        condition: service_healthy
-      redis:
-        condition: service_healthy
-      redis-cache:
-        condition: service_healthy
-    volumes:
-      - ./configuration:/etc/netbox/config:z,ro
-      - netbox-media-files:/opt/netbox/netbox/media
-      - netbox-reports-files:/opt/netbox/netbox/reports
-      - netbox-scripts-files:/opt/netbox/netbox/scripts
-    networks:
-      - default
-      - proxy
-    labels:
-      - "traefik.enable=true"
-      - "traefik.http.services.netbox.loadbalancer.server.port=8080"
-
-      # Prod Router
-      - "traefik.http.routers.netbox.rule=Host(`netbox.forust.xyz`)"
-      - "traefik.http.routers.netbox.entrypoints=websecure"
-      - "traefik.http.routers.netbox.middlewares=security-headers@file"
-      - "traefik.http.routers.netbox.tls.certresolver=letsencrypt"
-      # Local Router
-      - "traefik.http.routers.netbox-local.rule=Host(`netbox.workstation.internal`)"
-      - "traefik.http.routers.netbox-local.entrypoints=websecure"
-      - "traefik.http.routers.netbox-local.tls=true"
-    healthcheck:
-      test: ["CMD", "/opt/netbox/health.sh"]
-      start_period: 600s
-      timeout: 5s
-      interval: 15s
-      retries: 10
-
-  netbox-worker:
-    image: docker.io/netboxcommunity/netbox:v4.7-5.1.1
-    container_name: netbox-worker
-    restart: unless-stopped
-    user: "netbox:root"
-    command:
-      - /opt/netbox/venv/bin/python
-      - /opt/netbox/netbox/manage.py
-      - rqworker
-    env_file:
-      - .env
-    depends_on:
-      netbox:
-        condition: service_healthy
-    volumes:
-      - ./configuration:/etc/netbox/config:z,ro
-      - netbox-media-files:/opt/netbox/netbox/media
-      - netbox-reports-files:/opt/netbox/netbox/reports
-      - netbox-scripts-files:/opt/netbox/netbox/scripts
-    healthcheck:
-      test: ["CMD-SHELL", "ps -ef | grep -q '[r]qworker'"]
-      start_period: 30s
-      timeout: 5s
-      interval: 15s
-      retries: 10
-
-  postgres:
-    image: docker.io/postgres:18.6-alpine
-    container_name: netbox-postgres
-    restart: unless-stopped
-    environment:
-      POSTGRES_DB: "${POSTGRES_DB:?POSTGRES_DB must be set}"
-      POSTGRES_USER: "${POSTGRES_USER:?POSTGRES_USER must be set}"
-      POSTGRES_PASSWORD: "${POSTGRES_PASSWORD:?POSTGRES_PASSWORD must be set}"
-    volumes:
-      - netbox-postgres:/var/lib/postgresql
-    healthcheck:
-      test: ["CMD-SHELL", 'pg_isready -q -t 2 -d "$${POSTGRES_DB}" -U "$${POSTGRES_USER}"']
-      start_period: 20s
-      timeout: 5s
-      interval: 10s
-      retries: 10
-
-  redis:
-    image: docker.io/valkey/valkey:9.1.2-alpine
-    container_name: netbox-redis
-    restart: unless-stopped
-    command:
-      - sh
-      - -c
-      - valkey-server --appendonly yes --requirepass "$$REDIS_PASSWORD"
-    environment:
-      REDIS_PASSWORD: "${REDIS_PASSWORD:?REDIS_PASSWORD must be set}"
-    volumes:
-      - netbox-redis-data:/data
-    healthcheck:
-      test: ["CMD-SHELL", 'valkey-cli --pass "$${REDIS_PASSWORD}" ping | grep -q PONG']
-      start_period: 5s
-      timeout: 5s
-      interval: 5s
-      retries: 10
-
-  redis-cache:
-    image: docker.io/valkey/valkey:9.1.2-alpine
-    container_name: netbox-redis-cache
-    restart: unless-stopped
-    command:
-      - sh
-      - -c
-      - valkey-server --requirepass "$$REDIS_CACHE_PASSWORD"
-    environment:
-      REDIS_CACHE_PASSWORD: "${REDIS_CACHE_PASSWORD:?REDIS_CACHE_PASSWORD must be set}"
-    healthcheck:
-      test: ["CMD-SHELL", 'valkey-cli --pass "$${REDIS_CACHE_PASSWORD}" ping | grep -q PONG']
-      start_period: 5s
-      timeout: 5s
-      interval: 5s
-      retries: 10
-
-volumes:
-  netbox-media-files:
-  netbox-reports-files:
-  netbox-scripts-files:
-  netbox-postgres:
-  netbox-redis-data:
-
-networks:
-  default:
-  proxy:
-    external: true

netbox/configuration/configuration.py

@@ -1,48 +0,0 @@
-import os
-
-
-def _csv(name, default=""):
-    return [item.strip() for item in os.environ.get(name, default).split(",") if item.strip()]
-
-
-ALLOWED_HOSTS = _csv("ALLOWED_HOSTS", "localhost,127.0.0.1,[::1]")
-CSRF_TRUSTED_ORIGINS = _csv("CSRF_TRUSTED_ORIGINS")
-USE_X_FORWARDED_HOST = True
-SECURE_PROXY_SSL_HEADER = ("HTTP_X_FORWARDED_PROTO", "https")
-
-DATABASES = {
-    "default": {
-        "NAME": os.environ["DB_NAME"],
-        "USER": os.environ["DB_USER"],
-        "PASSWORD": os.environ["DB_PASSWORD"],
-        "HOST": os.environ["DB_HOST"],
-        "PORT": os.environ.get("DB_PORT", "5432"),
-        "OPTIONS": {"sslmode": os.environ.get("DB_SSLMODE", "disable")},
-        "CONN_MAX_AGE": int(os.environ.get("DB_CONN_MAX_AGE", "300")),
-    }
-}
-
-REDIS = {
-    "tasks": {
-        "HOST": os.environ["REDIS_HOST"],
-        "PORT": int(os.environ.get("REDIS_PORT", "6379")),
-        "PASSWORD": os.environ["REDIS_PASSWORD"],
-        "DATABASE": int(os.environ.get("REDIS_DATABASE", "0")),
-        "SSL": False,
-    },
-    "caching": {
-        "HOST": os.environ["REDIS_CACHE_HOST"],
-        "PORT": int(os.environ.get("REDIS_CACHE_PORT", "6379")),
-        "PASSWORD": os.environ["REDIS_CACHE_PASSWORD"],
-        "DATABASE": int(os.environ.get("REDIS_CACHE_DATABASE", "1")),
-        "SSL": False,
-    },
-}
-
-SECRET_KEY = os.environ["SECRET_KEY"]
-API_TOKEN_PEPPERS = {1: os.environ["API_TOKEN_PEPPER_1"]}
-TIME_ZONE = os.environ.get("TIME_ZONE", "UTC")
-MEDIA_ROOT = "/opt/netbox/netbox/media"
-REPORTS_ROOT = "/opt/netbox/netbox/reports"
-SCRIPTS_ROOT = "/opt/netbox/netbox/scripts"
-CENSUS_REPORTING_ENABLED = False

netbox/k8s/certificates.yaml

@@ -1,28 +0,0 @@
-apiVersion: cert-manager.io/v1
-kind: Certificate
-metadata:
-  name: netbox-prod-tls
-  namespace: netbox
-spec:
-  secretName: netbox-prod-tls
-  dnsNames:
-    - netbox.forust.xyz
-  issuerRef:
-    name: letsencrypt-prod
-    kind: ClusterIssuer
----
-apiVersion: cert-manager.io/v1
-kind: Certificate
-metadata:
-  name: internal-wildcard-tls
-  namespace: netbox
-spec:
-  secretName: internal-wildcard-tls
-  dnsNames:
-    - "*.workstation.internal"
-    - "*.gigaforust.internal"
-    - workstation.internal
-    - gigaforust.internal
-  issuerRef:
-    name: internal-ca
-    kind: ClusterIssuer

netbox/k8s/config.yaml

@@ -1,21 +0,0 @@
-apiVersion: v1
-kind: ConfigMap
-metadata:
-  name: netbox-config
-  namespace: netbox
-data:
-  DB_HOST: "postgres.database.svc.cluster.local"
-  DB_PORT: "5432"
-  DB_SSLMODE: "disable"
-  REDIS_HOST: "netbox-valkey"
-  REDIS_PORT: "6379"
-  REDIS_DATABASE: "0"
-  REDIS_CACHE_HOST: "netbox-valkey"
-  REDIS_CACHE_PORT: "6379"
-  REDIS_CACHE_DATABASE: "1"
-  TIME_ZONE: "Europe/Bratislava"
-  TZ: "Europe/Bratislava"
-  GRANIAN_WORKERS: "2"
-  ALLOWED_HOSTS: "netbox.forust.xyz,netbox.workstation.internal,netbox.gigaforust.internal"
-  CSRF_TRUSTED_ORIGINS: "https://netbox.forust.xyz,https://netbox.workstation.internal,https://netbox.gigaforust.internal"
-  SKIP_SUPERUSER: "false"

netbox/k8s/ingress.yaml

@@ -1,36 +0,0 @@
-apiVersion: traefik.io/v1alpha1
-kind: IngressRoute
-metadata:
-  name: netbox-prod
-  namespace: netbox
-spec:
-  entryPoints:
-    - websecure
-  routes:
-    - match: Host(`netbox.forust.xyz`)
-      kind: Rule
-      middlewares:
-        - name: crowdsec-bouncer
-          namespace: crowdsec
-      services:
-        - name: netbox-service
-          port: 8080
-  tls:
-    secretName: netbox-prod-tls
----
-apiVersion: traefik.io/v1alpha1
-kind: IngressRoute
-metadata:
-  name: netbox-local
-  namespace: netbox
-spec:
-  entryPoints:
-    - websecure
-  routes:
-    - match: Host(`netbox.workstation.internal`) || Host(`netbox.gigaforust.internal`)
-      kind: Rule
-      services:
-        - name: netbox-service
-          port: 8080
-  tls:
-    secretName: internal-wildcard-tls

netbox/k8s/namespace.yaml

@@ -1,4 +0,0 @@
-apiVersion: v1
-kind: Namespace
-metadata:
-  name: netbox

netbox/k8s/netbox.yaml

@@ -1,204 +0,0 @@
-apiVersion: v1
-kind: Service
-metadata:
-  name: netbox-service
-  namespace: netbox
-spec:
-  selector:
-    app: netbox
-  ports:
-    - name: http
-      port: 8080
-      targetPort: http
----
-apiVersion: apps/v1
-kind: Deployment
-metadata:
-  name: netbox-deployment
-  namespace: netbox
-  labels:
-    app: netbox
-spec:
-  replicas: 1
-  progressDeadlineSeconds: 300
-  selector:
-    matchLabels:
-      app: netbox
-  strategy:
-    # ReadWriteOnce PVC
-    type: Recreate
-  template:
-    metadata:
-      labels:
-        app: netbox
-    spec:
-      containers:
-        - name: netbox
-          image: docker.io/netboxcommunity/netbox:v4.7-5.1.1
-          ports:
-            - name: http
-              containerPort: 8080
-          envFrom:
-            - configMapRef:
-                name: netbox-config
-            - secretRef:
-                name: netbox-secrets
-          volumeMounts:
-            - name: netbox-config
-              mountPath: /etc/netbox/config
-              readOnly: true
-            - name: netbox-media
-              mountPath: /opt/netbox/netbox/media
-            - name: netbox-reports
-              mountPath: /opt/netbox/netbox/reports
-            - name: netbox-scripts
-              mountPath: /opt/netbox/netbox/scripts
-          startupProbe:
-            exec:
-              command:
-                - /opt/netbox/venv/bin/python
-                - -c
-                - >-
-                  exec /usr/bin/curl --fail --silent --show-error --max-time 4
-                  --header 'Host: netbox.forust.xyz'
-                  http://127.0.0.1:8080/login/ >/dev/null
-            failureThreshold: 90
-            periodSeconds: 10
-          readinessProbe:
-            exec:
-              command:
-                - /opt/netbox/venv/bin/python
-                - -c
-                - >-
-                  exec /usr/bin/curl --fail --silent --show-error --max-time 4
-                  --header 'Host: netbox.forust.xyz'
-                  http://127.0.0.1:8080/login/ >/dev/null
-            periodSeconds: 10
-          livenessProbe:
-            exec:
-              command:
-                - /opt/netbox/venv/bin/python
-                - -c
-                - >-
-                  exec /usr/bin/curl --fail --silent --show-error --max-time 4
-                  --header 'Host: netbox.forust.xyz'
-                  http://127.0.0.1:8080/login/ >/dev/null
-            initialDelaySeconds: 30
-            periodSeconds: 30
-          resources:
-            requests:
-              cpu: "100m"
-              memory: "512Mi"
-            limits:
-              cpu: "2"
-              memory: "2Gi"
-      volumes:
-        - name: netbox-config
-          configMap:
-            name: netbox-settings
-        - name: netbox-media
-          persistentVolumeClaim:
-            claimName: netbox-media-pvc
-        - name: netbox-reports
-          persistentVolumeClaim:
-            claimName: netbox-reports-pvc
-        - name: netbox-scripts
-          persistentVolumeClaim:
-            claimName: netbox-scripts-pvc
----
-apiVersion: apps/v1
-kind: Deployment
-metadata:
-  name: netbox-worker-deployment
-  namespace: netbox
-  labels:
-    app: netbox-worker
-spec:
-  replicas: 1
-  progressDeadlineSeconds: 300
-  selector:
-    matchLabels:
-      app: netbox-worker
-  strategy:
-    type: Recreate
-  template:
-    metadata:
-      labels:
-        app: netbox-worker
-    spec:
-      containers:
-        - name: netbox-worker
-          image: docker.io/netboxcommunity/netbox:v4.7-5.1.1
-          command:
-            - /opt/netbox/venv/bin/python
-            - netbox/manage.py
-            - rqworker
-          workingDir: /opt/netbox
-          envFrom:
-            - configMapRef:
-                name: netbox-config
-            - secretRef:
-                name: netbox-secrets
-          volumeMounts:
-            - name: netbox-config
-              mountPath: /etc/netbox/config
-              readOnly: true
-            - name: netbox-media
-              mountPath: /opt/netbox/netbox/media
-            - name: netbox-reports
-              mountPath: /opt/netbox/netbox/reports
-            - name: netbox-scripts
-              mountPath: /opt/netbox/netbox/scripts
-          resources:
-            requests:
-              cpu: "50m"
-              memory: "256Mi"
-            limits:
-              cpu: "1"
-              memory: "1Gi"
-      volumes:
-        - name: netbox-config
-          configMap:
-            name: netbox-settings
-        - name: netbox-media
-          persistentVolumeClaim:
-            claimName: netbox-media-pvc
-        - name: netbox-reports
-          persistentVolumeClaim:
-            claimName: netbox-reports-pvc
-        - name: netbox-scripts
-          persistentVolumeClaim:
-            claimName: netbox-scripts-pvc
----
-apiVersion: v1
-kind: PersistentVolumeClaim
-metadata:
-  name: netbox-media-pvc
-  namespace: netbox
-spec:
-  accessModes: ["ReadWriteOnce"]
-  resources:
-    requests:
-      storage: 2Gi
----
-apiVersion: v1
-kind: PersistentVolumeClaim
-metadata:
-  name: netbox-reports-pvc
-  namespace: netbox
-spec:
-  accessModes: ["ReadWriteOnce"]
-  resources:
-    requests:
-      storage: 1Gi
----
-apiVersion: v1
-kind: PersistentVolumeClaim
-metadata:
-  name: netbox-scripts-pvc
-  namespace: netbox
-spec:
-  accessModes: ["ReadWriteOnce"]
-  resources:
-    requests:
-      storage: 1Gi

netbox/k8s/secrets.yaml.example

@@ -1,18 +0,0 @@
-apiVersion: v1
-kind: Secret
-metadata:
-  name: netbox-secrets
-  namespace: netbox
-type: Opaque
-stringData:
-  DB_NAME: "netbox"
-  DB_USER: "netbox"
-  DB_PASSWORD: "CHANGE_ME_POSTGRES_PASSWORD"
-  REDIS_PASSWORD: "CHANGE_ME_VALKEY_PASSWORD"
-  REDIS_CACHE_PASSWORD: "CHANGE_ME_VALKEY_PASSWORD"
-  VALKEY_PASSWORD: "CHANGE_ME_VALKEY_PASSWORD"
-  SECRET_KEY: "CHANGE_ME_DJANGO_SECRET_KEY"
-  API_TOKEN_PEPPER_1: "CHANGE_ME_API_TOKEN_PEPPER"
-  SUPERUSER_NAME: "admin"
-  SUPERUSER_EMAIL: "admin@example.com"
-  SUPERUSER_PASSWORD: "CHANGE_ME_SUPERUSER_PASSWORD"

netbox/k8s/settings.yaml

@@ -1,56 +0,0 @@
-apiVersion: v1
-kind: ConfigMap
-metadata:
-  name: netbox-settings
-  namespace: netbox
-data:
-  # Sync wit netbox/configuration/configuration.py (the Docker mounts that file).
-  configuration.py: |
-    import os
-
-
-    def _csv(name, default=""):
-        return [item.strip() for item in os.environ.get(name, default).split(",") if item.strip()]
-
-
-    ALLOWED_HOSTS = _csv("ALLOWED_HOSTS", "localhost,127.0.0.1,[::1]")
-    CSRF_TRUSTED_ORIGINS = _csv("CSRF_TRUSTED_ORIGINS")
-    USE_X_FORWARDED_HOST = True
-    SECURE_PROXY_SSL_HEADER = ("HTTP_X_FORWARDED_PROTO", "https")
-
-    DATABASES = {
-        "default": {
-            "NAME": os.environ["DB_NAME"],
-            "USER": os.environ["DB_USER"],
-            "PASSWORD": os.environ["DB_PASSWORD"],
-            "HOST": os.environ["DB_HOST"],
-            "PORT": os.environ.get("DB_PORT", "5432"),
-            "OPTIONS": {"sslmode": os.environ.get("DB_SSLMODE", "disable")},
-            "CONN_MAX_AGE": int(os.environ.get("DB_CONN_MAX_AGE", "300")),
-        }
-    }
-
-    REDIS = {
-        "tasks": {
-            "HOST": os.environ["REDIS_HOST"],
-            "PORT": int(os.environ.get("REDIS_PORT", "6379")),
-            "PASSWORD": os.environ["REDIS_PASSWORD"],
-            "DATABASE": int(os.environ.get("REDIS_DATABASE", "0")),
-            "SSL": False,
-        },
-        "caching": {
-            "HOST": os.environ["REDIS_CACHE_HOST"],
-            "PORT": int(os.environ.get("REDIS_CACHE_PORT", "6379")),
-            "PASSWORD": os.environ["REDIS_CACHE_PASSWORD"],
-            "DATABASE": int(os.environ.get("REDIS_CACHE_DATABASE", "1")),
-            "SSL": False,
-        },
-    }
-
-    SECRET_KEY = os.environ["SECRET_KEY"]
-    API_TOKEN_PEPPERS = {1: os.environ["API_TOKEN_PEPPER_1"]}
-    TIME_ZONE = os.environ.get("TIME_ZONE", "UTC")
-    MEDIA_ROOT = "/opt/netbox/netbox/media"
-    REPORTS_ROOT = "/opt/netbox/netbox/reports"
-    SCRIPTS_ROOT = "/opt/netbox/netbox/scripts"
-    CENSUS_REPORTING_ENABLED = False

netbox/k8s/valkey.yaml

@@ -1,82 +0,0 @@
-apiVersion: v1
-kind: Service
-metadata:
-  name: netbox-valkey
-  namespace: netbox
-  labels:
-    app: netbox-valkey
-spec:
-  clusterIP: None
-  selector:
-    app: netbox-valkey
-  ports:
-    - name: valkey
-      port: 6379
-      targetPort: valkey
----
-apiVersion: apps/v1
-kind: StatefulSet
-metadata:
-  name: netbox-valkey
-  namespace: netbox
-  labels:
-    app: netbox-valkey
-spec:
-  serviceName: netbox-valkey
-  replicas: 1
-  selector:
-    matchLabels:
-      app: netbox-valkey
-  template:
-    metadata:
-      labels:
-        app: netbox-valkey
-    spec:
-      containers:
-        - name: valkey
-          image: docker.io/valkey/valkey:9.1.2-alpine
-          command:
-            - sh
-            - -c
-            - valkey-server --appendonly yes --save 30 1 --loglevel warning --requirepass "$VALKEY_PASSWORD"
-          env:
-            - name: VALKEY_PASSWORD
-              valueFrom:
-                secretKeyRef:
-                  name: netbox-secrets
-                  key: VALKEY_PASSWORD
-          ports:
-            - name: valkey
-              containerPort: 6379
-          volumeMounts:
-            - name: valkey-data
-              mountPath: /data
-          startupProbe:
-            exec:
-              command: ["sh", "-c", 'valkey-cli --pass "$VALKEY_PASSWORD" ping | grep -q PONG']
-            failureThreshold: 20
-            periodSeconds: 5
-          readinessProbe:
-            exec:
-              command: ["sh", "-c", 'valkey-cli --pass "$VALKEY_PASSWORD" ping | grep -q PONG']
-            periodSeconds: 10
-          livenessProbe:
-            exec:
-              command: ["sh", "-c", 'valkey-cli --pass "$VALKEY_PASSWORD" ping | grep -q PONG']
-            initialDelaySeconds: 20
-            periodSeconds: 20
-          resources:
-            requests:
-              cpu: "25m"
-              memory: "64Mi"
-            limits:
-              cpu: "250m"
-              memory: "256Mi"
-  volumeClaimTemplates:
-    - metadata:
-        name: valkey-data
-      spec:
-        accessModes: ["ReadWriteOnce"]
-        resources:
-          requests:
-            storage: 1Gi

netronome/compose.yaml

@@ -1,6 +1,6 @@
 services:
   netronome:
-    image: ghcr.io/autobrr/netronome:v0.14.1
+    image: ghcr.io/autobrr/netronome:v0.14.0
     restart: unless-stopped
     container_name: netronome
     ports:

netronome/k8s/netronome.yaml

@@ -30,7 +30,7 @@ spec:
     spec:
       containers:
         - name: netronome
-          image: ghcr.io/autobrr/netronome:v0.14.1
+          image: ghcr.io/autobrr/netronome:v0.14.0
           ports:
             - name: netronome-port
               protocol: TCP

postgres/README.md

@@ -1,7 +1,7 @@
 # Shared PostgreSQL
 
 This directory contains the shared PostgreSQL 17 deployment for Authentik,
-Gitea, NetBox, Netronome, and Statuspage. It creates one database and one login role
+Gitea, Netronome, and Statuspage. It creates one database and one login role
 per service. Per-service standalone databases were removed after the
 migration (Sep 2026); Penpot stays on its own compose PostgreSQL (archived,
 not part of the shared instance).
@@ -12,7 +12,6 @@ not part of the shared instance).
 | ---------- | ------------------- | -------------------------------------- |
 | Authentik  | 2025.10.x           | Supported (Authentik requires 14+)     |
 | Gitea      | 1.27.3              | Supported (Gitea requires 12+)         |
-| NetBox     | 4.7.x               | Supported (NetBox 4.x requires 13+)    |
 | Netronome  | 0.14.0              | Supported (upstream's example uses 17) |
 | Statuspage | custom              | Supported                              |
 

postgres/initdb/01-create-databases.sh

@@ -3,7 +3,6 @@ set -euo pipefail
 
 : "${AUTHENTIK_DB_PASSWORD:?AUTHENTIK_DB_PASSWORD is required}"
 : "${GITEA_DB_PASSWORD:?GITEA_DB_PASSWORD is required}"
-: "${NETBOX_DB_PASSWORD:?NETBOX_DB_PASSWORD is required}"
 : "${NETRONOME_DB_PASSWORD:?NETRONOME_DB_PASSWORD is required}"
 : "${PENPOT_DB_PASSWORD:?PENPOT_DB_PASSWORD is required}"
 : "${STATUSPAGE_DB_PASSWORD:?STATUSPAGE_DB_PASSWORD is required}"
@@ -24,7 +23,6 @@ SQL
 
 create_role_and_database authentik authentik "$AUTHENTIK_DB_PASSWORD"
 create_role_and_database gitea gitea "$GITEA_DB_PASSWORD"
-create_role_and_database netbox netbox "$NETBOX_DB_PASSWORD"
 create_role_and_database netronome netronome "$NETRONOME_DB_PASSWORD"
 create_role_and_database penpot penpot "$PENPOT_DB_PASSWORD"
 create_role_and_database statuspage statuspage "$STATUSPAGE_DB_PASSWORD"

postgres/k8s/network-policy.yaml

@@ -17,9 +17,6 @@ spec:
         - namespaceSelector:
             matchLabels:
               kubernetes.io/metadata.name: gitea
-        - namespaceSelector:
-            matchLabels:
-              kubernetes.io/metadata.name: netbox
         - namespaceSelector:
             matchLabels:
               kubernetes.io/metadata.name: netronome

postgres/k8s/postgres.yaml

@@ -113,7 +113,6 @@ data:
 
     : "${AUTHENTIK_DB_PASSWORD:?AUTHENTIK_DB_PASSWORD is required}"
     : "${GITEA_DB_PASSWORD:?GITEA_DB_PASSWORD is required}"
-    : "${NETBOX_DB_PASSWORD:?NETBOX_DB_PASSWORD is required}"
     : "${NETRONOME_DB_PASSWORD:?NETRONOME_DB_PASSWORD is required}"
     : "${PENPOT_DB_PASSWORD:?PENPOT_DB_PASSWORD is required}"
     : "${STATUSPAGE_DB_PASSWORD:?STATUSPAGE_DB_PASSWORD is required}"
@@ -134,7 +133,6 @@ data:
 
     create_role_and_database authentik authentik "$AUTHENTIK_DB_PASSWORD"
     create_role_and_database gitea gitea "$GITEA_DB_PASSWORD"
-    create_role_and_database netbox netbox "$NETBOX_DB_PASSWORD"
     create_role_and_database netronome netronome "$NETRONOME_DB_PASSWORD"
     create_role_and_database penpot penpot "$PENPOT_DB_PASSWORD"
     create_role_and_database statuspage statuspage "$STATUSPAGE_DB_PASSWORD"

postgres/k8s/secrets.yaml.example

@@ -8,7 +8,6 @@ stringData:
   POSTGRES_ADMIN_PASSWORD: ""
   AUTHENTIK_DB_PASSWORD: ""
   GITEA_DB_PASSWORD: ""
-  NETBOX_DB_PASSWORD: ""
   NETRONOME_DB_PASSWORD: ""
   PENPOT_DB_PASSWORD: ""
   STATUSPAGE_DB_PASSWORD: ""

prometheus-stack/compose.yaml

@@ -30,7 +30,7 @@ services:
       - proxy
 
   prometheus:
-    image: prom/prometheus:v3.15.0
+    image: prom/prometheus:v3.14.0
     container_name: prometheus-prometheus
     restart: unless-stopped
     command:

rackpeek/compose.yaml

@@ -1,34 +0,0 @@
-services:
-  rackpeek:
-    image: docker.io/aptacode/rackpeek:v2.1.0
-    container_name: rackpeek
-    restart: unless-stopped
-    ports:
-      - "127.0.0.1:8080:8080"
-    environment:
-      TZ: "Europe/Bratislava"
-    volumes:
-      - rackpeek-config:/app/config
-    networks:
-      - proxy
-    labels:
-      - "traefik.enable=true"
-      - "traefik.http.services.rackpeek.loadbalancer.server.port=8080"
-
-      # Local Router
-      - "traefik.http.routers.rackpeek-local.rule=Host(`rackpeek.workstation.internal`) || Host(`rack.workstation.internal`) || Host(`rackpeek.gigaforust.internal`) || Host(`rack.gigaforust.internal`)"
-      - "traefik.http.routers.rackpeek-local.entrypoints=websecure"
-      - "traefik.http.routers.rackpeek-local.tls=true"
-    healthcheck:
-      test: ["CMD-SHELL", "curl -fsS http://localhost:8080/health || exit 1"]
-      start_period: 15s
-      timeout: 5s
-      interval: 30s
-      retries: 3
-
-volumes:
-  rackpeek-config:
-
-networks:
-  proxy:
-    external: true

rackpeek/k8s/certificates.yaml

@@ -1,15 +0,0 @@
-apiVersion: cert-manager.io/v1
-kind: Certificate
-metadata:
-  name: internal-wildcard-tls
-  namespace: rackpeek
-spec:
-  secretName: internal-wildcard-tls
-  dnsNames:
-    - "*.workstation.internal"
-    - "*.gigaforust.internal"
-    - workstation.internal
-    - gigaforust.internal
-  issuerRef:
-    name: internal-ca
-    kind: ClusterIssuer

rackpeek/k8s/ingress.yaml

@@ -1,16 +0,0 @@
-apiVersion: traefik.io/v1alpha1
-kind: IngressRoute
-metadata:
-  name: rackpeek-local
-  namespace: rackpeek
-spec:
-  entryPoints:
-    - websecure
-  routes:
-    - match: Host(`rackpeek.workstation.internal`) || Host(`rack.workstation.internal`) || Host(`rackpeek.gigaforust.internal`) || Host(`rack.gigaforust.internal`)
-      kind: Rule
-      services:
-        - name: rackpeek-service
-          port: 8080
-  tls:
-    secretName: internal-wildcard-tls

rackpeek/k8s/namespace.yaml

@@ -1,4 +0,0 @@
-apiVersion: v1
-kind: Namespace
-metadata:
-  name: rackpeek

rackpeek/k8s/rackpeek.yaml

@@ -1,89 +0,0 @@
-apiVersion: v1
-kind: Service
-metadata:
-  name: rackpeek-service
-  namespace: rackpeek
-spec:
-  selector:
-    app: rackpeek
-  ports:
-    - name: http
-      port: 8080
-      targetPort: http
----
-apiVersion: apps/v1
-kind: Deployment
-metadata:
-  name: rackpeek-deployment
-  namespace: rackpeek
-  labels:
-    app: rackpeek
-spec:
-  replicas: 1
-  selector:
-    matchLabels:
-      app: rackpeek
-  strategy:
-    type: Recreate
-  template:
-    metadata:
-      labels:
-        app: rackpeek
-    spec:
-      securityContext:
-        # Image runs as uid/gid 1654
-        fsGroup: 1654
-      containers:
-        - name: rackpeek
-          image: docker.io/aptacode/rackpeek:v2.1.0
-          ports:
-            - name: http
-              containerPort: 8080
-          env:
-            - name: RPK_YAML_DIR
-              value: "/app/config"
-            - name: TZ
-              value: "Europe/Bratislava"
-          volumeMounts:
-            - name: rackpeek-config
-              mountPath: /app/config
-          startupProbe:
-            httpGet:
-              path: /health
-              port: http
-            failureThreshold: 30
-            periodSeconds: 5
-          readinessProbe:
-            httpGet:
-              path: /health
-              port: http
-            periodSeconds: 10
-          livenessProbe:
-            httpGet:
-              path: /health
-              port: http
-            initialDelaySeconds: 20
-            periodSeconds: 30
-          resources:
-            requests:
-              memory: "128Mi"
-              cpu: "100m"
-            limits:
-              memory: "512Mi"
-              cpu: "500m"
-      volumes:
-        - name: rackpeek-config
-          persistentVolumeClaim:
-            claimName: rackpeek-pvc
----
-apiVersion: v1
-kind: PersistentVolumeClaim
-metadata:
-  name: rackpeek-pvc
-  namespace: rackpeek
-spec:
-  accessModes: ["ReadWriteOnce"]
-  storageClassName: local-path-retain
-  resources:
-    requests:
-      storage: 2Gi

renovate.json

@@ -1,13 +1,7 @@
 {
   "$schema": "https://docs.renovatebot.com/renovate-schema.json",
   "extends": ["config:recommended"],
-  "enabledManagers": [
+  "enabledManagers": ["dockerfile", "docker-compose", "kubernetes", "helm-values", "custom.regex"],
-    "dockerfile",
-    "docker-compose",
-    "kubernetes",
-    "helm-values",
-    "custom.regex"
-  ],
   "helm-values": {
     "managerFilePatterns": ["/k8s/.+values\\.ya?ml$/"]
   },
@@ -18,10 +12,7 @@
     {
       "customType": "regex",
       "description": "singlesource: playwright npm version pinned in npx command (k8s + compose)",
-      "managerFilePatterns": [
+      "fileMatch": ["^edu_master/k8s/playwright\\.yaml$", "^edu_master/compose\\.yaml$"],
-        "/^edu_master/k8s/playwright\\.yaml$/",
-        "/^edu_master/compose\\.yaml$/"
-      ],
       "matchStrings": ["playwright@(?<currentValue>\\d+\\.\\d+\\.\\d+)"],
       "datasourceTemplate": "npm",
       "depNameTemplate": "playwright"
@@ -29,7 +20,7 @@
     {
       "customType": "regex",
       "description": "singlesource: PLAYWRIGHT_VERSION file",
-      "managerFilePatterns": ["/^edu_master/PLAYWRIGHT_VERSION$/"],
+      "fileMatch": ["^edu_master/PLAYWRIGHT_VERSION$"],
       "matchStrings": ["^(?<currentValue>\\d+\\.\\d+\\.\\d+)$"],
       "datasourceTemplate": "pypi",
       "depNameTemplate": "playwright"

renovate/k8s/cronjob.yaml

@@ -16,7 +16,7 @@ spec:
           restartPolicy: Never
           containers:
             - name: renovate
-              image: renovate/renovate:44.115.9
+              image: renovate/renovate:44.115.4
               env:
                 - name: RENOVATE_PLATFORM
                   value: gitea

traefik/compose.yaml

@@ -20,7 +20,6 @@ services:
       - "--entryPoints.web.http.redirections.entryPoint.scheme=https"
       - "--entryPoints.web.http.redirections.entryPoint.to=websecure"
       - "--entryPoints.websecure.address=:443"
-      - "--entrypoints.websecure.transport.respondingTimeouts.readTimeout=0"
       - "--entryPoints.websecure.http.middlewares=error-pages@docker"
       - "--entryPoints.websecure.http.tls=true"
       - "--entryPoints.ssh.address=:2221"

traefik/k8s/traefik-values.yaml

@@ -86,12 +86,6 @@ ports:
     protocol: UDP
     expose:
       default: true
-  netbird-stun:
-    port: 3478
-    exposedPort: 3478
-    protocol: UDP
-    expose:
-      default: true
   checkmk-agent:
     port: 8000
     protocol: TCP