chore(deps): update ghcr.io/henriquesebastiao/downtify docker tag to v3

Reviewed-on: https://gitea.forust.xyz/forust/homelab/pulls/41

.gitea/workflows/ci.yaml

@@ -7,6 +7,10 @@ on:
   pull_request:
   workflow_dispatch:
 
+concurrency:
+  group: ci-${{ github.ref }}
+  cancel-in-progress: ${{ github.ref != 'refs/heads/main' }}
+
 env:
   REGISTRY: gcr.forust.xyz
 
@@ -15,7 +19,7 @@ jobs:
     runs-on: [self-hosted, linux, arch, homelab]
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v4
+        uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
 
       - name: Check formatting with Prettier
         shell: bash
@@ -31,47 +35,46 @@ jobs:
             exit 0
           fi
 
-          docker run --rm \
-            -v "$PWD:/work" \
-            -w /work \
-            node:22-alpine \
-            sh -lc 'npx --yes prettier@3 --check --ignore-unknown "$@"' sh "${prettier_files[@]}"
+          prettier --check --ignore-unknown "${prettier_files[@]}"
 
   lint-ruff:
     runs-on: [self-hosted, linux, arch, homelab]
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v4
+        uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
 
       - name: Lint Python with Ruff
         shell: bash
         run: |
-          docker run --rm \
-            -v "$PWD:/work" \
-            -w /work \
-            ghcr.io/astral-sh/ruff:latest \
-            check .
+          ruff check .
 
   lint-yaml:
     runs-on: [self-hosted, linux, arch, homelab]
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v4
+        uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
 
       - name: Lint YAML syntax
         shell: bash
         run: |
-          docker run --rm \
-            -v "$PWD:/work" \
-            -w /work \
-            cytopia/yamllint:latest \
-            -c .yamllint .
+          mapfile -t yaml_files < <(
+            git ls-files '*.yaml' '*.yml' \
+              ':!node_modules/**' \
+              ':!**/.venv/**'
+          )
+
+          if [ "${#yaml_files[@]}" -eq 0 ]; then
+            echo "No YAML files found."
+            exit 0
+          fi
+
+          yamllint -c .yamllint "${yaml_files[@]}"
 
   lint-dockerfiles:
     runs-on: [self-hosted, linux, arch, homelab]
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v4
+        uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
 
       - name: Lint Dockerfiles
         shell: bash
@@ -85,18 +88,13 @@ jobs:
             exit 0
           fi
 
-          docker run --rm \
-            -v "$PWD:/work" \
-            -w /work \
-            --entrypoint hadolint \
-            hadolint/hadolint:latest-debian \
-            -c .hadolint.yaml "${dockerfiles[@]}"
+          hadolint -c .hadolint.yaml "${dockerfiles[@]}"
 
   validate:
     runs-on: [self-hosted, linux, arch, homelab]
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v4
+        uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
 
       - name: Validate Kubernetes manifests
         shell: bash
@@ -111,10 +109,7 @@ jobs:
             exit 0
           fi
 
-          docker run --rm \
-            -v "$PWD:/work" \
-            -w /work \
-            ghcr.io/yannh/kubeconform:latest \
+          kubeconform \
             -strict \
             -ignore-missing-schemas \
             -summary \
@@ -128,7 +123,7 @@ jobs:
       services: ${{ steps.services.outputs.services }}
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v4
+        uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
         with:
           fetch-depth: 0
 
@@ -219,7 +214,10 @@ jobs:
                 for tag in "${tags[@]}"; do
                   build_args+=(-t "${image}:${tag}")
                 done
-                docker build "${build_args[@]}" dtek_notif
+                docker build \
+                  --cache-from "type=registry,ref=${image}:buildcache" \
+                  --cache-to "type=registry,ref=${image}:buildcache,mode=max" \
+                  "${build_args[@]}" dtek_notif
                 for tag in "${tags[@]}"; do
                   docker push "${image}:${tag}"
                 done
@@ -239,7 +237,10 @@ jobs:
                 for tag in "${tags[@]}"; do
                   build_args+=(-t "${image}:${tag}")
                 done
-                docker build "${build_args[@]}" errorpages
+                docker build \
+                  --cache-from "type=registry,ref=${image}:buildcache" \
+                  --cache-to "type=registry,ref=${image}:buildcache,mode=max" \
+                  "${build_args[@]}" errorpages
                 for tag in "${tags[@]}"; do
                   docker push "${image}:${tag}"
                 done
@@ -269,7 +270,10 @@ jobs:
                   for tag in "${tags[@]}"; do
                     build_args+=(-t "${image}:${tag}")
                   done
-                  docker build "${build_args[@]}" "$context"
+                  docker build \
+                    --cache-from "type=registry,ref=${image}:buildcache" \
+                    --cache-to "type=registry,ref=${image}:buildcache,mode=max" \
+                    "${build_args[@]}" "$context"
                   for tag in "${tags[@]}"; do
                     docker push "${image}:${tag}"
                   done
@@ -298,7 +302,10 @@ jobs:
                   for tag in "${tags[@]}"; do
                     build_args+=(-t "${image}:${tag}")
                   done
-                  docker build "${build_args[@]}" -f "homepages/Dockerfile.${service}" homepages
+                  docker build \
+                    --cache-from "type=registry,ref=${image}:buildcache" \
+                    --cache-to "type=registry,ref=${image}:buildcache,mode=max" \
+                    "${build_args[@]}" -f "homepages/Dockerfile.${service}" homepages
                   for tag in "${tags[@]}"; do
                     docker push "${image}:${tag}"
                   done
@@ -329,7 +336,10 @@ jobs:
                   for tag in "${tags[@]}"; do
                     build_args+=(-t "${image}:${tag}")
                   done
-                  docker build "${build_args[@]}" "$context"
+                  docker build \
+                    --cache-from "type=registry,ref=${image}:buildcache" \
+                    --cache-to "type=registry,ref=${image}:buildcache,mode=max" \
+                    "${build_args[@]}" "$context"
                   for tag in "${tags[@]}"; do
                     docker push "${image}:${tag}"
                   done
@@ -344,7 +354,7 @@ jobs:
     runs-on: [self-hosted, linux, arch, homelab, prod]
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v4
+        uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
 
       - name: Apply and roll out userbot panel
         shell: bash

.gitea/workflows/deploy.yaml

@@ -1,9 +1,6 @@
 name: deploy
 
 on:
-  push:
-    branches:
-      - main
   workflow_dispatch:
 
 concurrency:
@@ -133,6 +130,30 @@ jobs:
             echo "  namespaces first: ${ns_files[*]}"
             kubectl apply -f "${ns_files[@]}"
           fi
+          if [ -f "$repo/prometheus-stack/k8s/active" ]; then
+            echo "== Upgrading kube-prometheus-stack =="
+            helm upgrade --install prometheus-stack prometheus-community/kube-prometheus-stack \
+              --namespace prometheus \
+              --version 86.2.3 \
+              --values "$repo/prometheus-stack/k8s/grafana-values.yaml" \
+              --wait
+          fi
+          if [ -f "$repo/loki/k8s/active" ]; then
+            echo "== Upgrading loki/alloy =="
+            helm repo add grafana https://grafana.github.io/helm-charts >/dev/null 2>&1 || true
+            helm repo update grafana >/dev/null 2>&1 || true
+            helm upgrade --install loki grafana/loki \
+              --version 7.3.0 \
+              --namespace prometheus \
+              --values "$repo/loki/k8s/loki-values.yaml" \
+              --wait
+            helm upgrade --install alloy grafana/alloy \
+              --version 1.12.1 \
+              --namespace prometheus \
+              --values "$repo/loki/k8s/alloy-values.yaml" \
+              --wait
+          fi
+
           if [ "${#other_files[@]}" -gt 0 ]; then
             echo "  resources: ${other_files[*]}"
             kubectl apply "${prune_opts[@]}" -f "${other_files[@]}"

.gitea/workflows/renovate-ci.yaml

@@ -0,0 +1,52 @@
+name: renovate-ci
+
+on:
+  pull_request:
+  push:
+    branches:
+      - main
+  workflow_dispatch:
+
+jobs:
+  validate-renovate:
+    runs-on: [self-hosted, linux, arch, homelab]
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
+
+      - name: Validate Renovate Compose draft
+        shell: bash
+        run: |
+          set -euo pipefail
+          trap 'rm -f renovate/.env' EXIT
+          printf '%s\n' \
+            'RENOVATE_ENDPOINT=https://gitea.example/api/v1' \
+            'RENOVATE_TOKEN=test-token' \
+            'RENOVATE_REPOSITORIES=forust/homelab' \
+            > renovate/.env
+          docker compose -f renovate/renovate-compose.yaml config --quiet
+
+      - name: Validate Kubernetes manifests
+        shell: bash
+        run: |
+          set -euo pipefail
+          docker run --rm \
+            -v "$PWD:/work" \
+            -w /work \
+            ghcr.io/yannh/kubeconform:latest \
+            -strict \
+            -ignore-missing-schemas \
+            -summary \
+            renovate/k8s/namespace.yaml \
+            renovate/k8s/configmap.yaml \
+            renovate/k8s/cronjob.yaml
+
+      - name: Validate Renovate repository config
+        shell: bash
+        run: |
+          set -euo pipefail
+          docker run --rm \
+            -v "$PWD:/work" \
+            -w /work \
+            renovate/renovate:44.103.0 \
+            renovate-config-validator renovate.json

.gitea/workflows/renovate-run.yaml

@@ -0,0 +1,69 @@
+name: renovate-run
+
+on:
+  workflow_dispatch:
+    inputs:
+      repositories:
+        description: "Repositories to scan (comma-separated)"
+        required: false
+        default: "forust/homelab"
+      log_level:
+        description: "Renovate log level"
+        required: false
+        default: "info"
+        type: choice
+        options:
+          - info
+          - debug
+      dry_run:
+        description: "Plan only, do not open or update PRs"
+        required: false
+        default: false
+        type: boolean
+
+concurrency:
+  group: renovate-run
+  cancel-in-progress: false
+
+jobs:
+  run-renovate:
+    runs-on: [self-hosted, linux, arch, homelab]
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
+
+      - name: Validate Renovate config
+        shell: bash
+        run: |
+          set -euo pipefail
+          docker run --rm \
+            -v "$PWD/renovate/config.js:/opt/renovate/config.js:ro" \
+            -e RENOVATE_CONFIG_FILE=/opt/renovate/config.js \
+            renovate/renovate:44.103.0 \
+            renovate-config-validator
+
+      - name: Run Renovate
+        shell: bash
+        env:
+          RENOVATE_TOKEN: ${{ secrets.RENOVATE_TOKEN }}
+          RENOVATE_GITHUB_COM_TOKEN: ${{ secrets.RENOVATE_GITHUB_COM_TOKEN }}
+          RENOVATE_REPOSITORIES: ${{ inputs.repositories }}
+          RENOVATE_DRY_RUN: ${{ inputs.dry_run && 'full' || '' }}
+          LOG_LEVEL: ${{ inputs.log_level }}
+        run: |
+          set -euo pipefail
+
+          : "${RENOVATE_TOKEN:?missing RENOVATE_TOKEN secret — add a renovate-bot PAT in repo/org Actions secrets}"
+
+          docker run --rm \
+            -v "$PWD/renovate/config.js:/opt/renovate/config.js:ro" \
+            -e RENOVATE_PLATFORM=gitea \
+            -e RENOVATE_ENDPOINT=https://gitea.forust.xyz/api/v1 \
+            -e RENOVATE_TOKEN="$RENOVATE_TOKEN" \
+            -e RENOVATE_GITHUB_COM_TOKEN="${RENOVATE_GITHUB_COM_TOKEN:-}" \
+            -e RENOVATE_REPOSITORIES="${RENOVATE_REPOSITORIES:-forust/homelab}" \
+            -e RENOVATE_DRY_RUN="${RENOVATE_DRY_RUN:-}" \
+            -e RENOVATE_CONFIG_FILE=/opt/renovate/config.js \
+            -e RENOVATE_BASE_DIR=/tmp/renovate \
+            -e LOG_LEVEL="${LOG_LEVEL:-info}" \
+            renovate/renovate:44.103.0

.github/workflows/ci.yaml

@@ -1,359 +0,0 @@
-name: ci
-
-on:
-  push:
-    branches:
-      - "**"
-  pull_request:
-  workflow_dispatch:
-
-env:
-  REGISTRY: gcr.forust.xyz
-
-jobs:
-  lint-prettier:
-    runs-on: [self-hosted, linux, arch, homelab]
-    steps:
-      - name: Checkout repository
-        uses: actions/checkout@v4
-
-      - name: Check formatting with Prettier
-        shell: bash
-        run: |
-          mapfile -t prettier_files < <(
-            git ls-files \
-              | grep -E '\.(md|json|ya?ml|html|css)$' \
-              | grep -Ev '^(\.docs/|\.zed/|errorpages/html/|homepages/(forust_files|xdfnx_files)/)'
-          )
-
-          if [ "${#prettier_files[@]}" -eq 0 ]; then
-            echo "No Prettier-managed files found."
-            exit 0
-          fi
-
-          docker run --rm \
-            -v "$PWD:/work" \
-            -w /work \
-            node:22-alpine \
-            sh -lc 'npx --yes prettier@3 --check --ignore-unknown "$@"' sh "${prettier_files[@]}"
-
-  lint-ruff:
-    runs-on: [self-hosted, linux, arch, homelab]
-    steps:
-      - name: Checkout repository
-        uses: actions/checkout@v4
-
-      - name: Lint Python with Ruff
-        shell: bash
-        run: |
-          docker run --rm \
-            -v "$PWD:/work" \
-            -w /work \
-            ghcr.io/astral-sh/ruff:latest \
-            check .
-
-  lint-yaml:
-    runs-on: [self-hosted, linux, arch, homelab]
-    steps:
-      - name: Checkout repository
-        uses: actions/checkout@v4
-
-      - name: Lint YAML syntax
-        shell: bash
-        run: |
-          docker run --rm \
-            -v "$PWD:/work" \
-            -w /work \
-            cytopia/yamllint:latest \
-            -c .yamllint .
-
-  lint-dockerfiles:
-    runs-on: [self-hosted, linux, arch, homelab]
-    steps:
-      - name: Checkout repository
-        uses: actions/checkout@v4
-
-      - name: Lint Dockerfiles
-        shell: bash
-        run: |
-          mapfile -t dockerfiles < <(
-            git ls-files ':(glob)**/Dockerfile' ':(glob)**/Dockerfile.*'
-          )
-
-          if [ "${#dockerfiles[@]}" -eq 0 ]; then
-            echo "No Dockerfiles found."
-            exit 0
-          fi
-
-          docker run --rm \
-            -v "$PWD:/work" \
-            -w /work \
-            --entrypoint hadolint \
-            hadolint/hadolint:latest-debian \
-            -c .hadolint.yaml "${dockerfiles[@]}"
-
-  validate:
-    runs-on: [self-hosted, linux, arch, homelab]
-    steps:
-      - name: Checkout repository
-        uses: actions/checkout@v4
-
-      - name: Validate Kubernetes manifests
-        shell: bash
-        run: |
-          mapfile -t manifests < <(
-            git ls-files ':(glob)**/k8s/**/*.yaml' ':(glob)**/k8s/**/*.yml' \
-              | grep -Ev '(^|/)(kustomization\.ya?ml|.*\.example\.ya?ml|.*values\.ya?ml|patch-.*\.ya?ml)$'
-          )
-
-          if [ "${#manifests[@]}" -eq 0 ]; then
-            echo "No Kubernetes manifests found."
-            exit 0
-          fi
-
-          docker run --rm \
-            -v "$PWD:/work" \
-            -w /work \
-            ghcr.io/yannh/kubeconform:latest \
-            -strict \
-            -ignore-missing-schemas \
-            -summary \
-            "${manifests[@]}"
-
-  build:
-    needs: [lint-prettier, lint-ruff, lint-yaml, lint-dockerfiles, validate]
-    if: github.event_name != 'pull_request' && (github.ref_name == 'main' || github.ref_name == 'dev')
-    runs-on: [self-hosted, linux, arch, homelab]
-    outputs:
-      services: ${{ steps.services.outputs.services }}
-    steps:
-      - name: Checkout repository
-        uses: actions/checkout@v4
-        with:
-          fetch-depth: 0
-
-      - name: Detect changed docker-built services
-        id: services
-        shell: bash
-        run: |
-          base="${{ github.event.before }}"
-          if [ -z "$base" ] || [ "$base" = "0000000000000000000000000000000000000000" ]; then
-            base="$(git rev-list --max-parents=0 HEAD)"
-          fi
-
-          mapfile -t changed_files < <(git diff --name-only "$base" "${GITHUB_SHA}")
-
-          services=()
-
-          add_service() {
-            local name="$1"
-            local seen=0
-            for existing in "${services[@]}"; do
-              if [ "$existing" = "$name" ]; then
-                seen=1
-                break
-              fi
-            done
-            if [ "$seen" -eq 0 ]; then
-              services+=("$name")
-            fi
-          }
-
-          for file in "${changed_files[@]}"; do
-            case "$file" in
-              dtek_notif/*)
-                add_service dtek_notif
-                ;;
-              errorpages/*)
-                add_service errorpages
-                ;;
-              userbot/*)
-                add_service userbot
-                ;;
-              homepages/*)
-                add_service homepages
-                ;;
-              edu_master/phpsessid-bot/*|edu_master/webinar-checker/*|edu_master/compose.yaml)
-                add_service edu_master
-                ;;
-            esac
-          done
-
-          if [ "${#services[@]}" -eq 0 ]; then
-            echo "No docker-built services changed."
-            echo "services=" >> "$GITHUB_OUTPUT"
-            exit 0
-          fi
-
-          printf '%s\n' "${services[@]}" | tee /tmp/services.txt
-          echo "services=$(paste -sd, /tmp/services.txt)" >> "$GITHUB_OUTPUT"
-
-      - name: Log in to registry
-        if: steps.services.outputs.services != ''
-        shell: bash
-        run: |
-          echo "${{ secrets.REGISTRY_PASSWORD }}" | docker login "${REGISTRY}" \
-            -u "${{ secrets.REGISTRY_USERNAME }}" \
-            --password-stdin
-
-      - name: Build and push changed images
-        if: steps.services.outputs.services != ''
-        shell: bash
-        run: |
-          IFS=, read -r -a services <<< "${{ steps.services.outputs.services }}"
-
-          for service in "${services[@]}"; do
-            case "$service" in
-              dtek_notif)
-                image="${REGISTRY}/forust/dtek-notif"
-                tags=("latest")
-                case "${GITHUB_REF_NAME}" in
-                  main)
-                    tags+=("main" "prod")
-                    ;;
-                  dev)
-                    tags+=("dev")
-                    ;;
-                esac
-                build_args=()
-                for tag in "${tags[@]}"; do
-                  build_args+=(-t "${image}:${tag}")
-                done
-                docker build "${build_args[@]}" dtek_notif
-                for tag in "${tags[@]}"; do
-                  docker push "${image}:${tag}"
-                done
-                ;;
-              errorpages)
-                image="${REGISTRY}/forust/error-pages"
-                tags=("latest")
-                case "${GITHUB_REF_NAME}" in
-                  main)
-                    tags+=("main" "prod")
-                    ;;
-                  dev)
-                    tags+=("dev")
-                    ;;
-                esac
-                build_args=()
-                for tag in "${tags[@]}"; do
-                  build_args+=(-t "${image}:${tag}")
-                done
-                docker build "${build_args[@]}" errorpages
-                for tag in "${tags[@]}"; do
-                  docker push "${image}:${tag}"
-                done
-                ;;
-              userbot)
-                tags=("latest")
-                case "${GITHUB_REF_NAME}" in
-                  main)
-                    tags+=("main" "prod")
-                    ;;
-                  dev)
-                    tags+=("dev")
-                    ;;
-                esac
-                for target in runtime panel; do
-                  case "$target" in
-                    runtime)
-                      context="userbot"
-                      image="${REGISTRY}/forust/userbot"
-                      ;;
-                    panel)
-                      context="userbot/panel"
-                      image="${REGISTRY}/forust/userbot-panel"
-                      ;;
-                  esac
-                  build_args=()
-                  for tag in "${tags[@]}"; do
-                    build_args+=(-t "${image}:${tag}")
-                  done
-                  docker build "${build_args[@]}" "$context"
-                  for tag in "${tags[@]}"; do
-                    docker push "${image}:${tag}"
-                  done
-                done
-                ;;
-              homepages)
-                for service in forust xdfnx; do
-                  case "$service" in
-                    forust)
-                      image="${REGISTRY}/forust/forust-homepage"
-                      ;;
-                    xdfnx)
-                      image="${REGISTRY}/forust/xdfnx-homepage"
-                      ;;
-                  esac
-                  tags=("latest")
-                  case "${GITHUB_REF_NAME}" in
-                    main)
-                      tags+=("main" "prod")
-                      ;;
-                    dev)
-                      tags+=("dev")
-                      ;;
-                  esac
-                  build_args=()
-                  for tag in "${tags[@]}"; do
-                    build_args+=(-t "${image}:${tag}")
-                  done
-                  docker build "${build_args[@]}" -f "homepages/Dockerfile.${service}" homepages
-                  for tag in "${tags[@]}"; do
-                    docker push "${image}:${tag}"
-                  done
-                done
-                ;;
-              edu_master)
-                for service in session-keeper webinar-checker; do
-                  case "$service" in
-                    session-keeper)
-                      context="edu_master/phpsessid-bot"
-                      image="${REGISTRY}/forust/session-keeper"
-                      ;;
-                    webinar-checker)
-                      context="edu_master/webinar-checker"
-                      image="${REGISTRY}/forust/webinar-checker"
-                      ;;
-                  esac
-                  tags=("latest")
-                  case "${GITHUB_REF_NAME}" in
-                    main)
-                      tags+=("main" "prod")
-                      ;;
-                    dev)
-                      tags+=("dev")
-                      ;;
-                  esac
-                  build_args=()
-                  for tag in "${tags[@]}"; do
-                    build_args+=(-t "${image}:${tag}")
-                  done
-                  docker build "${build_args[@]}" "$context"
-                  for tag in "${tags[@]}"; do
-                    docker push "${image}:${tag}"
-                  done
-                done
-                ;;
-            esac
-          done
-
-  deploy-userbot-panel:
-    needs: build
-    if: github.ref_name == 'main' && contains(needs.build.outputs.services, 'userbot')
-    runs-on: [self-hosted, linux, arch, homelab, prod]
-    steps:
-      - name: Checkout repository
-        uses: actions/checkout@v4
-
-      - name: Apply and roll out userbot panel
-        shell: bash
-        run: |
-          kubectl apply -f userbot/k8s/base/panel.yaml
-          kubectl get secret userbot-common-secrets -n default -o json \
-            | jq 'del(.metadata.annotations,.metadata.creationTimestamp,.metadata.resourceVersion,.metadata.uid,.metadata.managedFields) | .metadata.namespace = "userbot"' \
-            | kubectl apply -f -
-          # Keep legacy deployments (forust/anna) in sync with manifests; they have no replicas field, so apply leaves scaling to the user manager only.
-          kubectl apply -f userbot/k8s/base/userbots.yaml
-          kubectl rollout restart deployment/userbot-panel -n userbot
-          kubectl rollout status deployment/userbot-panel -n userbot --timeout=180s

.github/workflows/deploy.yaml

@@ -1,155 +0,0 @@
-name: deploy
-
-on:
-  push:
-    branches:
-      - main
-  workflow_dispatch:
-
-concurrency:
-  group: deploy-main
-  cancel-in-progress: false
-
-jobs:
-  redeploy:
-    runs-on: [self-hosted, linux, arch, homelab, prod]
-    steps:
-      - name: Redeploy workstation
-        shell: bash
-        env:
-          DEPLOY_HOST: ${{ secrets.DEPLOY_HOST }}
-          DEPLOY_PORT: ${{ secrets.DEPLOY_PORT }}
-          DEPLOY_USER: ${{ secrets.DEPLOY_USER }}
-          DEPLOY_PATH: ${{ secrets.DEPLOY_PATH }}
-          DEPLOY_KEY: ${{ secrets.DEPLOY_SSH_KEY }}
-          # Set APPLY_PRUNE=true to enable kubectl apply --prune. Requires every
-          # manifest to carry label app.kubernetes.io/managed-by=homelab-deploy,
-          # otherwise previously applied resources get deleted on the next run.
-          APPLY_PRUNE: ${{ vars.APPLY_PRUNE }}
-        run: |
-          set -euo pipefail
-
-          : "${DEPLOY_HOST:?missing DEPLOY_HOST}"
-          : "${DEPLOY_USER:?missing DEPLOY_USER}"
-          : "${DEPLOY_KEY:?missing DEPLOY_SSH_KEY}"
-
-          deploy_port="${DEPLOY_PORT:-22}"
-          deploy_path="${DEPLOY_PATH:-/srv/homelab}"
-
-          ssh_key="$RUNNER_TEMP/deploy_key"
-          mkdir -p "$RUNNER_TEMP"
-          printf '%s\n' "$DEPLOY_KEY" > "$ssh_key"
-          chmod 600 "$ssh_key"
-
-          ssh_opts=(
-            -i "$ssh_key"
-            -p "$deploy_port"
-            -o BatchMode=yes
-            -o StrictHostKeyChecking=accept-new
-          )
-
-          ssh "${ssh_opts[@]}" "${DEPLOY_USER}@${DEPLOY_HOST}" \
-            "DEPLOY_PATH=$(printf '%q' \"$deploy_path\") APPLY_PRUNE=$(printf '%q' \"${APPLY_PRUNE:-false}\") bash -se" <<'EOF'
-          set -euo pipefail
-
-          repo="${DEPLOY_PATH:-/srv/homelab}"
-
-          if [ ! -d "$repo/.git" ]; then
-            echo "Repository not found at $repo"
-            exit 1
-          fi
-
-          git -C "$repo" fetch origin main
-          git -C "$repo" reset --hard origin/main
-
-          # Runtime selection: a service is k8s-managed when $SERVICE/k8s/active
-          # exists. Otherwise it is compose-managed, and only k8s/routing/*
-          # manifests (external Services / EndpointSlices / ServersTransport /
-          # Ingresses that route to docker backends) are applied.
-          #   migrate:   touch SERVICE/k8s/active   (+ move routing files up)
-          #   rollback:  rm SERVICE/k8s/active
-          collect_k8s() {
-            find "$1" -type f \( -name '*.yaml' -o -name '*.yml' \) \
-              ! -path '*/routing/*' ! -path '*/overlays/*' \
-              ! -name 'kustomization.y*ml' ! -name '*.example.y*ml' \
-              ! -name '*values.y*ml' ! -name 'patch-*.y*ml' \
-              | sort
-          }
-
-          collect_k8s_inactive() {
-            find "$1" -type f \( -name '*.yaml' -o -name '*.yml' \) \
-              \( -name 'namespace.y*ml' -o -path '*/routing/*' \) \
-              ! -path '*/overlays/*' ! -name '*.example.y*ml' \
-              | sort
-          }
-
-          mapfile -t compose_stacks < <(
-            find "$repo" -type f \( -name 'compose.yaml' -o -name 'compose.yml' \) | sort
-          )
-
-          mapfile -t k8s_manifests < <(
-            for kd in $(find "$repo" -type d -name k8s ! -path '*/.git/*' | sort); do
-              if [ -f "$kd/active" ]; then
-                collect_k8s "$kd"
-              else
-                collect_k8s_inactive "$kd"
-              fi
-            done
-          )
-
-          echo "== Validate compose stacks =="
-          for cf in "${compose_stacks[@]}"; do
-            dir=$(dirname "$cf")
-            if [ -f "$dir/k8s/active" ]; then
-              echo "  skip (k8s-managed): $dir"
-              continue
-            fi
-            echo "  config: $cf"
-            docker compose -f "$cf" config --quiet
-          done
-
-          echo "== Validate k8s manifests (kubectl dry-run) =="
-          for m in "${k8s_manifests[@]}"; do
-            echo "  apply --dry-run=client $m"
-            kubectl apply --dry-run=client -f "$m" >/dev/null
-          done
-
-          echo "== Applying Kubernetes manifests =="
-          ns_files=()
-          other_files=()
-          for m in "${k8s_manifests[@]}"; do
-            case "$m" in
-              */namespace.y?ml) ns_files+=("$m") ;;
-              *) other_files+=("$m") ;;
-            esac
-          done
-
-          prune_opts=()
-          if [ "${APPLY_PRUNE:-false}" = "true" ]; then
-            prune_opts=(--prune -l app.kubernetes.io/managed-by=homelab-deploy)
-          fi
-
-          if [ "${#ns_files[@]}" -gt 0 ]; then
-            echo "  namespaces first: ${ns_files[*]}"
-            kubectl apply -f "${ns_files[@]}"
-          fi
-          if [ "${#other_files[@]}" -gt 0 ]; then
-            echo "  resources: ${other_files[*]}"
-            kubectl apply "${prune_opts[@]}" -f "${other_files[@]}"
-          fi
-
-          echo "== Redeploying docker compose stacks =="
-          for cf in "${compose_stacks[@]}"; do
-            dir=$(dirname "$cf")
-            if [ -f "$dir/k8s/active" ]; then
-              echo "  skip (k8s-managed): $dir"
-              continue
-            fi
-            echo "  compose: $dir"
-            if grep -Eq '^\s+pull_policy:\s*build\b' "$cf"; then
-              docker compose -f "$cf" build
-              docker compose -f "$cf" push
-            fi
-            docker compose -f "$cf" up -d --pull always --remove-orphans
-          done
-          EOF

.gitignore

@@ -41,6 +41,7 @@ traefik/dynamic/fileservers.yml
 traefik/dynamic/*.local.y*ml.*
 traefik/dynamic/*.external.y*ml
 traefik/k8s/fileservers.y*ml
+traefik/k8s/aliasHeadersStrategy.md
 
 traefik/logs/*
 
@@ -103,6 +104,10 @@ temp/*
 # kubernetes
 */k8s/*secret*
 !*/k8s/*secret*.example
+**/k8s/*secret*
+!**/k8s/*secret*.example
+# Local-only tweaks, not for upstream
+prometheus-stack/k8s/grafana-values.yaml
 traefik/k8s/local-tls.yaml
 converters/k8s/config.yaml
 convertx/k8s/config.yaml

adguardhome/compose.yaml

@@ -1,6 +1,6 @@
 services:
   adguard:
-    image: adguard/adguardhome:latest
+    image: adguard/adguardhome:v0.107.79
     container_name: adguardhome
     restart: unless-stopped
     ports:

adguardhome/k8s/adguard.yaml

@@ -65,7 +65,7 @@ spec:
     spec:
       containers:
         - name: adguard
-          image: adguard/adguardhome:latest
+          image: adguard/adguardhome:v0.107.79
           resources:
             limits:
               memory: "1.5Gi"

adguardhome/k8s/ingress.yaml

@@ -9,6 +9,9 @@ spec:
   routes:
     - match: Host(`adguard.forust.xyz`) || Host(`dns.forust.xyz`)
       kind: Rule
+      middlewares:
+        - name: crowdsec-bouncer
+          namespace: crowdsec
       services:
         - name: adguard-service
           port: 3000

authentik/compose.yaml

@@ -1,6 +1,6 @@
 services:
   postgresql:
-    image: docker.io/library/postgres:15-alpine
+    image: docker.io/library/postgres:15.19-alpine
     restart: unless-stopped
     env_file:
       - .env

authentik/k8s/authentik.yaml

@@ -41,7 +41,7 @@ spec:
     spec:
       containers:
         - name: authentik-server
-          image: ghcr.io/goauthentik/server:2025.10.2
+          image: ghcr.io/goauthentik/server:2026.8.3
           args: ["server"]
           envFrom:
             - configMapRef:
@@ -75,7 +75,7 @@ spec:
     spec:
       containers:
         - name: authentik-worker
-          image: ghcr.io/goauthentik/server:2025.10.2
+          image: ghcr.io/goauthentik/server:2026.8.3
           args: ["worker"]
           securityContext:
             runAsUser: 0

authentik/k8s/config.yaml

@@ -6,6 +6,6 @@ metadata:
 data:
   AUTHENTIK_IMAGE: ghcr.io/goauthentik/server
   AUTHENTIK_TAG: "2025.10.2"
-  AUTHENTIK_POSTGRESQL__HOST: authentik-postgres-service
+  AUTHENTIK_POSTGRESQL__HOST: postgres.database.svc.cluster.local
   AUTHENTIK_POSTGRESQL__NAME: authentik
   AUTHENTIK_ERROR_REPORTING__ENABLED: "true"

authentik/k8s/ingress.yaml

@@ -9,6 +9,9 @@ spec:
   routes:
     - match: Host(`auth.forust.xyz`)
       kind: Rule
+      middlewares:
+        - name: crowdsec-bouncer
+          namespace: crowdsec
       services:
         - name: authentik-server-service
           port: 9000

authentik/k8s/postgresql.yaml

@@ -1,66 +0,0 @@
-apiVersion: v1
-kind: Service
-metadata:
-  name: authentik-postgres-service
-  namespace: authentik
-spec:
-  clusterIP: None
-  selector:
-    app: authentik-postgres
-  ports:
-    - port: 5432
-      targetPort: 5432
----
-apiVersion: apps/v1
-kind: StatefulSet
-metadata:
-  name: authentik-postgres-statefulset
-  namespace: authentik
-spec:
-  selector:
-    matchLabels:
-      app: authentik-postgres
-  serviceName: authentik-postgres-service
-  replicas: 1
-  template:
-    metadata:
-      labels:
-        app: authentik-postgres
-    spec:
-      containers:
-        - name: postgres
-          image: docker.io/library/postgres:15-alpine
-          env:
-            - name: POSTGRES_DB
-              value: authentik
-            - name: POSTGRES_USER
-              valueFrom:
-                secretKeyRef:
-                  name: authentik-secrets
-                  key: AUTHENTIK_POSTGRESQL__USER
-            - name: POSTGRES_PASSWORD
-              valueFrom:
-                secretKeyRef:
-                  name: authentik-secrets
-                  key: AUTHENTIK_POSTGRESQL__PASSWORD
-          ports:
-            - containerPort: 5432
-              name: postgres
-          volumeMounts:
-            - name: postgres-data
-              mountPath: /var/lib/postgresql/data
-          resources:
-            requests:
-              memory: "256Mi"
-              cpu: "200m"
-            limits:
-              memory: "1Gi"
-              cpu: "500m"
-  volumeClaimTemplates:
-    - metadata:
-        name: postgres-data
-      spec:
-        accessModes: ["ReadWriteOnce"]
-        resources:
-          requests:
-            storage: 5Gi

cfddns/compose.yaml

@@ -1,6 +1,6 @@
 services:
   cloudflare-ddns:
-    image: timothyjmiller/cloudflare-ddns:latest
+    image: timothyjmiller/cloudflare-ddns:2.2.0
     container_name: cloudflare-ddns
     restart: unless-stopped
     security_opt:

cfddns/k8s/deployment.yaml

@@ -18,7 +18,7 @@ spec:
       dnsPolicy: ClusterFirstWithHostNet
       containers:
         - name: cloudflare-ddns
-          image: timothyjmiller/cloudflare-ddns:latest
+          image: timothyjmiller/cloudflare-ddns:2.2.0
           imagePullPolicy: Always
           resources:
             requests:

checkmk/compose.yaml

@@ -1,6 +1,6 @@
 services:
   checkmk:
-    image: "checkmk/check-mk-raw:2.4.0-latest"
+    image: "checkmk/check-mk-raw:2.4.0-2026.09.14"
     container_name: "checkmk"
     restart: unless-stopped
     # ports:

checkmk/k8s/checkmk.yaml

@@ -7,8 +7,12 @@ spec:
   selector:
     app: checkmk
   ports:
-    - port: 5000
+    - name: web
+      port: 5000
       targetPort: 5000
+    - name: agent-receiver
+      port: 8000
+      targetPort: 8000
 ---
 apiVersion: apps/v1
 kind: Deployment
@@ -27,14 +31,17 @@ spec:
     spec:
       containers:
         - name: checkmk
-          image: checkmk/check-mk-raw:2.4.0-latest
+          image: checkmk/check-mk-raw:2.4.0-2026.09.14
           envFrom:
             - secretRef:
                 name: checkmk-secrets
             - configMapRef:
                 name: checkmk-config
           ports:
-            - containerPort: 5000
+            - name: web
+              containerPort: 5000
+            - name: agent-receiver
+              containerPort: 8000
           volumeMounts:
             - name: sites
               mountPath: /omd/sites

checkmk/k8s/ingress.yaml

@@ -9,6 +9,9 @@ spec:
   routes:
     - match: Host(`cmk.forust.xyz`)
       kind: Rule
+      middlewares:
+        - name: crowdsec-bouncer
+          namespace: crowdsec
       services:
         - name: checkmk-service
           port: 5000
@@ -16,6 +19,22 @@ spec:
     certResolver: letsencrypt
 ---
 apiVersion: traefik.io/v1alpha1
+kind: IngressRouteTCP
+metadata:
+  name: checkmk-agent-receiver
+  namespace: checkmk
+spec:
+  entryPoints:
+    - checkmk-agent
+  routes:
+    - match: HostSNI(`*`)
+      services:
+        - name: checkmk-service
+          port: 8000
+  tls:
+    passthrough: true
+---
+apiVersion: traefik.io/v1alpha1
 kind: IngressRoute
 metadata:
   name: checkmk-local

cloudflared/k8s/.gitignore

@@ -0,0 +1 @@
+secret.yaml

cloudflared/k8s/deployment.yaml

@@ -0,0 +1,37 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: cloudflared
+  labels:
+    app: cloudflared
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app: cloudflared
+  template:
+    metadata:
+      labels:
+        app: cloudflared
+    spec:
+      containers:
+        - name: cloudflared
+          image: cloudflare/cloudflared:2026.9.1
+          imagePullPolicy: IfNotPresent
+          args:
+            - tunnel
+            - --no-autoupdate
+            - run
+          env:
+            - name: TUNNEL_TOKEN
+              valueFrom:
+                secretKeyRef:
+                  name: cloudflared-secrets
+                  key: TUNNEL_TOKEN
+          resources:
+            requests:
+              memory: "32Mi"
+              cpu: "30m"
+            limits:
+              memory: "128Mi"
+              cpu: "200m"

cloudflared/k8s/secret.yaml.example

@@ -0,0 +1,7 @@
+apiVersion: v1
+kind: Secret
+metadata:
+  name: cloudflared-secrets
+type: Opaque
+stringData:
+  TUNNEL_TOKEN: your_tunnel_token_here

converters/compose.yaml

@@ -1,7 +1,7 @@
 services:
   convertx:
     container_name: convertx
-    image: ghcr.io/c4illin/convertx:latest
+    image: ghcr.io/c4illin/convertx:v0.18.0
     restart: unless-stopped
     ports:
       - "9992:3000"
@@ -42,7 +42,7 @@ services:
 
   bentopdf:
     container_name: bentopdf
-    image: bentopdf/bentopdf:latest
+    image: bentopdf/bentopdf@sha256:4eb4ec8f5030faf87c29a73d3d5a2781f28a597cf440c3ab111eb96aee550871
     restart: unless-stopped
     labels:
       - "traefik.enable=true"

converters/k8s/bentopdf.yaml

@@ -26,7 +26,7 @@ spec:
         app: bentopdf
     spec:
       containers:
-        - image: bentopdf/bentopdf:latest
+        - image: bentopdf/bentopdf@sha256:4eb4ec8f5030faf87c29a73d3d5a2781f28a597cf440c3ab111eb96aee550871
           imagePullPolicy: Always
           name: bentopdf
           ports:

converters/k8s/convertx.yaml

@@ -26,7 +26,7 @@ spec:
         app: convertx
     spec:
       containers:
-        - image: ghcr.io/c4illin/convertx:latest
+        - image: ghcr.io/c4illin/convertx:v0.18.0
           name: convertx
           envFrom:
             - configMapRef:

crowdsec/k8s/crowdsec-middleware.yaml

@@ -0,0 +1,14 @@
+apiVersion: traefik.io/v1alpha1
+kind: Middleware
+metadata:
+  name: crowdsec-bouncer
+  namespace: crowdsec
+spec:
+  plugin:
+    crowdsec-bouncer:
+      enabled: true
+      LogLevel: INFO
+      CrowdsecMode: live
+      CrowdsecLapiScheme: http
+      CrowdsecLapiHost: crowdsec-service.crowdsec.svc.cluster.local:8080
+      CrowdsecLapiKeyFile: "/etc/traefik/secrets/traefik-api-key"

crowdsec/k8s/crowdsec-values.yaml

@@ -0,0 +1,102 @@
+container_runtime: containerd
+
+agent:
+  acquisition: []
+  additionalAcquisition:
+    - labels:
+        type: traefik
+      limit: 1000
+      query: |
+        {namespace="traefik"}
+      source: loki
+      url: http://loki.prometheus.svc.cluster.local:3100/
+      wait_for_ready: 30s
+  env:
+    - name: COLLECTIONS
+      value: crowdsecurity/traefik crowdsecurity/base-http-scenarios
+    - name: DISABLE_COLLECTIONS
+      value: crowdsecurity/sshd
+  metrics:
+    enabled: true
+    serviceMonitor:
+      additionalLabels:
+        release: prometheus-stack
+      enabled: true
+  # Static machine identity: agent pods mount pre-created LAPI credentials
+  # (Secret crowdsec-agent-credentials, key local_api_credentials.yaml)
+  # at the exact path the agent entrypoint expects. Together with the
+  # patched register-init (enforced by janitor-cronjob.yaml) the agent
+  # never calls `cscli lapi register` in steady state, so pod names,
+  # restarts and reboots can no longer break it.
+  extraVolumes:
+    - name: static-creds
+      secret:
+        secretName: crowdsec-agent-credentials
+        items:
+          - key: local_api_credentials.yaml
+            path: local_api_credentials.yaml
+  extraVolumeMounts:
+    - name: static-creds
+      mountPath: /tmp_config/local_api_credentials.yaml
+      subPath: local_api_credentials.yaml
+      readOnly: true
+  resources:
+    limits:
+      cpu: 200m
+      memory: 500Mi
+    requests:
+      cpu: 50m
+      memory: 100Mi
+
+config:
+  parsers:
+    s02-enrich:
+      mobile-whitelist.yaml: |
+        name: forust/mobile-whitelist
+        description: "Whitelist SWAN/4ka mobile network"
+        whitelist:
+          reason: "Mobile IP whitelist"
+          cidr:
+            - "84.245.64.0/18"
+
+  postoverflows:
+    s01-whitelist:
+      home-dynamic-ip.yaml: |
+        name: forust/home-dynamic-ip
+        description: "Whitelist home dynamic IP"
+        whitelist:
+          reason: "Home dynamic IP"
+          expression:
+            - evt.Overflow.Alert.Source.IP in LookupHost("ddns.forust.xyz")
+
+lapi:
+  env:
+    - name: COLLECTIONS
+      value: crowdsecurity/traefik crowdsecurity/base-http-scenarios
+    - name: DISABLE_COLLECTIONS
+      value: crowdsecurity/linux crowdsecurity/sshd
+  metrics:
+    enabled: true
+    serviceMonitor:
+      additionalLabels:
+        release: prometheus-stack
+      enabled: true
+  persistentVolume:
+    config:
+      enabled: true
+      size: 100Mi
+      storageClassName: local-path-retain
+    data:
+      enabled: true
+      size: 1Gi
+      storageClassName: local-path-retain
+  resources:
+    limits:
+      cpu: 400m
+      memory: 500Mi
+    requests:
+      cpu: 50m
+      memory: 150Mi
+  service:
+    type: ClusterIP
+  storeLAPICscliCredentialsInSecret: true

crowdsec/k8s/grafana-dashboards.yaml

@@ -0,0 +1,32 @@
+apiVersion: v1
+data:
+  crowdsec-overview.json: "{\n  \"__inputs\": [\n    {\n      \"name\": \"DS_PROMETHEUS\",\n      \"label\": \"Prometheus\",\n      \"description\": \"\",\n      \"type\": \"datasource\",\n      \"pluginId\": \"prometheus\",\n      \"pluginName\": \"Prometheus\"\n    }\n  ],\n  \"__requires\": [\n    {\n      \"type\": \"grafana\",\n      \"id\": \"grafana\",\n      \"name\": \"Grafana\",\n      \"version\": \"8.1.2\"\n    },\n    {\n      \"type\": \"panel\",\n      \"id\": \"graph\",\n      \"name\": \"Graph (old)\",\n      \"version\": \"\"\n    },\n    {\n      \"type\": \"datasource\",\n      \"id\": \"prometheus\",\n      \"name\": \"Prometheus\",\n      \"version\": \"1.0.0\"\n    },\n    {\n      \"type\": \"panel\",\n      \"id\": \"stat\",\n      \"name\": \"Stat\",\n      \"version\": \"\"\n    },\n    {\n      \"type\": \"panel\",\n      \"id\": \"timeseries\",\n      \"name\": \"Time series\",\n      \"version\": \"\"\n    }\n  ],\n  \"annotations\": {\n    \"list\": [\n      {\n        \"builtIn\": 1,\n        \"datasource\": \"-- Grafana --\",\n        \"enable\": true,\n        \"hide\": true,\n        \"iconColor\": \"rgba(0, 211, 255, 1)\",\n        \"name\": \"Annotations & Alerts\",\n        \"target\": {\n          \"limit\": 100,\n          \"matchAny\": false,\n          \"tags\": [],\n          \"type\": \"dashboard\"\n        },\n        \"type\": \"dashboard\"\n      }\n    ]\n  },\n  \"editable\": true,\n  \"gnetId\": null,\n  \"graphTooltip\": 0,\n  \"id\": null,\n  \"links\": [],\n  \"panels\": [\n    {\n      \"collapsed\": false,\n      \"datasource\": null,\n      \"gridPos\": {\n        \"h\": 1,\n        \"w\": 24,\n        \"x\": 0,\n        \"y\": 0\n      },\n      \"id\": 24,\n      \"panels\": [],\n      \"title\": \"Summary\",\n      \"type\": \"row\"\n    },\n    {\n      \"cacheTimeout\": null,\n      \"datasource\": \"${DS_PROMETHEUS}\",\n      \"fieldConfig\": {\n        \"defaults\": {\n          \"color\": {\n            \"mode\": \"thresholds\"\n          },\n          \"mappings\": [\n            {\n              \"options\": {\n                \"match\": \"null\",\n                \"result\": {\n                  \"text\": \"N/A\"\n                }\n              },\n              \"type\": \"special\"\n            }\n          ],\n          \"thresholds\": {\n            \"mode\": \"absolute\",\n            \"steps\": [\n              {\n                \"color\": \"#E02F44\",\n                \"value\": null\n              },\n              {\n                \"color\": \"#E02F44\",\n                \"value\": 10\n              },\n              {\n                \"color\": \"#299c46\",\n                \"value\": 10\n              }\n            ]\n          },\n          \"unit\": \"none\"\n        },\n        \"overrides\": []\n      },\n      \"gridPos\": {\n        \"h\": 8,\n        \"w\": 6,\n        \"x\": 0,\n        \"y\": 1\n      },\n      \"id\": 2,\n      \"interval\": null,\n      \"links\": [],\n      \"maxDataPoints\": 100,\n      \"options\": {\n        \"colorMode\": \"background\",\n        \"graphMode\": \"none\",\n        \"justifyMode\": \"auto\",\n        \"orientation\": \"horizontal\",\n        \"reduceOptions\": {\n          \"calcs\": [\n            \"lastNotNull\"\n          ],\n          \"fields\": \"\",\n          \"values\": false\n        },\n        \"text\": {},\n        \"textMode\": \"auto\"\n      },\n      \"pluginVersion\": \"8.1.2\",\n      \"targets\": [\n        {\n          \"exemplar\": true,\n          \"expr\": \"count(cs_info)\",\n          \"interval\": \"\",\n          \"legendFormat\": \"\",\n          \"refId\": \"A\"\n        }\n      ],\n      \"timeFrom\": null,\n      \"timeShift\": null,\n      \"title\": \"Running Crowdsec\",\n      \"transparent\": true,\n      \"type\": \"stat\"\n    },\n    {\n      \"aliasColors\": {},\n      \"bars\": false,\n      \"dashLength\": 10,\n      \"dashes\": false,\n      \"datasource\": \"${DS_PROMETHEUS}\",\n      \"decimals\": 1,\n      \"fieldConfig\": {\n        \"defaults\": {\n          \"links\": []\n        },\n        \"overrides\": []\n      },\n      \"fill\": 1,\n      \"fillGradient\": 0,\n      \"gridPos\": {\n        \"h\": 8,\n        \"w\": 18,\n        \"x\": 6,\n        \"y\": 1\n      },\n      \"hiddenSeries\": false,\n      \"id\": 8,\n      \"legend\": {\n        \"alignAsTable\": true,\n        \"avg\": false,\n        \"current\": false,\n        \"max\": false,\n        \"min\": false,\n        \"rightSide\": true,\n        \"show\": true,\n        \"sort\": \"total\",\n        \"sortDesc\": true,\n        \"total\": true,\n        \"values\": true\n      },\n      \"lines\": true,\n      \"linewidth\": 1,\n      \"nullPointMode\": \"null\",\n      \"options\": {\n        \"alertThreshold\": true\n      },\n      \"percentage\": false,\n      \"pluginVersion\": \"8.1.2\",\n      \"pointradius\": 2,\n      \"points\": false,\n      \"renLine truncated
+kind: ConfigMap
+metadata:
+  labels:
+    app.kubernetes.io/managed-by: manual
+    grafana_dashboard: "1"
+  name: crowdsec-crowdsec-overview
+  namespace: prometheus
+---
+apiVersion: v1
+data:
+  crowdsec-lapi-metrics.json: "{\n  \"__inputs\": [\n    {\n      \"name\": \"DS_PROMETHEUS\",\n      \"label\": \"Prometheus\",\n      \"description\": \"\",\n      \"type\": \"datasource\",\n      \"pluginId\": \"prometheus\",\n      \"pluginName\": \"Prometheus\"\n    }\n  ],\n  \"__requires\": [\n    {\n      \"type\": \"panel\",\n      \"id\": \"bargauge\",\n      \"name\": \"Bar gauge\",\n      \"version\": \"\"\n    },\n    {\n      \"type\": \"grafana\",\n      \"id\": \"grafana\",\n      \"name\": \"Grafana\",\n      \"version\": \"8.1.2\"\n    },\n    {\n      \"type\": \"datasource\",\n      \"id\": \"prometheus\",\n      \"name\": \"Prometheus\",\n      \"version\": \"1.0.0\"\n    }\n  ],\n  \"annotations\": {\n    \"list\": [\n      {\n        \"builtIn\": 1,\n        \"datasource\": \"-- Grafana --\",\n        \"enable\": true,\n        \"hide\": true,\n        \"iconColor\": \"rgba(0, 211, 255, 1)\",\n        \"name\": \"Annotations & Alerts\",\n        \"target\": {\n          \"limit\": 100,\n          \"matchAny\": false,\n          \"tags\": [],\n          \"type\": \"dashboard\"\n        },\n        \"type\": \"dashboard\"\n      }\n    ]\n  },\n  \"editable\": true,\n  \"gnetId\": null,\n  \"graphTooltip\": 0,\n  \"id\": null,\n  \"iteration\": 1655915193937,\n  \"links\": [],\n  \"panels\": [\n    {\n      \"collapsed\": false,\n      \"datasource\": null,\n      \"gridPos\": {\n        \"h\": 1,\n        \"w\": 24,\n        \"x\": 0,\n        \"y\": 0\n      },\n      \"id\": 10,\n      \"panels\": [],\n      \"title\": \"Agents\",\n      \"type\": \"row\"\n    },\n    {\n      \"datasource\": \"${DS_PROMETHEUS}\",\n      \"fieldConfig\": {\n        \"defaults\": {\n          \"color\": {\n            \"mode\": \"thresholds\"\n          },\n          \"mappings\": [],\n          \"thresholds\": {\n            \"mode\": \"absolute\",\n            \"steps\": [\n              {\n                \"color\": \"green\",\n                \"value\": null\n              },\n              {\n                \"color\": \"red\",\n                \"value\": 80\n              }\n            ]\n          }\n        },\n        \"overrides\": []\n      },\n      \"gridPos\": {\n        \"h\": 8,\n        \"w\": 12,\n        \"x\": 0,\n        \"y\": 1\n      },\n      \"id\": 2,\n      \"options\": {\n        \"displayMode\": \"gradient\",\n        \"orientation\": \"vertical\",\n        \"reduceOptions\": {\n          \"calcs\": [\n            \"lastNotNull\"\n          ],\n          \"fields\": \"\",\n          \"values\": false\n        },\n        \"showUnfilled\": false,\n        \"text\": {}\n      },\n      \"pluginVersion\": \"8.1.2\",\n      \"repeat\": \"query0\",\n      \"repeatDirection\": \"h\",\n      \"targets\": [\n        {\n          \"exemplar\": false,\n          \"expr\": \"sum(rate(cs_lapi_request_duration_seconds_bucket{endpoint=\\\"/v1/watchers/login\\\", instance=\\\"$lapi\\\"}[$__rate_interval])) by (le)\",\n          \"format\": \"heatmap\",\n          \"interval\": \"\",\n          \"legendFormat\": \"{{le}}\",\n          \"refId\": \"A\"\n        }\n      ],\n      \"title\": \"Agents Login\",\n      \"type\": \"heatmap\"\n    },\n    {\n      \"datasource\": \"${DS_PROMETHEUS}\",\n      \"fieldConfig\": {\n        \"defaults\": {\n          \"color\": {\n            \"mode\": \"thresholds\"\n          },\n          \"mappings\": [],\n          \"thresholds\": {\n            \"mode\": \"absolute\",\n            \"steps\": [\n              {\n                \"color\": \"green\",\n                \"value\": null\n              }\n            ]\n          },\n          \"unit\": \"none\"\n        },\n        \"overrides\": []\n      },\n      \"gridPos\": {\n        \"h\": 8,\n        \"w\": 12,\n        \"x\": 12,\n        \"y\": 1\n      },\n      \"id\": 6,\n      \"options\": {\n        \"displayMode\": \"gradient\",\n        \"orientation\": \"auto\",\n        \"reduceOptions\": {\n          \"calcs\": [\n            \"lastNotNull\"\n          ],\n          \"fields\": \"\",\n          \"values\": false\n        },\n        \"showUnfilled\": false,\n        \"text\": {}\n      },\n      \"pluginVersion\": \"8.1.2\",\n      \"targets\": [\n        {\n          \"exemplar\": true,\n          \"expr\": \"sum(rate(cs_lapi_request_duration_seconds_bucket{endpoint=\\\"/v1/watchers/login\\\"}[$__rate_interval])) by (le)\",\n          \"format\": \"heatmap\",\n          \"interval\": \"\",\n          \"legendFormat\": \"{{le}}\",\n          \"refId\": \"A\"\n        }\n      ],\n      \"title\": \"Heartbeat\",\n      \"type\": \"heatmap\"\n    },\n    {\n      \"collapsed\": false,\n      \"datasource\": null,\n      \"gridPos\": {\n        \"h\": 1,\n        \"w\": 24,\n        \"x\": 0,\n        \"y\": 9\n      },\n      \"id\": 12,\n      \"panels\": [],\n      \"title\": \"Decisions\",\n      \"type\": \"row\"\n    },\n    {\n      \"datasource\": \"${DS_PROMETHEUS}\",\n  Line truncated
+kind: ConfigMap
+metadata:
+  labels:
+    app.kubernetes.io/managed-by: manual
+    grafana_dashboard: "1"
+  name: crowdsec-crowdsec-lapi-metrics
+  namespace: prometheus
+---
+apiVersion: v1
+data:
+  crowdsec-insight.json: "{\n  \"__inputs\": [\n    {\n      \"name\": \"DS_PROMETHEUS\",\n      \"label\": \"Prometheus\",\n      \"description\": \"\",\n      \"type\": \"datasource\",\n      \"pluginId\": \"prometheus\",\n      \"pluginName\": \"Prometheus\"\n    }\n  ],\n  \"__requires\": [\n    {\n      \"type\": \"panel\",\n      \"id\": \"bargauge\",\n      \"name\": \"Bar gauge\",\n      \"version\": \"\"\n    },\n    {\n      \"type\": \"panel\",\n      \"id\": \"gauge\",\n      \"name\": \"Gauge\",\n      \"version\": \"\"\n    },\n    {\n      \"type\": \"grafana\",\n      \"id\": \"grafana\",\n      \"name\": \"Grafana\",\n      \"version\": \"8.1.2\"\n    },\n    {\n      \"type\": \"datasource\",\n      \"id\": \"prometheus\",\n      \"name\": \"Prometheus\",\n      \"version\": \"1.0.0\"\n    },\n    {\n      \"type\": \"panel\",\n      \"id\": \"stat\",\n      \"name\": \"Stat\",\n      \"version\": \"\"\n    }\n  ],\n  \"annotations\": {\n    \"list\": [\n      {\n        \"builtIn\": 1,\n        \"datasource\": \"-- Grafana --\",\n        \"enable\": true,\n        \"hide\": true,\n        \"iconColor\": \"rgba(0, 211, 255, 1)\",\n        \"name\": \"Annotations & Alerts\",\n        \"target\": {\n          \"limit\": 100,\n          \"matchAny\": false,\n          \"tags\": [],\n          \"type\": \"dashboard\"\n        },\n        \"type\": \"dashboard\"\n      }\n    ]\n  },\n  \"editable\": true,\n  \"gnetId\": null,\n  \"graphTooltip\": 0,\n  \"id\": null,\n  \"iteration\": 1655915159751,\n  \"links\": [],\n  \"panels\": [\n    {\n      \"collapsed\": true,\n      \"datasource\": null,\n      \"gridPos\": {\n        \"h\": 1,\n        \"w\": 24,\n        \"x\": 0,\n        \"y\": 0\n      },\n      \"id\": 22,\n      \"panels\": [\n        {\n          \"cacheTimeout\": null,\n          \"datasource\": \"${DS_PROMETHEUS}\",\n          \"fieldConfig\": {\n            \"defaults\": {\n              \"color\": {\n                \"mode\": \"thresholds\"\n              },\n              \"mappings\": [\n                {\n                  \"options\": {\n                    \"match\": \"null\",\n                    \"result\": {\n                      \"text\": \"N/A\"\n                    }\n                  },\n                  \"type\": \"special\"\n                }\n              ],\n              \"thresholds\": {\n                \"mode\": \"absolute\",\n                \"steps\": [\n                  {\n                    \"color\": \"green\",\n                    \"value\": null\n                  },\n                  {\n                    \"color\": \"red\",\n                    \"value\": 80\n                  }\n                ]\n              },\n              \"unit\": \"dateTimeAsIso\"\n            },\n            \"overrides\": []\n          },\n          \"gridPos\": {\n            \"h\": 9,\n            \"w\": 5,\n            \"x\": 2,\n            \"y\": 1\n          },\n          \"id\": 2,\n          \"interval\": null,\n          \"links\": [],\n          \"maxDataPoints\": 100,\n          \"options\": {\n            \"colorMode\": \"none\",\n            \"graphMode\": \"none\",\n            \"justifyMode\": \"auto\",\n            \"orientation\": \"horizontal\",\n            \"reduceOptions\": {\n              \"calcs\": [\n                \"lastNotNull\"\n              ],\n              \"fields\": \"\",\n              \"values\": false\n            },\n            \"text\": {},\n            \"textMode\": \"auto\"\n          },\n          \"pluginVersion\": \"8.1.2\",\n          \"targets\": [\n            {\n              \"exemplar\": true,\n              \"expr\": \"(process_start_time_seconds{instance=\\\"$instance\\\"})*1000\",\n              \"interval\": \"\",\n              \"legendFormat\": \"{{instance}}\",\n              \"refId\": \"A\"\n            }\n          ],\n          \"timeFrom\": null,\n          \"timeShift\": null,\n          \"title\": \"Up since\",\n          \"type\": \"stat\"\n        },\n        {\n          \"datasource\": \"${DS_PROMETHEUS}\",\n          \"fieldConfig\": {\n            \"defaults\": {\n              \"displayName\": \"\",\n              \"mappings\": [],\n              \"thresholds\": {\n                \"mode\": \"absolute\",\n                \"steps\": [\n                  {\n                    \"color\": \"green\",\n                    \"value\": null\n                  }\n                ]\n              },\n              \"unit\": \"decbytes\"\n            },\n            \"overrides\": []\n          },\n          \"gridPos\": {\n            \"h\": 9,\n            \"w\": 5,\n            \"x\": 7,\n            \"y\": 1\n          },\n          \"id\": 4,\n          \"options\": {\n            \"orientation\": \"auto\",\n            \"reduceOptions\": {\n              \"calcs\": [\n                \"mean\"\n              ],\n              \"fields\": \"\",\n              \"values\": false\n            },\Line truncated
+kind: ConfigMap
+metadata:
+  labels:
+    app.kubernetes.io/managed-by: manual
+    grafana_dashboard: "1"
+  name: crowdsec-crowdsec-insight
+  namespace: prometheus

crowdsec/k8s/janitor-cronjob.yaml

@@ -0,0 +1,195 @@
+# CrowdSec self-healing: static machine identity + enforcement loops.
+#
+# Problem it fixes: the chart's agent init container runs
+#   `cscli lapi register --machine "$POD_NAME" ...`
+# unconditionally. Credentials live in an emptyDir, the machine row lives
+# in LAPI's persistent DB. Any init re-run for an already-known pod name
+# (kubelet restart, node reboot) dies with
+#   403 Forbidden: user '<pod>' already exist
+# and the DaemonSet pod sticks in Init forever. Every DS restart also
+# leaves an orphan machine row that is never cleaned.
+#
+# Design (name-independent):
+#   * Agent identity is a STATIC machine `crowdsec-agent-workstation`
+#     whose password lives in Secret `crowdsec-agent-credentials`
+#     (created once, manually - like all other secrets in this repo).
+#     The secret is mounted into agent pods at
+#     /tmp_config/local_api_credentials.yaml (see extraVolumeMounts in
+#     crowdsec-values.yaml), which is exactly the path the agent's main
+#     container copies into place at startup.
+#   * The DS init command is patched (strategic merge, by container name)
+#     to SKIP registration when that file exists, keeping the legacy
+#     register path only as fallback. Detection marker in the patched
+#     command: `[ -s /tmp_config`.
+#   * This CronJob enforces the desired state hourly, so recovery is
+#     automatic even after `helm upgrade` reverts the DS patch or the
+#     LAPI database is wiped:
+#       1. patch DS init if it still has the unconditional register
+#          (no-op otherwise - no restart churn);
+#       2. prune machines with no heartbeat for 2h (orphan hygiene);
+#       3. ensure the static machine exists, recreating it with the
+#          Secret password if missing (agent retry loops reconnect
+#          on their own - same name + same password);
+#       4. prune bouncer entries idle for 30d.
+#
+# Manual apply (crowdsec/k8s is NOT managed by deploy.yaml):
+#   kubectl apply -f crowdsec/k8s/janitor-cronjob.yaml
+# Force a run:
+#   kubectl create job -n crowdsec --from=cronjob/crowdsec-janitor janitor-now
+#
+# Helm upgrades: the janitor's strategic patch puts the DS field under
+# the `kubectl-patch` field manager, so a plain `helm upgrade` FAILS
+# with an SSA conflict on initContainers[].command. Procedure:
+#   1. revert init to chart state (kills the conflict):
+#        helm template crowdsec crowdsec/crowdsec --version <ver> \
+#          -n crowdsec -f crowdsec/k8s/crowdsec-values.yaml > /tmp/r.yaml
+#        python3 -c "import yaml,json; ..." # build revert patch from
+#        the rendered DaemonSet init command, then
+#        kubectl patch ds crowdsec-agent -n crowdsec \
+#          --type strategic -p "\$(cat /tmp/revert_patch.json)"
+#   2. helm upgrade --install crowdsec ... (no --force needed)
+#   3. janitor-now right away (upgrade reverts init; new pods would
+#      sit in Init until the next hourly run otherwise).
+#
+# One-time bootstrap (order matters):
+#   1. Create Secret + static machine (see commands in chat).
+#   2. Apply this file, trigger janitor-now, wait for agent 1/1.
+#   3. One-time orphan cleanup:
+#        kubectl exec -n crowdsec deploy/crowdsec-lapi -- \
+#          cscli machines prune --duration 1h --force
+#   4. Only then `helm upgrade` crowdsec with the extraVolumes values.
+#      Upgrade reverts the DS patch; trigger janitor-now right after it
+#      (otherwise new pods sit in Init until the next hourly run, then
+#      self-heal anyway).
+#
+# Password rotation: update the Secret, delete the machine
+# (`cscli machines delete crowdsec-agent-workstation`), trigger
+# janitor-now (recreates it), then `kubectl rollout restart
+# ds/crowdsec-agent -n crowdsec` (agent reads the file at startup only).
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: crowdsec-janitor
+  namespace: crowdsec
+  labels:
+    app.kubernetes.io/part-of: crowdsec
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: Role
+metadata:
+  name: crowdsec-janitor
+  namespace: crowdsec
+  labels:
+    app.kubernetes.io/part-of: crowdsec
+rules:
+  - apiGroups: [""]
+    resources: ["pods"]
+    verbs: ["get", "list"]
+  - apiGroups: [""]
+    resources: ["pods/exec"]
+    verbs: ["create"]
+  - apiGroups: ["apps"]
+    resources: ["daemonsets"]
+    verbs: ["get", "patch"]
+  # `kubectl exec deploy/<name>` resolves deploy -> replicaset -> pod,
+  # which needs read access to these (exec itself is pods/exec above).
+  - apiGroups: ["apps"]
+    resources: ["deployments", "replicasets"]
+    verbs: ["get", "list"]
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: RoleBinding
+metadata:
+  name: crowdsec-janitor
+  namespace: crowdsec
+  labels:
+    app.kubernetes.io/part-of: crowdsec
+subjects:
+  - kind: ServiceAccount
+    name: crowdsec-janitor
+    namespace: crowdsec
+roleRef:
+  kind: Role
+  name: crowdsec-janitor
+  apiGroup: rbac.authorization.k8s.io
+---
+apiVersion: batch/v1
+kind: CronJob
+metadata:
+  name: crowdsec-janitor
+  namespace: crowdsec
+  labels:
+    app.kubernetes.io/part-of: crowdsec
+spec:
+  schedule: "17 * * * *"
+  concurrencyPolicy: Forbid
+  successfulJobsHistoryLimit: 3
+  failedJobsHistoryLimit: 3
+  jobTemplate:
+    spec:
+      activeDeadlineSeconds: 300
+      template:
+        metadata:
+          labels:
+            app.kubernetes.io/part-of: crowdsec
+        spec:
+          serviceAccountName: crowdsec-janitor
+          restartPolicy: OnFailure
+          containers:
+            - name: janitor
+              # Same image the chart itself uses for registration jobs;
+              # IfNotPresent so it works while the node is offline
+              # (layer cached from the chart install).
+              image: alpine/kubectl:latest
+              imagePullPolicy: IfNotPresent
+              env:
+                - name: AGENT_PASSWORD
+                  valueFrom:
+                    secretKeyRef:
+                      name: crowdsec-agent-credentials
+                      key: password
+              command:
+                - /bin/sh
+                - -c
+                - |
+                  set -eu
+                  LAPI_EXEC="kubectl exec -n crowdsec deploy/crowdsec-lapi --"
+                  echo "== 1. enforce patched agent init =="
+                  CUR=$(kubectl get ds crowdsec-agent -n crowdsec \
+                    -o jsonpath='{.spec.template.spec.initContainers[0].command[2]}')
+                  case "$CUR" in
+                    *'-s /tmp_config'*)
+                      echo "init already patched"
+                      ;;
+                    *)
+                      echo "patching init"
+                      WAIT='until nc "$LAPI_HOST" "$LAPI_PORT" -z'
+                      WAIT="$WAIT; do echo waiting for lapi to start; sleep 5; done"
+                      LINK='ln -s /staging/etc/crowdsec /etc/crowdsec'
+                      REG='cscli lapi register --machine "$USERNAME"'
+                      REG="$REG -u \"\$LAPI_URL\" --token \"\$REGISTRATION_TOKEN\""
+                      CREDS=/tmp_config/local_api_credentials.yaml
+                      CMD="$WAIT; $LINK; [ -s $CREDS ] || {"
+                      CMD="$CMD $REG && cp"
+                      CMD="$CMD /etc/crowdsec/local_api_credentials.yaml $CREDS; }"
+                      ESC=$(printf '%s' "$CMD" | sed 's/"/\\"/g')
+                      PATCH='{"spec":{"template":{"spec":{"initContainers":'
+                      PATCH=$PATCH'[{"name":"wait-for-lapi-and-register",'
+                      PATCH=$PATCH'"command":["sh","-c","'$ESC'"]}]}}}}'
+                      kubectl patch ds crowdsec-agent -n crowdsec \
+                        --type strategic -p "$PATCH"
+                      ;;
+                  esac
+                  echo "== 2. prune orphan machines (no heartbeat for 2h) =="
+                  $LAPI_EXEC cscli machines prune --duration 2h --force
+                  echo "== 3. ensure static machine exists =="
+                  if $LAPI_EXEC cscli machines inspect \
+                    crowdsec-agent-workstation >/dev/null 2>&1; then
+                    echo "static machine present"
+                  else
+                    echo "recreating static machine"
+                    $LAPI_EXEC cscli machines add crowdsec-agent-workstation \
+                      --password "$AGENT_PASSWORD" --force
+                  fi
+                  echo "== 4. prune stale bouncers (no pull for 30d) =="
+                  $LAPI_EXEC cscli bouncers prune -d 720h --force

crowdsec/k8s/namespace.yaml

@@ -0,0 +1,6 @@
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: crowdsec
+  labels:
+    app.kubernetes.io/part-of: crowdsec

crowdsec/k8s/network-policy.yaml

@@ -0,0 +1,34 @@
+apiVersion: networking.k8s.io/v1
+kind: NetworkPolicy
+metadata:
+  name: crowdsec-lapi
+  namespace: crowdsec
+spec:
+  podSelector:
+    matchLabels:
+      k8s-app: crowdsec
+      type: lapi
+  policyTypes:
+    - Ingress
+  ingress:
+    - from:
+        - namespaceSelector:
+            matchLabels:
+              kubernetes.io/metadata.name: traefik
+          podSelector:
+            matchLabels:
+              app.kubernetes.io/name: traefik
+        - podSelector:
+            matchLabels:
+              k8s-app: crowdsec
+              type: agent
+      ports:
+        - protocol: TCP
+          port: 8080
+    - from:
+        - namespaceSelector:
+            matchLabels:
+              kubernetes.io/metadata.name: prometheus
+      ports:
+        - protocol: TCP
+          port: 6060

dockmon/compose.yaml

@@ -1,6 +1,6 @@
 services:
   dockmon:
-    image: darthnorse/dockmon:latest
+    image: darthnorse/dockmon:2.4.5
     container_name: dockmon
     restart: unless-stopped
     # ports:

dockmon/k8s/dockmon.yaml

@@ -29,7 +29,7 @@ spec:
     spec:
       containers:
         - name: dockmon
-          image: darthnorse/dockmon:latest
+          image: darthnorse/dockmon:2.4.5
           ports:
             - containerPort: 443
           volumeMounts:

dockmon/k8s/ingress.yaml

@@ -18,6 +18,8 @@ spec:
     - match: Host(`dockmon.forust.xyz`)
       kind: Rule
       middlewares:
+        - name: crowdsec-bouncer
+          namespace: crowdsec
         - name: security-headers@file
       services:
         - name: dockmon-service

downtify/compose.yaml

@@ -1,7 +1,7 @@
 services:
   downtify:
     container_name: downtify
-    image: ghcr.io/henriquesebastiao/downtify:latest
+    image: ghcr.io/henriquesebastiao/downtify:3.1.0
     restart: unless-stopped
     # ports:
     #   - '7077:8000'

downtify/k8s/downtify.yaml

@@ -27,7 +27,7 @@ spec:
     spec:
       containers:
         - name: downtify
-          image: ghcr.io/henriquesebastiao/downtify:latest
+          image: ghcr.io/henriquesebastiao/downtify:3.1.0
           ports:
             - containerPort: 8000
           volumeMounts:

downtify/k8s/ingress.yaml

@@ -10,6 +10,8 @@ spec:
     - match: Host(`downtify.forust.xyz`)
       kind: Rule
       middlewares:
+        - name: crowdsec-bouncer
+          namespace: crowdsec
         - name: security-chain@file
       services:
         - name: downtify-service

edu_master/compose.yaml

@@ -1,6 +1,6 @@
 services:
   redis:
-    image: redis:alpine
+    image: redis:8.10.1-alpine
     restart: unless-stopped
     volumes:
       - redis-data:/data
@@ -11,7 +11,7 @@ services:
       retries: 5
 
   playwright-service:
-    image: mcr.microsoft.com/playwright:v1.56.0-jammy
+    image: mcr.microsoft.com/playwright:v1.63.0-jammy
     restart: unless-stopped
     command: npx -y playwright@1.56.0 run-server --port 3000 --path /ws
 

edu_master/k8s/playwright.yaml

@@ -17,7 +17,7 @@ spec:
     spec:
       containers:
         - name: playwright
-          image: mcr.microsoft.com/playwright:v1.56.0-jammy
+          image: mcr.microsoft.com/playwright:v1.63.0-jammy
           imagePullPolicy: IfNotPresent
           command:
             - npx

edu_master/k8s/redis.yaml

@@ -1,11 +1,12 @@
 apiVersion: apps/v1
-kind: Deployment
+kind: StatefulSet
 metadata:
   name: redis
   namespace: edu-master
   labels:
     app: edu-master-redis
 spec:
+  serviceName: redis
   replicas: 1
   selector:
     matchLabels:
@@ -17,7 +18,7 @@ spec:
     spec:
       containers:
         - name: redis
-          image: redis:alpine
+          image: redis:8.10.1-alpine
           imagePullPolicy: IfNotPresent
           ports:
             - containerPort: 6379

edu_master/k8s/session-keeper.yaml

@@ -17,7 +17,7 @@ spec:
     spec:
       initContainers:
         - name: wait-redis
-          image: redis:alpine
+          image: redis:8.10.1-alpine
           command:
             - /bin/sh
             - -ec

edu_master/k8s/webinar-checker.yaml

@@ -19,7 +19,7 @@ spec:
       # redis healthy -> session-keeper healthy (EXISTS EDU_PHPSESSID) -> playwright started
       initContainers:
         - name: wait-deps
-          image: redis:alpine
+          image: redis:8.10.1-alpine
           command:
             - /bin/sh
             - -ec
@@ -55,8 +55,8 @@ spec:
               value: "Europe/Kyiv"
           resources:
             requests:
-              cpu: 25m
-              memory: 128Mi
+              cpu: "50m"
+              memory: "128Mi"
             limits:
-              cpu: 300m
-              memory: 384Mi
+              cpu: "600m"
+              memory: "512Mi"

gitea/compose.yaml

@@ -1,6 +1,6 @@
 services:
   server:
-    image: docker.gitea.com/gitea:1.26
+    image: docker.gitea.com/gitea:1.27.3
     container_name: gitea
     restart: always
     environment:
@@ -61,7 +61,7 @@ services:
     depends_on:
       - db
   db:
-    image: docker.io/library/postgres:14
+    image: docker.io/library/postgres:14.24-alpine
     restart: always
     environment:
       - POSTGRES_USER=gitea

gitea/k8s/config.yaml

@@ -10,13 +10,13 @@ data:
   GITEA__server__SSH_PORT: "2221"
 
   GITEA__database__DB_TYPE: "postgres"
-  GITEA__database__HOST: "gitea-postgres-service:5432"
+  GITEA__database__HOST: "postgres.database.svc.cluster.local:5432"
   GITEA__database__NAME: "gitea"
   GITEA__security__REVERSE_PROXY_LIMIT: "1"
   GITEA__security__REVERSE_PROXY_TRUSTED_PROXIES: "*"
 
   GITEA__mailer__ENABLED: "false"
 
-  GITEA__log__logger__access__MODE: "console, file"
+  GITEA__log__logger.access.MODE: "console, file"
   USER_UID: "1000"
   USER_GID: "1000"

gitea/k8s/gitea.yaml

@@ -31,7 +31,7 @@ spec:
     spec:
       containers:
         - name: gitea
-          image: docker.gitea.com/gitea:1.26
+          image: docker.gitea.com/gitea:1.27.3
           envFrom:
             - configMapRef:
                 name: gitea-config

gitea/k8s/ingress.yaml

@@ -9,11 +9,17 @@ spec:
   routes:
     - match: Host(`gitea.forust.xyz`)
       kind: Rule
+      middlewares:
+        - name: crowdsec-bouncer
+          namespace: crowdsec
       services:
         - name: gitea-service
           port: 3000
     - match: Host(`gcr.forust.xyz`) && PathPrefix(`/v2`)
       kind: Rule
+      middlewares:
+        - name: crowdsec-bouncer
+          namespace: crowdsec
       services:
         - name: gitea-service
           port: 3000

gitea/k8s/postgres.yaml

@@ -1,62 +0,0 @@
-apiVersion: v1
-kind: Service
-metadata:
-  name: gitea-postgres-service
-  namespace: gitea
-spec:
-  clusterIP: None
-  selector:
-    app: gitea-postgres
-  ports:
-    - port: 5432
-      targetPort: 5432
----
-apiVersion: apps/v1
-kind: StatefulSet
-metadata:
-  name: gitea-postgres-statefulset
-  namespace: gitea
-spec:
-  selector:
-    matchLabels:
-      app: gitea-postgres
-  serviceName: gitea-postgres-service
-  replicas: 1
-  template:
-    metadata:
-      labels:
-        app: gitea-postgres
-    spec:
-      containers:
-        - name: gitea-postgres
-          image: postgres:14
-          env:
-            - name: POSTGRES_USER
-              valueFrom:
-                secretKeyRef:
-                  name: gitea-secrets
-                  key: GITEA__database__USER
-            - name: POSTGRES_PASSWORD
-              valueFrom:
-                secretKeyRef:
-                  name: gitea-secrets
-                  key: GITEA__database__PASSWD
-            - name: POSTGRES_DB
-              valueFrom:
-                secretKeyRef:
-                  name: gitea-secrets
-                  key: GITEA__database__USER
-          ports:
-            - containerPort: 5432
-              name: postgres
-          volumeMounts:
-            - name: postgres-data
-              mountPath: /var/lib/postgresql/data
-  volumeClaimTemplates:
-    - metadata:
-        name: postgres-data
-      spec:
-        accessModes: ["ReadWriteOnce"]
-        resources:
-          requests:
-            storage: 1Gi

gitea/k8s/secrets.yaml.example

@@ -7,3 +7,4 @@ type: Opaque
 stringData:
   GITEA__database__USER: "gitea"
   GITEA__database__PASSWD: "gitea"
+  GITEA__database__NAME: "gitea"

glance/compose.yaml

@@ -1,7 +1,7 @@
 services:
   glance:
     container_name: glance
-    image: glanceapp/glance
+    image: glanceapp/glance:v0.8.6
     restart: unless-stopped
     volumes:
       - ./config:/app/config:ro

glance/k8s/glance.yaml

@@ -27,7 +27,7 @@ spec:
     spec:
       containers:
         - name: glance
-          image: glanceapp/glance
+          image: glanceapp/glance:v0.8.6
           envFrom:
             - secretRef:
                 name: glance-secrets
@@ -56,11 +56,11 @@ spec:
               readOnly: true
           resources:
             requests:
-              memory: "30Mi"
-              cpu: "20m"
-            limits:
-              memory: "100Mi"
               cpu: "50m"
+              memory: "64Mi"
+            limits:
+              cpu: "200m"
+              memory: "256Mi"
       volumes:
         - name: glance-config
           configMap:

headscale/compose.yaml

@@ -1,6 +1,6 @@
 services:
   headscale:
-    image: headscale/headscale:latest
+    image: headscale/headscale:0.29.3
     restart: unless-stopped
     container_name: headscale-server
     command: serve
@@ -53,7 +53,7 @@ services:
       - "traefik.http.routers.headscale-metrics-dev.service=headscale-metrics"
       - "traefik.http.routers.headscale-metrics-dev.tls=true"
   headplane:
-    image: ghcr.io/tale/headplane:latest
+    image: ghcr.io/tale/headplane:0.7.1
     container_name: headplane
     restart: unless-stopped
     ports:
@@ -100,7 +100,7 @@ services:
       - "traefik.http.routers.headplane-dev.entrypoints=websecure"
       - "traefik.http.routers.headplane-dev.tls=true"
   web:
-    image: goodieshq/headscale-admin:latest
+    image: goodieshq/headscale-admin:0.28.0
     restart: unless-stopped
     ports:
       - 10080:80

headscale/k8s/routing/ingress.yaml

@@ -23,11 +23,17 @@ spec:
           port: 8080
     - match: Host(`hs.forust.xyz`) && PathPrefix(`/admin`)
       kind: Rule
+      middlewares:
+        - name: crowdsec-bouncer
+          namespace: crowdsec
       services:
         - name: headscale-ui-external
           port: 80
     - match: Host(`hs.forust.xyz`) && PathPrefix(`/metrics`)
       kind: Rule
+      middlewares:
+        - name: crowdsec-bouncer
+          namespace: crowdsec
       services:
         - name: headscale-server-external
           port: 9090
@@ -47,6 +53,8 @@ spec:
       kind: Rule
       middlewares:
         - name: headplane-prefix
+        - name: crowdsec-bouncer
+          namespace: crowdsec
       services:
         - name: headplane-external
           port: 3000

homepages/k8s/ingress.yaml

@@ -9,6 +9,9 @@ spec:
   routes:
     - match: Host(`forust.xyz`) || Host(`www.forust.xyz`)
       kind: Rule
+      middlewares:
+        - name: crowdsec-bouncer
+          namespace: crowdsec
       priority: 10
       services:
         - name: forust-homepage-service
@@ -43,6 +46,9 @@ spec:
   routes:
     - match: Host(`xdfnx.cfd`)
       kind: Rule
+      middlewares:
+        - name: crowdsec-bouncer
+          namespace: crowdsec
       services:
         - name: xdfnx-homepage-service
           port: 80

kener/compose.yaml

@@ -1,6 +1,6 @@
 services:
   kener:
-    image: rajnandan1/kener:4.0.23
+    image: rajnandan1/kener:4.1.5
     container_name: kener
     restart: unless-stopped
     # ports:
@@ -36,7 +36,7 @@ services:
       - proxy
       - kener
   redis:
-    image: redis:7-alpine
+    image: redis:8.10.1-alpine
     container_name: kener-redis
     restart: unless-stopped
     volumes:

kener/k8s/ingress.yaml

@@ -9,6 +9,9 @@ spec:
   routes:
     - match: Host(`status.forust.xyz`)
       kind: Rule
+      middlewares:
+        - name: crowdsec-bouncer
+          namespace: crowdsec
       services:
         - name: kener-service
           port: 3000

kener/k8s/kener.yaml

@@ -27,7 +27,7 @@ spec:
     spec:
       containers:
         - name: kener
-          image: rajnandan1/kener:4.1.0
+          image: rajnandan1/kener:4.1.5
           envFrom:
             - configMapRef:
                 name: kener-config

kener/k8s/redis.yaml

@@ -30,7 +30,7 @@ spec:
     spec:
       containers:
         - name: redis
-          image: redis:7-alpine
+          image: redis:8.10.1-alpine
           ports:
             - containerPort: 6379
           volumeMounts:

loki/k8s/alloy-values.yaml

@@ -0,0 +1,57 @@
+# Pinned chart: grafana/alloy 1.12.1 (app v1.19.2).
+# Install (deferred to deploy task, namespace prometheus):
+#   helm upgrade --install alloy grafana/alloy --version 1.12.1 \
+#     --namespace prometheus --values loki/k8s/alloy-values.yaml --wait
+# DaemonSet ships k8s pod logs (API-tailed, no hostPath mounts) to Loki.
+# Scope phase 1: k8s only, compose leftovers out.
+
+controller:
+  type: daemonset
+  resources:
+    requests:
+      memory: "128Mi"
+      cpu: "50m"
+    limits:
+      memory: "512Mi"
+      cpu: "500m"
+
+image:
+  tag: "v1.19.2"
+
+alloy:
+  configMap:
+    create: true
+    content: |
+      discovery.kubernetes "pods" {
+        role = "pod"
+      }
+
+      discovery.relabel "pods" {
+        targets = discovery.kubernetes.pods.targets
+
+        rule {
+          source_labels = ["__meta_kubernetes_namespace"]
+          target_label  = "namespace"
+        }
+
+        rule {
+          source_labels = ["__meta_kubernetes_pod_name"]
+          target_label  = "pod"
+        }
+
+        rule {
+          source_labels = ["__meta_kubernetes_pod_container_name"]
+          target_label  = "container"
+        }
+      }
+
+      loki.source.kubernetes "pods" {
+        targets    = discovery.relabel.pods.output
+        forward_to = [loki.write.default.receiver]
+      }
+
+      loki.write "default" {
+        endpoint {
+          url = "http://loki-gateway.prometheus.svc.cluster.local/loki/api/v1/push"
+        }
+      }

loki/k8s/loki-values.yaml

@@ -0,0 +1,97 @@
+# Pinned chart: grafana/loki 7.3.0 (app 3.6.12).
+# Install (deferred to deploy task, namespace prometheus):
+#   helm upgrade --install loki grafana/loki --version 7.3.0 \
+#     --namespace prometheus --values loki/k8s/loki-values.yaml --wait
+# SingleBinary, filesystem storage on local-path-retain, 14d retention.
+# No IngressRoute: Loki is cluster-internal, queried via Grafana datasource.
+
+deploymentMode: SingleBinary
+
+loki:
+  # Multitenancy off: single-node homelab, gateway + Alloy + Grafana talk to one tenant.
+  auth_enabled: false
+  image:
+    tag: "3.6.12"
+  commonConfig:
+    # Single replica: default RF=3 would require 3 ingesters and fail all writes.
+    replication_factor: 1
+  storage:
+    type: filesystem
+  schemaConfig:
+    configs:
+      - from: "2024-04-01"
+        store: tsdb
+        object_store: filesystem
+        schema: v13
+        index:
+          prefix: index_
+          period: 24h
+  compactor:
+    retention_enabled: true
+    delete_request_store: filesystem
+  limits_config:
+    retention_period: 336h
+  rulerConfig:
+    wal:
+      dir: /var/loki/ruler-wal
+    storage:
+      type: local
+      local:
+        directory: /var/loki/rules
+
+singleBinary:
+  replicas: 1
+  persistence:
+    enabled: true
+    size: 20Gi
+    storageClass: local-path-retain
+  resources:
+    requests:
+      memory: "512Mi"
+      cpu: "200m"
+    limits:
+      memory: "2Gi"
+      cpu: "1000m"
+
+# Zeroed: unused in SingleBinary mode (chart validation requires it).
+write:
+  replicas: 0
+read:
+  replicas: 0
+backend:
+  replicas: 0
+
+gateway:
+  replicas: 1
+  resources:
+    requests:
+      memory: "64Mi"
+      cpu: "50m"
+    limits:
+      memory: "256Mi"
+      cpu: "300m"
+
+monitoring:
+  serviceMonitor:
+    enabled: true
+    labels:
+      release: prometheus-stack
+    interval: 15s
+  rules:
+    enabled: true
+    namespace: prometheus
+    labels:
+      release: prometheus-stack
+
+# Disabled: memcached caches don't fit a memory-tight single node.
+# SingleBinary works without them (slower repeated queries, fine at homelab scale).
+resultsCache:
+  enabled: false
+chunksCache:
+  enabled: false
+
+# Disabled: synthetic canary traffic + helm test pod, noise on a single node.
+lokiCanary:
+  enabled: false
+test:
+  enabled: false

metube/compose.yaml

@@ -1,6 +1,6 @@
 services:
   metube:
-    image: ghcr.io/alexta69/metube
+    image: ghcr.io/alexta69/metube:2026.09.15
     container_name: metube
     restart: unless-stopped
     # ports:

metube/k8s/metube.yaml

@@ -27,7 +27,7 @@ spec:
     spec:
       containers:
         - name: metube
-          image: ghcr.io/alexta69/metube
+          image: ghcr.io/alexta69/metube:2026.09.15
           envFrom:
             - configMapRef:
                 name: metube-config

n8n/compose.yaml

@@ -1,6 +1,6 @@
 services:
   n8n:
-    image: docker.n8n.io/n8nio/n8n
+    image: docker.n8n.io/n8nio/n8n:2.40.3
     container_name: n8n
     restart: unless-stopped
     environment:

n8n/k8s/ingress.yaml

@@ -9,6 +9,9 @@ spec:
   routes:
     - match: Host(`n8n.forust.xyz`)
       kind: Rule
+      middlewares:
+        - name: crowdsec-bouncer
+          namespace: crowdsec
       services:
         - name: n8n-service
           port: 5678

n8n/k8s/n8n.yaml

@@ -27,7 +27,7 @@ spec:
     spec:
       containers:
         - name: n8n
-          image: docker.n8n.io/n8nio/n8n
+          image: docker.n8n.io/n8nio/n8n:2.40.3
           envFrom:
             - configMapRef:
                 name: n8n-config

netronome/compose.yaml

@@ -1,6 +1,6 @@
 services:
   netronome:
-    image: ghcr.io/autobrr/netronome:latest
+    image: ghcr.io/autobrr/netronome:v0.14.0
     restart: unless-stopped
     container_name: netronome
     ports:
@@ -33,7 +33,7 @@ services:
         condition: service_healthy
   postgres:
     container_name: netronome-postgres
-    image: postgres:17-alpine
+    image: postgres:17.11-alpine
     environment:
       - POSTGRES_USER=netronome
       - POSTGRES_PASSWORD=netronome

netronome/k8s/config.yaml

@@ -5,7 +5,7 @@ metadata:
   namespace: netronome
 data:
   NETRONOME__DB_TYPE: "postgres"
-  NETRONOME__DB_HOST: "netronome-postgres-service"
+  NETRONOME__DB_HOST: "postgres.database.svc.cluster.local"
   NETRONOME__DB_PORT: "5432"
   NETRONOME__DB_NAME: "netronome"
   NETRONOME__DB_SSLMODE: "disable"

netronome/k8s/ingress.yaml

@@ -9,6 +9,9 @@ spec:
   routes:
     - match: Host(`nm.forust.xyz`)
       kind: Rule
+      middlewares:
+        - name: crowdsec-bouncer
+          namespace: crowdsec
       services:
         - name: netronome-service
           port: 7575

netronome/k8s/netronome.yaml

@@ -30,7 +30,7 @@ spec:
     spec:
       containers:
         - name: netronome
-          image: ghcr.io/autobrr/netronome:latest
+          image: ghcr.io/autobrr/netronome:v0.14.0
           ports:
             - name: netronome-port
               protocol: TCP

netronome/k8s/postgres.yaml

@@ -1,71 +0,0 @@
-apiVersion: v1
-kind: Service
-metadata:
-  name: netronome-postgres-service
-  namespace: netronome
-spec:
-  selector:
-    app: netronome-postgres
-  ports:
-    - protocol: TCP
-      port: 5432
-      targetPort: 5432
----
-apiVersion: apps/v1
-kind: StatefulSet
-metadata:
-  name: netronome-postgres
-  namespace: netronome
-spec:
-  serviceName: "netronome-postgres-service"
-  replicas: 1
-  selector:
-    matchLabels:
-      app: netronome-postgres
-  template:
-    metadata:
-      labels:
-        app: netronome-postgres
-    spec:
-      containers:
-        - name: netronome-postgres
-          image: postgres:17-alpine
-          ports:
-            - name: postgres-port
-              protocol: TCP
-              containerPort: 5432
-          env:
-            - name: POSTGRES_USER
-              valueFrom:
-                secretKeyRef:
-                  name: netronome-secrets
-                  key: NETRONOME__DB_USER
-            - name: POSTGRES_PASSWORD
-              valueFrom:
-                secretKeyRef:
-                  name: netronome-secrets
-                  key: NETRONOME__DB_PASSWORD
-            - name: POSTGRES_DB
-              valueFrom:
-                configMapKeyRef:
-                  name: netronome-config
-                  key: NETRONOME__DB_NAME
-          resources:
-            requests:
-              memory: "512Mi"
-              cpu: "500m"
-            limits:
-              memory: "1Gi"
-              cpu: "1000m"
-          volumeMounts:
-            - name: netronome-pg-data
-              mountPath: /var/lib/postgresql/data
-  volumeClaimTemplates:
-    - metadata:
-        name: netronome-pg-data
-      spec:
-        accessModes:
-          - ReadWriteOnce
-        resources:
-          requests:
-            storage: 1Gi

nextcloud/k8s/routing/ingress.yaml

@@ -12,6 +12,8 @@ spec:
       kind: Rule
       middlewares:
         - name: nextcloud-chain@file
+        - name: crowdsec-bouncer
+          namespace: crowdsec
       services:
         - name: nextcloud-apache
           port: 11000
@@ -30,6 +32,8 @@ spec:
     - match: Host(`nextcloud.workstation.internal`) || Host(`nextcloud.gigaforust.internal`)
       kind: Rule
       middlewares:
+        - name: crowdsec-bouncer
+          namespace: crowdsec
         - name: nextcloud-chain@file
       services:
         - name: nextcloud-apache

penpot/compose.yaml

@@ -84,7 +84,7 @@ services:
   #     - "443:443"
 
   penpot-frontend:
-    image: "penpotapp/frontend:${PENPOT_VERSION:-latest}"
+    image: "penpotapp/frontend:${PENPOT_VERSION:-2.17.2}"
     restart: always
     # ports:
     #   - 9001:8080
@@ -119,7 +119,7 @@ services:
     environment:
       <<: [*penpot-flags, *penpot-http-body-size]
   penpot-backend:
-    image: "penpotapp/backend:${PENPOT_VERSION:-latest}"
+    image: "penpotapp/backend:${PENPOT_VERSION:-2.17.2}"
     restart: always
 
     volumes:
@@ -189,7 +189,7 @@ services:
       # PENPOT_SMTP_SSL: false
 
   penpot-exporter:
-    image: "penpotapp/exporter:${PENPOT_VERSION:-latest}"
+    image: "penpotapp/exporter:${PENPOT_VERSION:-2.17.2}"
     restart: always
 
     depends_on:
@@ -209,7 +209,7 @@ services:
       PENPOT_REDIS_URI: redis://penpot-valkey/0
 
   penpot-postgres:
-    image: "postgres:15"
+    image: "postgres:15.19-alpine"
     restart: always
     stop_signal: SIGINT
 
@@ -233,7 +233,7 @@ services:
       - POSTGRES_PASSWORD=penpot
 
   penpot-valkey:
-    image: valkey/valkey:8.1
+    image: valkey/valkey:9.1.2
     restart: always
 
     healthcheck:

portainer/compose.yaml

@@ -1,6 +1,6 @@
 services:
   portainer:
-    image: portainer/portainer-ce:2.41.0
+    image: portainer/portainer-ce:2.45.1
     container_name: portainer
     restart: always
     volumes:

portainer/k8s/ingress.yaml

@@ -9,6 +9,9 @@ spec:
   routes:
     - match: Host(`portainer.forust.xyz`)
       kind: Rule
+      middlewares:
+        - name: crowdsec-bouncer
+          namespace: crowdsec
       services:
         - name: portainer-service
           port: 9000

portainer/k8s/portainer.yaml

@@ -27,7 +27,7 @@ spec:
     spec:
       containers:
         - name: portainer
-          image: portainer/portainer-ce:2.41.0
+          image: portainer/portainer-ce:2.45.1
           ports:
             - containerPort: 9000
           volumeMounts:

postgres/.env.example

@@ -0,0 +1,5 @@
+POSTGRES_ADMIN_PASSWORD=
+AUTHENTIK_DB_PASSWORD=
+GITEA_DB_PASSWORD=
+NETRONOME_DB_PASSWORD=
+PENPOT_DB_PASSWORD=

postgres/README.md

@@ -0,0 +1,35 @@
+# Shared PostgreSQL
+
+This directory contains a PostgreSQL 15 deployment draft for Authentik, Gitea,
+Netronome, and Penpot. It creates one database and one login role per service;
+it does not migrate existing data or change application connection settings.
+
+## Compatibility baseline
+
+| Service   | Current application | Current standalone PostgreSQL | Common PostgreSQL 15                                                                 |
+| --------- | ------------------- | ----------------------------: | ------------------------------------------------------------------------------------ |
+| Authentik | 2025.10.2           |                            15 | Supported (Authentik requires 14+)                                                   |
+| Gitea     | 1.27.3              |                            14 | Supported (Gitea requires 12+)                                                       |
+| Netronome | 0.14.0              |                            17 | Validate in staging; upstream's example uses 17 but no 17-only feature is documented |
+| Penpot    | 2.17.2              |                            15 | Supported by the official deployment                                                 |
+
+PostgreSQL 15 is the conservative common major. A major-version downgrade or
+change must use a logical dump/restore; changing only the image tag while
+keeping a data directory is not supported. Back up and migrate one application
+at a time, starting with Netronome because its current standalone deployment
+uses PostgreSQL 17.
+
+For Compose, copy `.env.example` to `.env`, set all passwords, and start it with
+`docker compose -f shared-compose.yaml up -d`. This file is intentionally not
+named `compose.yaml`, so the repository deploy workflow does not start a second
+database accidentally.
+Applications that use this database must also join that external network and use
+`homelab-postgres:5432`.
+
+For Kubernetes, create `k8s/secrets.yaml` from the example before applying the
+manifests. The `k8s/active` marker makes the normal deploy workflow include the
+namespace, StatefulSet, ConfigMap, and NetworkPolicy. Applications use
+`postgres.database.svc.cluster.local:5432`.
+Migrate each existing database with a tested logical dump/restore before
+switching an application. Do not reuse a PostgreSQL 14 or 17 data directory
+with PostgreSQL 15.

postgres/initdb/01-create-databases.sh

@@ -0,0 +1,27 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+: "${AUTHENTIK_DB_PASSWORD:?AUTHENTIK_DB_PASSWORD is required}"
+: "${GITEA_DB_PASSWORD:?GITEA_DB_PASSWORD is required}"
+: "${NETRONOME_DB_PASSWORD:?NETRONOME_DB_PASSWORD is required}"
+: "${PENPOT_DB_PASSWORD:?PENPOT_DB_PASSWORD is required}"
+
+create_role_and_database() {
+  local role="$1"
+  local database="$2"
+  local password="$3"
+
+  psql --username "$POSTGRES_USER" --dbname postgres \
+    -v role="$role" -v database="$database" -v password="$password" \
+    <<'SQL'
+SELECT format('CREATE ROLE %I LOGIN PASSWORD %L', :'role', :'password')
+WHERE NOT EXISTS (SELECT FROM pg_roles WHERE rolname = :'role')\gexec
+SELECT format('CREATE DATABASE %I OWNER %I', :'database', :'role')
+WHERE NOT EXISTS (SELECT FROM pg_database WHERE datname = :'database')\gexec
+SQL
+}
+
+create_role_and_database authentik authentik "$AUTHENTIK_DB_PASSWORD"
+create_role_and_database gitea gitea "$GITEA_DB_PASSWORD"
+create_role_and_database netronome netronome "$NETRONOME_DB_PASSWORD"
+create_role_and_database penpot penpot "$PENPOT_DB_PASSWORD"

postgres/k8s/namespace.yaml

@@ -0,0 +1,6 @@
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: database
+  labels:
+    app.kubernetes.io/part-of: homelab-database

postgres/k8s/network-policy.yaml

@@ -0,0 +1,31 @@
+apiVersion: networking.k8s.io/v1
+kind: NetworkPolicy
+metadata:
+  name: postgres-ingress
+  namespace: database
+spec:
+  podSelector:
+    matchLabels:
+      app.kubernetes.io/name: postgres17
+  policyTypes:
+    - Ingress
+  ingress:
+    - from:
+        - namespaceSelector:
+            matchLabels:
+              kubernetes.io/metadata.name: authentik
+        - namespaceSelector:
+            matchLabels:
+              kubernetes.io/metadata.name: gitea
+        - namespaceSelector:
+            matchLabels:
+              kubernetes.io/metadata.name: netronome
+        - namespaceSelector:
+            matchLabels:
+              kubernetes.io/metadata.name: penpot
+        - namespaceSelector:
+            matchLabels:
+              kubernetes.io/metadata.name: statuspage
+      ports:
+        - protocol: TCP
+          port: 5432

postgres/k8s/postgres.yaml

@@ -0,0 +1,126 @@
+apiVersion: v1
+kind: Service
+metadata:
+  name: postgres
+  namespace: database
+  labels:
+    app.kubernetes.io/name: postgres17
+    app.kubernetes.io/part-of: homelab-database
+spec:
+  selector:
+    app.kubernetes.io/name: postgres17
+  ports:
+    - name: postgres
+      port: 5432
+      targetPort: postgres
+---
+apiVersion: apps/v1
+kind: StatefulSet
+metadata:
+  name: postgres17
+  namespace: database
+spec:
+  serviceName: postgres17
+  replicas: 1
+  selector:
+    matchLabels:
+      app.kubernetes.io/name: postgres17
+  template:
+    metadata:
+      labels:
+        app.kubernetes.io/name: postgres17
+    spec:
+      containers:
+        - name: postgres
+          image: postgres:17.11-alpine
+          ports:
+            - name: postgres
+              containerPort: 5432
+          env:
+            - name: POSTGRES_DB
+              value: postgres
+            - name: POSTGRES_USER
+              value: postgres
+            - name: POSTGRES_PASSWORD
+              valueFrom:
+                secretKeyRef:
+                  name: postgres-shared-secrets
+                  key: POSTGRES_ADMIN_PASSWORD
+          envFrom:
+            - secretRef:
+                name: postgres-shared-secrets
+          volumeMounts:
+            - name: postgres-data
+              mountPath: /var/lib/postgresql/data
+            - name: initdb
+              mountPath: /docker-entrypoint-initdb.d/01-create-databases.sh
+              subPath: 01-create-databases.sh
+          readinessProbe:
+            exec:
+              command: ["pg_isready", "-U", "postgres", "-d", "postgres"]
+            initialDelaySeconds: 10
+            periodSeconds: 10
+          livenessProbe:
+            exec:
+              command: ["pg_isready", "-U", "postgres", "-d", "postgres"]
+            initialDelaySeconds: 30
+            periodSeconds: 20
+      volumes:
+        - name: postgres-data
+          persistentVolumeClaim:
+            claimName: postgres17-data
+        - name: initdb
+          configMap:
+            name: postgres-initdb
+            defaultMode: 0755
+---
+apiVersion: v1
+kind: PersistentVolumeClaim
+metadata:
+  name: postgres17-data
+  namespace: database
+  labels:
+    app.kubernetes.io/name: postgres17
+    app.kubernetes.io/part-of: homelab-database
+spec:
+  accessModes: ["ReadWriteOnce"]
+  storageClassName: local-path-retain
+  resources:
+    requests:
+      storage: 20Gi
+---
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: postgres-initdb
+  namespace: database
+data:
+  01-create-databases.sh: |
+    #!/usr/bin/env bash
+    set -euo pipefail
+
+    : "${AUTHENTIK_DB_PASSWORD:?AUTHENTIK_DB_PASSWORD is required}"
+    : "${GITEA_DB_PASSWORD:?GITEA_DB_PASSWORD is required}"
+    : "${NETRONOME_DB_PASSWORD:?NETRONOME_DB_PASSWORD is required}"
+    : "${PENPOT_DB_PASSWORD:?PENPOT_DB_PASSWORD is required}"
+    : "${STATUSPAGE_DB_PASSWORD:?STATUSPAGE_DB_PASSWORD is required}"
+
+    create_role_and_database() {
+      local role="$1"
+      local database="$2"
+      local password="$3"
+      psql --username "$POSTGRES_USER" --dbname postgres \
+        -v role="$role" -v database="$database" -v password="$password" \
+        <<'SQL'
+    SELECT format('CREATE ROLE %I LOGIN PASSWORD %L', :'role', :'password')
+    WHERE NOT EXISTS (SELECT FROM pg_roles WHERE rolname = :'role')\gexec
+    SELECT format('CREATE DATABASE %I OWNER %I', :'database', :'role')
+    WHERE NOT EXISTS (SELECT FROM pg_database WHERE datname = :'database')\gexec
+    SQL
+    }
+
+    create_role_and_database authentik authentik "$AUTHENTIK_DB_PASSWORD"
+    create_role_and_database gitea gitea "$GITEA_DB_PASSWORD"
+    create_role_and_database netronome netronome "$NETRONOME_DB_PASSWORD"
+    create_role_and_database penpot penpot "$PENPOT_DB_PASSWORD"
+    create_role_and_database statuspage statuspage "$STATUSPAGE_DB_PASSWORD"

postgres/k8s/secrets.yaml.example

@@ -0,0 +1,13 @@
+apiVersion: v1
+kind: Secret
+metadata:
+  name: postgres-shared-secrets
+  namespace: database
+type: Opaque
+stringData:
+  POSTGRES_ADMIN_PASSWORD: ""
+  AUTHENTIK_DB_PASSWORD: ""
+  GITEA_DB_PASSWORD: ""
+  NETRONOME_DB_PASSWORD: ""
+  PENPOT_DB_PASSWORD: ""
+  STATUSPAGE_DB_PASSWORD: ""

postgres/shared-compose.yaml

@@ -0,0 +1,28 @@
+services:
+  postgres:
+    image: postgres:15.19-alpine
+    container_name: homelab-postgres
+    restart: unless-stopped
+    env_file:
+      - .env
+    environment:
+      POSTGRES_DB: postgres
+      POSTGRES_USER: postgres
+      POSTGRES_PASSWORD: ${POSTGRES_ADMIN_PASSWORD:?set POSTGRES_ADMIN_PASSWORD}
+    volumes:
+      - postgres-data:/var/lib/postgresql/data
+      - ./initdb:/docker-entrypoint-initdb.d:ro
+    healthcheck:
+      test: ["CMD-SHELL", "pg_isready -U postgres -d postgres"]
+      interval: 10s
+      timeout: 5s
+      retries: 5
+    networks:
+      - database
+
+volumes:
+  postgres-data:
+
+networks:
+  database:
+    name: homelab-database

prometheus-stack/alertmanager.yaml

@@ -1,5 +1,10 @@
 route:
   receiver: default
+  routes:
+    - receiver: "null"
+      matchers:
+        - alertname="Watchdog"
 
 receivers:
   - name: default
+  - name: "null"

prometheus-stack/compose.yaml

@@ -1,6 +1,6 @@
 services:
   grafana:
-    image: grafana/grafana:11.6.0
+    image: grafana/grafana:13.2.2
     container_name: prometheus-grafana
     restart: unless-stopped
     env_file:
@@ -30,7 +30,7 @@ services:
       - proxy
 
   prometheus:
-    image: prom/prometheus:v3.2.1
+    image: prom/prometheus:v3.14.0
     container_name: prometheus-prometheus
     restart: unless-stopped
     command:
@@ -44,7 +44,7 @@ services:
       - proxy
 
   alertmanager:
-    image: prom/alertmanager:v0.28.1
+    image: prom/alertmanager:v0.34.1
     container_name: prometheus-alertmanager
     restart: unless-stopped
     command:

prometheus-stack/k8s/alertmanager-config.example.yaml

@@ -0,0 +1,42 @@
+templates:
+  - "/etc/alertmanager/config/telegram.tmpl"
+
+route:
+  receiver: telegram
+  group_by:
+    - alertname
+    - namespace
+  group_wait: 30s
+  group_interval: 5m
+  repeat_interval: 12h
+  routes:
+    - receiver: "null"
+      matchers:
+        - alertname="InfoInhibitor"
+    - receiver: "null"
+      matchers:
+        - alertname="Watchdog"
+
+inhibit_rules:
+  - source_matchers:
+      - severity="critical"
+    target_matchers:
+      - severity=~"warning|info"
+    equal:
+      - namespace
+  - source_matchers:
+      - severity="warning"
+    target_matchers:
+      - severity="info"
+    equal:
+      - namespace
+
+receivers:
+  - name: telegram
+    telegram_configs:
+      - bot_token: REPLACE_WITH_TELEGRAM_BOT_TOKEN
+        chat_id: REPLACE_WITH_TELEGRAM_CHAT_ID
+        parse_mode: HTML
+        send_resolved: true
+        message: '{{ template "telegram.forust.message" . }}'
+  - name: "null"

prometheus-stack/k8s/alertmanager-telegram.tmpl

@@ -0,0 +1,44 @@
+{{- define "telegram.forust.message" -}}
+{{- $statusEmoji := "🚨" -}}
+{{- if ne .Status "firing" -}}{{- $statusEmoji = "✅" -}}{{- end -}}
+{{- $count := len .Alerts.Firing -}}
+{{- if eq .Status "resolved" -}}{{- $count = len .Alerts.Resolved -}}{{- end -}}
+{{ $statusEmoji }} <b>{{ .Status | toUpper }} ({{ $count }})</b>
+{{- range .Alerts }}
+
+<b>{{ .Labels.alertname }}</b>
+{{- $sev := .Labels.severity }}
+{{- if eq $sev "critical" }} 🔥 critical
+{{- else if eq $sev "warning" }} ⚠️ warning
+{{- else if eq $sev "info" }} ℹ️ info
+{{- else if $sev }} • {{ $sev }}
+{{- end }}
+{{- if .Annotations.description }}
+
+<i>{{ .Annotations.description }}</i>
+{{- end }}
+{{- if .Labels.namespace }}
+📦 Namespace: <code>{{ .Labels.namespace }}</code>
+{{- end }}
+{{- if .Labels.pod }}
+📦 Pod: <code>{{ .Labels.pod }}</code>
+{{- end }}
+{{- if .Labels.container }}
+🐳 Container: <code>{{ .Labels.container }}</code>
+{{- end }}
+{{- if .Labels.node }}
+🖥 Node: <code>{{ .Labels.node }}</code>
+{{- end }}
+{{- if .Labels.instance }}
+🖥 Instance: <code>{{ .Labels.instance }}</code>
+{{- end }}
+{{- if .Labels.job }}
+🔧 Job: <code>{{ .Labels.job }}</code>
+{{- end }}
+{{- if eq .Status "firing" }}
+🕐 Since: <code>{{ .StartsAt | date "2006-01-02 15:04 MST" }}</code>
+{{- else }}
+🕐 Resolved: <code>{{ .EndsAt | date "2006-01-02 15:04 MST" }}</code>
+{{- end }}
+{{- end }}
+{{- end }}

prometheus-stack/k8s/alerts.yaml

@@ -0,0 +1,86 @@
+apiVersion: monitoring.coreos.com/v1
+kind: PrometheusRule
+metadata:
+  name: homelab-infrastructure
+  namespace: prometheus
+  labels:
+    release: prometheus-stack
+spec:
+  groups:
+    - name: homelab.infrastructure
+      rules:
+        - alert: TargetDown
+          expr: up == 0
+          for: 10m
+          labels:
+            severity: warning
+          annotations:
+            summary: "Prometheus target is down"
+            description: "{{ $labels.job }} target {{ $labels.instance }} has been down for more than 10 minutes."
+
+        - alert: PodCrashLooping
+          expr: max_over_time(kube_pod_container_status_waiting_reason{reason="CrashLoopBackOff"}[10m]) >= 1
+          for: 10m
+          labels:
+            severity: warning
+          annotations:
+            summary: "Pod is crash looping"
+            description: "Container {{ $labels.container }} in {{ $labels.namespace }}/{{ $labels.pod }} is in CrashLoopBackOff."
+
+        - alert: PersistentVolumeClaimFillingUp
+          expr: kubelet_volume_stats_available_bytes / kubelet_volume_stats_capacity_bytes < 0.15
+          for: 15m
+          labels:
+            severity: warning
+          annotations:
+            summary: "PVC has less than 15% free space"
+            description: "{{ $labels.namespace }}/{{ $labels.persistentvolumeclaim }} has less than 15% free space."
+
+        - alert: CPUThrottlingHigh
+          expr: |
+            sum without (id, metrics_path, name, image, endpoint, job, node) (
+              topk by (cluster, namespace, pod, container, instance) (1,
+                increase(container_cpu_cfs_throttled_periods_total{container!="", job="kubelet", metrics_path="/metrics/cadvisor", }[5m])
+              )
+            )
+            / on (cluster, namespace, pod, container, instance) group_left
+            sum without (id, metrics_path, name, image, endpoint, job, node) (
+              topk by (cluster, namespace, pod, container, instance) (1,
+                increase(container_cpu_cfs_periods_total{job="kubelet", metrics_path="/metrics/cadvisor", }[5m])
+              )
+            )
+            > ( 50 / 100 )
+          for: 30m
+          labels:
+            severity: info
+          annotations:
+            summary: "Processes experience elevated CPU throttling"
+            description: "{{ $value | humanizePercentage }} throttling of CPU in namespace {{ $labels.namespace }} for container {{ $labels.container }} in pod {{ $labels.pod }} on cluster {{ $labels.cluster }}."
+            runbook_url: "https://runbooks.prometheus-operator.dev/runbooks/kubernetes/cputhrottlinghigh"
+
+        - alert: NodeMemoryPressure
+          expr: 100 * (1 - node_memory_MemAvailable_bytes / node_memory_MemTotal_bytes) > 90
+          for: 15m
+          labels:
+            severity: warning
+          annotations:
+            summary: "Node memory pressure"
+            description: "Node {{ $labels.instance }} has used more than 90% of memory for 15 minutes."
+
+        - alert: LokiDown
+          expr: kube_statefulset_status_replicas_unavailable{statefulset="loki"} > 0 or kube_deployment_status_replicas_unavailable{deployment="loki-gateway"} > 0
+          for: 10m
+          labels:
+            severity: warning
+          annotations:
+            summary: "Loki is down"
+            description: "Loki in namespace {{ $labels.namespace }} has unavailable replicas for more than 10 minutes. Logs are not queryable."
+
+        - alert: AlloyDown
+          expr: kube_daemonset_status_number_unavailable{daemonset="alloy"} > 0
+          for: 10m
+          labels:
+            severity: warning
+          annotations:
+            summary: "Alloy is down"
+            description: "Alloy DaemonSet in namespace {{ $labels.namespace }} has {{ $value }} unavailable pods for more than 10 minutes. Pod logs are not being shipped to Loki."

prometheus-stack/k8s/grafana-values.yaml

@@ -14,6 +14,10 @@ grafana:
 
   persistence:
     enabled: true
+    # Matches live PVC (10Gi/local-path). Retain migration is a separate task
+    # with data migration (see storage-audit doc); do NOT change SC/size here
+    # without migrating, helm upgrade fails on immutable PVC fields.
+    storageClassName: local-path
     size: 10Gi
 
   ingress:
@@ -22,11 +26,20 @@ grafana:
   service:
     port: 80
 
+  additionalDataSources:
+    - name: Loki
+      type: loki
+      url: http://loki-gateway.prometheus.svc.cluster.local
+      access: proxy
+
 prometheus:
   prometheusSpec:
+    retention: 60d
+    retentionSize: 32GB
     storageSpec:
       volumeClaimTemplate:
         spec:
+          # Matches live PVC, see note on grafana.persistence above.
           storageClassName: "local-path"
           accessModes:
             - ReadWriteOnce
@@ -41,12 +54,18 @@ prometheus:
         memory: "2Gi"
 alertmanager:
   alertmanagerSpec:
+    configSecret: alertmanager-config
     storage:
       volumeClaimTemplate:
         spec:
+          # Matches live PVC (20Gi), see note on grafana.persistence above.
+          storageClassName: local-path
           accessModes:
             - ReadWriteOnce
-
           resources:
             requests:
               storage: 20Gi
+
+defaultRules:
+  disabled:
+    CPUThrottlingHigh: true

prometheus-stack/k8s/ingress.yaml

@@ -10,7 +10,8 @@ spec:
     - match: Host(`grafana.forust.xyz`)
       kind: Rule
       middlewares:
-        - name: "security-chain@file"
+        - name: crowdsec-bouncer
+          namespace: crowdsec
       services:
         - name: prometheus-stack-grafana
           port: 80

prometheus-stack/k8s/traefik-alerts.yaml

@@ -0,0 +1,60 @@
+apiVersion: monitoring.coreos.com/v1
+kind: PrometheusRule
+metadata:
+  name: traefik
+  namespace: prometheus
+  labels:
+    release: prometheus-stack
+spec:
+  groups:
+    - name: traefik
+      rules:
+        - alert: TraefikDown
+          expr: absent(up{job="traefik"})
+          for: 10m
+          labels:
+            severity: critical
+          annotations:
+            summary: "Traefik metrics are unavailable"
+            description: "Prometheus has no Traefik target."
+
+        - alert: TraefikConfigReloadFailed
+          expr: traefik_config_last_reload_success == 0
+          for: 5m
+          labels:
+            severity: warning
+          annotations:
+            summary: "Traefik configuration reload failed"
+            description: "Traefik failed to apply its last configuration reload. Check Traefik logs and the dynamic config sources."
+
+        - alert: TraefikServiceHigh5xxRate
+          expr: |
+            sum(rate(traefik_service_requests_total{code=~"5.."}[5m])) by (service)
+              / sum(rate(traefik_service_requests_total[5m])) by (service) * 100 > 5
+              and sum(rate(traefik_service_requests_total[5m])) by (service) > 0
+          for: 5m
+          labels:
+            severity: warning
+          annotations:
+            summary: "High 5xx error rate for service {{ $labels.service }}"
+            description: "Service {{ $labels.service }} is returning 5xx errors for more than 5% of requests over the last 5 minutes (current: {{ $value | humanizePercentage }})."
+
+        - alert: TraefikServiceHighLatency
+          expr: |
+            histogram_quantile(0.95,
+              sum(rate(traefik_service_request_duration_seconds_bucket{service!~"xui-xui-service-.*"}[5m])) by (le, service)) > 2
+          for: 5m
+          labels:
+            severity: warning
+          annotations:
+            summary: "High latency for service {{ $labels.service }}"
+            description: "P95 latency of {{ $labels.service }} exceeded 2 seconds over the last 5 minutes (current: {{ $value | humanizeDuration }})."
+
+        - alert: TraefikCertExpiringSoon
+          expr: min(traefik_tls_certs_not_after) - time() < 14 * 24 * 60 * 60
+          for: 10m
+          labels:
+            severity: warning
+          annotations:
+            summary: "Traefik TLS certificate expires soon"
+            description: "A TLS certificate managed by Traefik expires in less than 14 days (in {{ $value | humanizeDuration }})."

renovate.json

@@ -0,0 +1,31 @@
+{
+  "$schema": "https://docs.renovatebot.com/renovate-schema.json",
+  "extends": ["config:recommended"],
+  "enabledManagers": ["docker-compose", "kubernetes", "helm-values"],
+  "helm-values": {
+    "managerFilePatterns": ["/k8s/.+values\\.ya?ml$/"]
+  },
+  "kubernetes": {
+    "managerFilePatterns": ["/k8s/.+\\.ya?ml$/"]
+  },
+  "packageRules": [
+    {
+      "description": "Keep private homelab images unchanged",
+      "matchDatasources": ["docker"],
+      "matchPackageNames": ["/gcr\\.forust\\.xyz\\/forust\\/.+/"],
+      "enabled": false
+    },
+    {
+      "description": "Require approval for major upgrades",
+      "matchUpdateTypes": ["major"],
+      "dependencyDashboardApproval": true,
+      "automerge": false
+    },
+    {
+      "description": "Group container patch updates",
+      "matchDatasources": ["docker"],
+      "matchUpdateTypes": ["patch"],
+      "groupName": "container patch updates"
+    }
+  ]
+}

renovate/.env.example

@@ -0,0 +1,4 @@
+RENOVATE_ENDPOINT=https://gitea.forust.xyz/api/v1
+RENOVATE_TOKEN=
+RENOVATE_REPOSITORIES=forust/homelab
+LOG_LEVEL=info

renovate/README.md

@@ -0,0 +1,72 @@
+# Renovate for Gitea
+
+Renovate runs as a Kubernetes CronJob and creates container image update pull
+requests in Gitea. It does not deploy changes itself.
+
+## Kubernetes
+
+Create a dedicated Gitea user named `renovate-bot`, create a repository access
+token, and grant it repository read/write plus issue read/write permissions.
+Add `read:packages` if Renovate must inspect private Gitea registry images.
+
+Create the ignored Secret locally; never commit the PAT:
+
+```sh
+cp renovate/k8s/secrets.yaml.example renovate/k8s/secrets.yaml
+$EDITOR renovate/k8s/secrets.yaml
+kubectl apply -f renovate/k8s/namespace.yaml
+kubectl apply -f renovate/k8s/secrets.yaml
+kubectl apply -f renovate/k8s/configmap.yaml
+kubectl apply -f renovate/k8s/cronjob.yaml
+```
+
+The `renovate/k8s/active` marker makes the normal deployment workflow include
+the namespace, ConfigMap, and CronJob. The Secret is intentionally excluded
+from Git and must be applied separately after every new cluster.
+
+Run it immediately instead of waiting for the six-hour schedule.
+
+Two options, both use the same `renovate/config.js`:
+
+```sh
+kubectl create job --from=cronjob/renovate renovate-manual-$(date +%s) -n renovate
+```
+
+or the `renovate-run` Actions workflow (Actions tab → `renovate-run` →
+Run workflow). It runs `renovate/renovate:44.103.0` on the self-hosted
+runner via Docker. Required Actions secrets (repo or org settings):
+
+- `RENOVATE_TOKEN` — renovate-bot PAT (repository + issue read/write).
+- `RENOVATE_GITHUB_COM_TOKEN` — optional, for changelogs and GitHub rate limits.
+
+Inputs: `repositories` (default `forust/homelab`), `log_level`
+(`info`/`debug`). Only one run at a time (concurrency group
+`renovate-run`), same as the CronJob `Forbid` policy.
+
+Inspect runs with:
+
+```sh
+kubectl get cronjob,jobs,pods -n renovate
+kubectl logs -n renovate job/<job-name>
+```
+
+`RENOVATE_GITHUB_COM_TOKEN` is optional but recommended for changelogs and
+GitHub API rate limits. Set it in the Kubernetes Secret if available.
+
+## Compose
+
+Copy `.env.example` to `.env`, set the PAT, and run:
+
+```sh
+docker compose -f renovate-compose.yaml run --rm renovate
+```
+
+The Compose file is intentionally named `renovate-compose.yaml`, so the
+repository's automatic deployment discovery does not start it accidentally.
+
+## How updates flow
+
+Renovate scans both `compose.yaml` files and Kubernetes manifests, opens a
+branch and PR with image tag changes, and waits for CI. After merge, the
+existing deployment workflow applies Kubernetes changes or redeploys Compose
+stacks. Renovate never updates running workloads directly.

renovate/config.js

@@ -0,0 +1,44 @@
+module.exports = {
+  platform: 'gitea',
+  endpoint: process.env.RENOVATE_ENDPOINT,
+  enabledManagers: ['docker-compose', 'kubernetes', 'helm-values'],
+  'helm-values': {
+    managerFilePatterns: ['/k8s/.+values\\.ya?ml$/'],
+  },
+  kubernetes: {
+    managerFilePatterns: ['/k8s/.+\\.ya?ml$/'],
+  },
+  repositories: (process.env.RENOVATE_REPOSITORIES || '')
+    .split(',')
+    .map((repository) => repository.trim())
+    .filter(Boolean),
+  onboarding: false,
+  requireConfig: 'optional',
+  autodiscover: false,
+  dependencyDashboard: true,
+  prCreation: 'immediate',
+  labels: ['dependencies', 'automated'],
+  extends: [
+    'config:recommended',
+    ':dependencyDashboard',
+  ],
+  packageRules: [
+    {
+      description: 'Do not update private homelab images',
+      matchDatasources: ['docker'],
+      matchPackageNames: ['/gcr\\.forust\\.xyz\\/forust\\/.+/'],
+      enabled: false,
+    },
+    {
+      description: 'Keep major upgrades manual',
+      matchUpdateTypes: ['major'],
+      dependencyDashboardApproval: true,
+      automerge: false,
+    },
+    {
+      description: 'Group patch updates',
+      matchUpdateTypes: ['patch'],
+      groupName: 'container patch updates',
+    },
+  ],
+};

renovate/k8s/configmap.yaml

@@ -0,0 +1,51 @@
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: renovate-config
+  namespace: renovate
+data:
+  config.js: |
+    module.exports = {
+      platform: 'gitea',
+      endpoint: process.env.RENOVATE_ENDPOINT,
+      enabledManagers: ['docker-compose', 'kubernetes', 'helm-values'],
+      'helm-values': {
+        managerFilePatterns: ['/k8s/.+values\\.ya?ml$/'],
+      },
+      kubernetes: {
+        managerFilePatterns: ['/k8s/.+\\.ya?ml$/'],
+      },
+      repositories: (process.env.RENOVATE_REPOSITORIES || '')
+        .split(',')
+        .map((repository) => repository.trim())
+        .filter(Boolean),
+      onboarding: false,
+      requireConfig: 'optional',
+      autodiscover: false,
+      dependencyDashboard: true,
+      prCreation: 'immediate',
+      labels: ['dependencies', 'automated'],
+      extends: [
+        'config:recommended',
+        ':dependencyDashboard',
+      ],
+      packageRules: [
+        {
+          description: 'Do not update private homelab images',
+          matchDatasources: ['docker'],
+          matchPackageNames: ['/gcr\\.forust\\.xyz\\/forust\\/.+/'],
+          enabled: false,
+        },
+        {
+          description: 'Keep major upgrades manual',
+          matchUpdateTypes: ['major'],
+          dependencyDashboardApproval: true,
+          automerge: false,
+        },
+        {
+          description: 'Group patch updates',
+          matchUpdateTypes: ['patch'],
+          groupName: 'container patch updates',
+        },
+      ],
+    };