🔧 Renovate: Pin dependencies

Merged by Trez.One

.gitea/workflows/compose-services-readme.yml

@@ -11,7 +11,7 @@ jobs:
    runs-on: ubuntu-latest
    steps:
     - name: Checkout
-      uses: actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955 # v4.3.0
+      uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
       with:
         ref: 'main'
 
@@ -20,7 +20,7 @@ jobs:
 
     - name: Generate service list
       run: |
-        yq '.services | to_entries | map({"service": .key, "image": .value.image, "description": (.value.labels."homepage.description" // "")})' docker-compose.yml > services.yml
+        yq 'explode(.) | .services | to_entries | map({"service": .key, "image": (.value.image | sub("@sha256:.*$"; "")), "description": (.value.labels."homepage.description" // "")})' docker-compose.yml > services.yml
 
     - name: Generate Markdown Table
       uses: gazab/create-markdown-table@6686233d7008e8d8b9d4bbdbfd1fb1ae510019f0 # v1.0.7

.gitea/workflows/pr-docker-deploy.yml

@@ -10,8 +10,8 @@ on:
       - "**/docker-compose.yml"
 
 env:
-  HC_VAULT_VERSION: "1.20.4"
-  TEA_VERSION: "0.10.1"
+  HC_VAULT_VERSION: "1.21.4"
+  TEA_VERSION: "0.14.0"
 
 jobs:
   check-and-create-pr:
@@ -20,12 +20,12 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout Code
-        uses: actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955 # v4.3.0
+        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
         with:
           fetch-depth: 1
 
       - name: Gotify Notification
-        uses: eikendev/gotify-action@master
+        uses: eikendev/gotify-action@ca0339b85ee8db9fda9c0718aaa7f95e17b3c617 # 0.0.4
         with:
           gotify_api_base: "${{ secrets.RUNNER_GOTIFY_URL }}"
           gotify_app_token: "${{ secrets.RUNNER_GOTIFY_TOKEN }}"
@@ -41,7 +41,7 @@ jobs:
           assignee: ${{ github.actor }}
 
       - name: Gotify Notification
-        uses: eikendev/gotify-action@master
+        uses: eikendev/gotify-action@ca0339b85ee8db9fda9c0718aaa7f95e17b3c617 # 0.0.4
         with:
           gotify_api_base: "${{ secrets.RUNNER_GOTIFY_URL }}"
           gotify_app_token: "${{ secrets.RUNNER_GOTIFY_TOKEN }}"
@@ -56,14 +56,14 @@ jobs:
       svc_deploy_list: ${{ steps.detect_services.outputs.docker_svc_list }}
     steps:
       - name: Checkout
-        uses: actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955 # v4.3.0
+        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
 
       - name: Fetch base branch
         run: |
           git fetch origin ${{ github.event.pull_request.base.ref }}
 
       - name: Gotify Notification
-        uses: eikendev/gotify-action@master
+        uses: eikendev/gotify-action@ca0339b85ee8db9fda9c0718aaa7f95e17b3c617 # 0.0.4
         with:
           gotify_api_base: "${{ secrets.RUNNER_GOTIFY_URL }}"
           gotify_app_token: "${{ secrets.RUNNER_GOTIFY_TOKEN }}"
@@ -121,7 +121,7 @@ jobs:
       DOCKER_SVC_LIST: ${{ needs.generate-service-list.outputs.svc_deploy_list }}
     steps:
       - name: Checkout
-        uses: actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955 # v4.3.0
+        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
 
       - name: Login to Docker Hub
         uses: docker/login-action@5e57cd118135c172c3672efd75eb46360885c0ef # v3.6.0
@@ -150,7 +150,7 @@ jobs:
           password: ${{ secrets.BOT_GITEA_PASSWORD }}
 
       - name: Gotify Notification
-        uses: eikendev/gotify-action@master
+        uses: eikendev/gotify-action@ca0339b85ee8db9fda9c0718aaa7f95e17b3c617 # 0.0.4
         with:
           gotify_api_base: "${{ secrets.RUNNER_GOTIFY_URL }}"
           gotify_app_token: "${{ secrets.RUNNER_GOTIFY_TOKEN }}"
@@ -162,8 +162,8 @@ jobs:
         with:
           HC_VAULT_VERSION: ${{ env.HC_VAULT_VERSION }}
           HC_VAULT_ADDR: ${{ secrets.TREZ_VAULT_ADDR }}
-          HC_VAULT_USERNAME: ${{ secrets.VAULT_GITEA_USER }}
-          HC_VAULT_PASSWORD: ${{ secrets.VAULT_GITEA_PASSWORD }}
+          HC_VAULT_AUTH: token
+          HC_VAULT_TOKEN: ${{ secrets.VAULT_GITEA_TOKEN }}
           HC_VAULT_SECRETS_PATH: rikku-docker/env
 
       - name: Pre-pull/build service images in parallel
@@ -174,7 +174,7 @@ jobs:
           services: ${{ env.DOCKER_SVC_LIST }}
 
       - name: Docker Compose Dry Run
-        uses: cssnr/stack-deploy-action@d58b92bcd776afc57ef12f55bafff71200fd218e # v1.4.0
+        uses: cssnr/stack-deploy-action@28c3c6f42b225af7100652b459621c0c966fd901 # v1.5.0
         with:
           mode: compose
           file: docker-compose.yml
@@ -187,7 +187,7 @@ jobs:
           summary: true
 
       - name: Gotify Notification
-        uses: eikendev/gotify-action@master
+        uses: eikendev/gotify-action@ca0339b85ee8db9fda9c0718aaa7f95e17b3c617 # 0.0.4
         with:
           gotify_api_base: "${{ secrets.RUNNER_GOTIFY_URL }}"
           gotify_app_token: "${{ secrets.RUNNER_GOTIFY_TOKEN }}"
@@ -205,7 +205,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout
-        uses: actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955 # v4.3.0
+        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
 
       - name: Cache tea CLI
         id: cache-tea
@@ -232,7 +232,7 @@ jobs:
           echo "pr_index=${pr_index}" >> $GITHUB_OUTPUT
 
       - name: Gotify Notification
-        uses: eikendev/gotify-action@master
+        uses: eikendev/gotify-action@ca0339b85ee8db9fda9c0718aaa7f95e17b3c617 # 0.0.4
         with:
           gotify_api_base: "${{ secrets.RUNNER_GOTIFY_URL }}"
           gotify_app_token: "${{ secrets.RUNNER_GOTIFY_TOKEN }}"
@@ -250,7 +250,7 @@ jobs:
       DOCKER_SVC_LIST: ${{ needs.generate-service-list.outputs.svc_deploy_list }}
     steps:
       - name: Checkout
-        uses: actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955 # v4.3.0
+        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
         with:
           ref: main
 
@@ -281,7 +281,7 @@ jobs:
           password: ${{ secrets.BOT_GITEA_PASSWORD }}
 
       - name: Gotify Notification
-        uses: eikendev/gotify-action@master
+        uses: eikendev/gotify-action@ca0339b85ee8db9fda9c0718aaa7f95e17b3c617 # 0.0.4
         with:
           gotify_api_base: "${{ secrets.RUNNER_GOTIFY_URL }}"
           gotify_app_token: "${{ secrets.RUNNER_GOTIFY_TOKEN }}"
@@ -298,7 +298,7 @@ jobs:
           HC_VAULT_SECRETS_PATH: rikku-docker/env
 
       - name: Docker Compose Deployment
-        uses: cssnr/stack-deploy-action@d58b92bcd776afc57ef12f55bafff71200fd218e # v1.4.0
+        uses: cssnr/stack-deploy-action@28c3c6f42b225af7100652b459621c0c966fd901 # v1.5.0
         with:
           mode: compose
           file: docker-compose.yml
@@ -322,7 +322,7 @@ jobs:
           skip-no-healthcheck: "true"
 
       - name: Gotify Notification
-        uses: eikendev/gotify-action@master
+        uses: eikendev/gotify-action@ca0339b85ee8db9fda9c0718aaa7f95e17b3c617 # 0.0.4
         with:
           gotify_api_base: "${{ secrets.RUNNER_GOTIFY_URL }}"
           gotify_app_token: "${{ secrets.RUNNER_GOTIFY_TOKEN }}"

.gitea/workflows/renovate-pr-deploy.yml

@@ -10,7 +10,7 @@ on:
       - "**/docker-compose.yml"
 
 env:
-  HC_VAULT_VERSION: "1.20.4"
+  HC_VAULT_VERSION: "1.21.4"
   VAULT_ADDR: ${{ secrets.TREZ_VAULT_ADDR }}
   VAULT_TOKEN: ${{ secrets.VAULT_GITEA_TOKEN }}
 
@@ -23,7 +23,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Check out code
-        uses: actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955 # v4.3.0
+        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
         with:
           fetch-depth: 0
 
@@ -106,7 +106,7 @@ jobs:
           password: ${{ secrets.BOT_GITEA_PASSWORD }}
 
       - name: Gotify Notification
-        uses: eikendev/gotify-action@master
+        uses: eikendev/gotify-action@ca0339b85ee8db9fda9c0718aaa7f95e17b3c617 # 0.0.4
         with:
           gotify_api_base: "${{ secrets.RUNNER_GOTIFY_URL }}"
           gotify_app_token: "${{ secrets.RUNNER_GOTIFY_TOKEN }}"
@@ -118,12 +118,12 @@ jobs:
         with:
           HC_VAULT_VERSION: ${{ env.HC_VAULT_VERSION }}
           HC_VAULT_ADDR: ${{ secrets.TREZ_VAULT_ADDR }}
-          HC_VAULT_USERNAME: ${{ secrets.VAULT_GITEA_USER }}
-          HC_VAULT_PASSWORD: ${{ secrets.VAULT_GITEA_PASSWORD }}
+          HC_VAULT_AUTH: token
+          HC_VAULT_TOKEN: ${{ secrets.VAULT_GITEA_TOKEN }}
           HC_VAULT_SECRETS_PATH: rikku-docker/env
 
       - name: Docker Compose Deployment
-        uses: cssnr/stack-deploy-action@d58b92bcd776afc57ef12f55bafff71200fd218e # v1.4.0
+        uses: cssnr/stack-deploy-action@28c3c6f42b225af7100652b459621c0c966fd901 # v1.5.0
         with:
           mode: compose
           file: docker-compose.yml
@@ -147,7 +147,7 @@ jobs:
           skip-no-healthcheck: "true"
 
       - name: Gotify Notification
-        uses: eikendev/gotify-action@master
+        uses: eikendev/gotify-action@ca0339b85ee8db9fda9c0718aaa7f95e17b3c617 # 0.0.4
         with:
           gotify_api_base: "${{ secrets.RUNNER_GOTIFY_URL }}"
           gotify_app_token: "${{ secrets.RUNNER_GOTIFY_TOKEN }}"

.gitea/workflows/renovate.yml

@@ -6,7 +6,7 @@ on:
   workflow_dispatch:
 
 env:
-  RENOVATE_VERSION: "41.138.5"
+  RENOVATE_VERSION: "42.84.2"
 
 jobs:
   renovate:
@@ -14,7 +14,7 @@ jobs:
     timeout-minutes: 5
     steps:
       - name: Checkout
-        uses: actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955 # v4.3.0
+        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
 
       - name: Renovate Run
         env:

README.md

@@ -4,18 +4,22 @@
 
 | Service | Image | Description |
 | --- | --- | --- |
-| adguard | adguard/adguardhome:v0.107.67@sha256:927dc14b3e3cbd359e84658914590270a77d54446a6565e9498bef3444c286a4 |  |
-| beszel-agent | henrygd/beszel-agent:0.13.2@sha256:da76c4091dc5a1504d53df6e9b880ce3f5fe3adf369656fcf4f300970a4452e8 |  |
-| castsponsorskip | ghcr.io/gabe565/castsponsorskip:0.8.2@sha256:fe3a1b45987168b9cbccc394496e42bed5d396cd4869aa70ea402c686e679403 |  |
-| docker-socket-proxy | ghcr.io/tecnativa/docker-socket-proxy:latest@sha256:3400c429c5f9e1b21d62130fb93b16e2e772d4fb7695bd52fc2b743800b9fe9e |  |
-| dockflare | alplat/dockflare:stable@sha256:6955b8c7c16099226d2c314851c388c4027d16b2844082735010e5c3b88e342c |  |
-| ha-fusion | ghcr.io/matt8707/ha-fusion:2024.10.1@sha256:5eea4634ab2b1e7c7523943996d13318d109b293abe8e9e86c38daf5c41830cb |  |
-| homeassistant | ghcr.io/home-assistant/home-assistant:stable@sha256:5ae78cf2e6d8b53439cac50ed184ff1336cfbbb878fce16f75589e048fcdcdd9 |  |
-| ollama | ollama/ollama:0.12.5@sha256:e43c26d2d1ebc726bc932166d2979086310b2f9c5ccd64fb06b55d1ea2c4f2cc |  |
-| portainer-agent | portainer/agent:latest@sha256:a454c023f4b79ae308e372e5a4ab0d37961d6d8ad88fe5945544435203ded198 |  |
-| renovate | renovate/renovate:41.141.0-full@sha256:c59f19a05048acce73d727f7c14b5e27f6f0064e5845d90861fa29be542504ae |  |
-| renovate-valkey | docker.io/valkey/valkey:8-alpine@sha256:e706d1213aaba6896c162bb6a3a9e1894e1a435f28f8f856d14fab2e10aa098b |  |
-| signoz-logspout | pavanputhra/logspout-signoz:2025.07.19-887dfeb@sha256:6da8ce12279a5262de8b2d5c083ce82d4c878c4eab702b4d328afe147ed7553b |  |
-| upsnap | ghcr.io/seriousm4x/upsnap:5@sha256:1d84315eb2811e849ffcab86ac5b5ecb73c0299db0b12766c8179864bdad7641 |  |
-| webhook | thecatlady/webhook:2.8.2@sha256:0507d6c27d87837bcdee5078d63f54e50d9073ae879618233858e3da68d4b0cc |  |
+| adguard | adguard/adguardhome:v0.107.76 |  |
+| beszel-agent | henrygd/beszel-agent:0.18.7 |  |
+| castsponsorskip | ghcr.io/gabe565/castsponsorskip:0.8.3 |  |
+| docker-socket-proxy | ghcr.io/tecnativa/docker-socket-proxy:latest |  |
+| dockflare | alplat/dockflare:stable |  |
+| ha-fusion | ghcr.io/matt8707/ha-fusion:2024.10.1 |  |
+| homeassistant | ghcr.io/home-assistant/home-assistant:stable |  |
+| patchmon-server | ghcr.io/patchmon/patchmon-server:latest |  |
+| patchmon-pg-db | postgres:17-alpine |  |
+| patchmon-redis | redis:7-alpine |  |
+| patchmon-guacd | guacamole/guacd:1.6.0 |  |
+| portainer-agent | portainer/agent:latest |  |
+| renovate | renovate/renovate:43.170.22-full |  |
+| renovate-valkey | docker.io/valkey/valkey:9-alpine |  |
+| signoz-logspout | pavanputhra/logspout-signoz:2025.07.19-887dfeb |  |
+| snapcast-server | docker.io/sweisgerber/snapcast:latest |  |
+| upsnap | ghcr.io/seriousm4x/upsnap:5 |  |
+| webhook | thecatlady/webhook:2.8.2 |  |
 

docker-compose.yml

@@ -10,7 +10,7 @@ services:
     container_name: adguard
     environment:
       TZ: ${TZ}
-    image: adguard/adguardhome:v0.107.67@sha256:927dc14b3e3cbd359e84658914590270a77d54446a6565e9498bef3444c286a4
+    image: adguard/adguardhome:v0.107.76@sha256:7157eb1dc3b26c7af1d6898759a7b3f7d0fa09891fbd2d3caa6abc1057a9179b
     network_mode: host
     privileged: true
     restart: unless-stopped
@@ -29,7 +29,7 @@ services:
       HUB_URL: http://192.168.1.254:22220
     expose:
       - 45876
-    image: henrygd/beszel-agent:0.13.2@sha256:da76c4091dc5a1504d53df6e9b880ce3f5fe3adf369656fcf4f300970a4452e8
+    image: henrygd/beszel-agent:0.18.7@sha256:8874e2c53f9de5e063a6a80d6b617e20fa593ac5dc4eb4c6ce1f912f510f38f8
     network_mode: host
     restart: unless-stopped
     volumes:
@@ -38,7 +38,7 @@ services:
       - /var/run/docker.sock:/var/run/docker.sock:ro
   castsponsorskip:
     container_name: castsponsorskip
-    image: ghcr.io/gabe565/castsponsorskip:0.8.2@sha256:fe3a1b45987168b9cbccc394496e42bed5d396cd4869aa70ea402c686e679403
+    image: ghcr.io/gabe565/castsponsorskip:0.8.3@sha256:f556d274aab94c3140058e9f192396bc75e04d8e075769223c1edfc8c4f4daa4
     environment:
       TZ: ${TZ}
       # CSS_PAUSED_INTERVAL:
@@ -72,7 +72,7 @@ services:
       TASKS: 1
       VOLUMES: 1
       LOG_LEVEL: debug
-    image: ghcr.io/tecnativa/docker-socket-proxy:latest@sha256:3400c429c5f9e1b21d62130fb93b16e2e772d4fb7695bd52fc2b743800b9fe9e
+    image: ghcr.io/tecnativa/docker-socket-proxy:latest@sha256:1f3a6f303320723d199d2316a3e82b2e2685d86c275d5e3deeaf182573b47476
     ports:
       - 2375:2375
     privileged: true
@@ -101,16 +101,17 @@ services:
       TUNNEL_NAME: dockflared-tunnel
       TZ: ${TZ}
     healthcheck:
-      test:
-        [
+      test: [
           "CMD-SHELL",
-          "wget -qO- --server-response http://localhost:5000/ping 2>&1 | awk '/^  HTTP/{code=$2} /^[^{]/{next} {print; fflush()} END{exit (code>=400 || code==0)}' >/dev/null",
+          "wget -qO- --server-response http://localhost:5000/ping 2>&1 | awk
+          '/^  HTTP/{code=$2} /^[^{]/{next} {print; fflush()} END{exit
+          (code>=400 || code==0)}' >/dev/null",
         ]
       interval: 1m30s
       timeout: 30s
       retries: 5
       start_period: 30s
-    image: alplat/dockflare:stable@sha256:6955b8c7c16099226d2c314851c388c4027d16b2844082735010e5c3b88e342c # Or :unstable for the latest features
+    image: alplat/dockflare:stable@sha256:ff2807c696b0752767716825e7b3d9f7d4f353e7ea8a323dc2b7cc174ad27ef7 # Or :unstable for the latest features
     # labels:
     #   ## EXAMPLE CF TUNNEL LABELS ###
     #   Enable DockFlare management for this container
@@ -159,7 +160,7 @@ services:
       - /dev/ttyS0:/dev/ttyS0
     environment:
       DISABLE_JEMALLOC: true
-    image: ghcr.io/home-assistant/home-assistant:stable@sha256:5ae78cf2e6d8b53439cac50ed184ff1336cfbbb878fce16f75589e048fcdcdd9
+    image: ghcr.io/home-assistant/home-assistant:stable@sha256:f0baa7922ecec7790c40c41baf08ab218b6ab8db5f96dc03b03a0ae33d987c3d
     labels:
       com.centurylinklabs.watchtower.monitor-only: true
     network_mode: host
@@ -169,17 +170,103 @@ services:
       - ${RIKKU_DOCKER_DIR}/homeassistant:/config
       - /etc/localtime:/etc/localtime:ro
       - /run/dbus:/run/dbus:ro
-  ollama:
-    container_name: ollama
-    image: ollama/ollama:0.12.5@sha256:e43c26d2d1ebc726bc932166d2979086310b2f9c5ccd64fb06b55d1ea2c4f2cc
+  patchmon-server:
+    container_name: patchmon-server
+    depends_on:
+      patchmon-pg-db:
+        condition: service_healthy
+      patchmon-redis:
+        condition: service_healthy
+      patchmon-guacd:
+        condition: service_healthy
+    environment:
+      CORS_ORIGIN: "*"
+      JWT_SECRET: ${PATCHMON_JWT_SECRET}
+      POSTGRES_HOST: patchmon-pg-db
+      DATABASE_URL: postgresql://patchmon:${PATCHMON_PG_PASSWORD}@patchmon-pg-db:5432/patchmon
+      ENABLE_LOGGING: true
+      GUACD_ADDRESS: patchmon-guacd:4822
+      LOG_LEVEL: info
+      REDIS_HOST: patchmon-redis
+      SESSION_SECRET: ${PATCHMON_SESSION_SECRET}
+      AI_ENCRYPTION_KEY: ${PATCHMON_AI_ENCRYPTION_KEY}
+      REDIS_PORT: 6379
+      REDIS_PASSWORD: ${PATCHMON_REDIS_PASSWORD}
+      REDIS_DB: 0
+      TRUST_PROXY: true
+      TZ: ${TZ}
+    image: ghcr.io/patchmon/patchmon-server:latest@sha256:eaa1bcce290c7003cff01a96cfc893a64cb144e582e9b797875e6381f56b297a
     ports:
-      - 11434:11434
+      - 3000:3000
     restart: unless-stopped
+  patchmon-pg-db:
+    container_name: patchmon-pg-db
+    image: postgres:17-alpine@sha256:979c4379dd698aba0b890599a6104e082035f98ef31d9b9291ec22f2b13059ca
+    restart: unless-stopped
+    environment:
+      POSTGRES_PASSWORD: ${PATCHMON_PG_PASSWORD}
+      POSTGRES_USER: patchmon
+      POSTGRES_DB: patchmon
+    expose:
+      - 5432
     volumes:
-      - ollama:/root/.ollama
+      - patchmon-pg-data:/var/lib/postgresql/data
+    healthcheck:
+      test: ["CMD-SHELL", "pg_isready -U patchmon -d patchmon"]
+      interval: 3s
+      timeout: 5s
+      retries: 7
+  patchmon-redis:
+    container_name: patchmon-redis
+    image: redis:7-alpine@sha256:6ab0b6e7381779332f97b8ca76193e45b0756f38d4c0dcda72dbb3c32061ab99
+    restart: unless-stopped
+    environment:
+      TZ: ${TZ}
+      REDIS_PORT: 6379
+      REDIS_PASSWORD: ${PATCHMON_REDIS_PASSWORD}
+      REDIS_DB: 0
+    expose:
+      - 6379
+    command: redis-server --requirepass ${PATCHMON_REDIS_PASSWORD}
+    volumes:
+      - patchmon-redis-data:/data
+    healthcheck:
+      test:
+        [
+          "CMD",
+          "redis-cli",
+          "--no-auth-warning",
+          "-a",
+          "${PATCHMON_REDIS_PASSWORD}",
+          "ping",
+        ]
+      interval: 3s
+      timeout: 5s
+      retries: 7
+  patchmon-guacd:
+    container_name: patchmon-guacd
+    image: guacamole/guacd:1.6.0@sha256:8974eaa9ba32f713daf311e7cc8cd7e4cdfba1edea39eed75524e78ef4b08f4f
+    expose:
+      - 4822
+    restart: unless-stopped
+    read_only: true
+    tmpfs:
+      - /tmp:size=64m
+    security_opt:
+      - no-new-privileges:true
+    cap_drop:
+      - ALL
+    mem_limit: 512m
+    cpus: "1.0"
+    healthcheck:
+      test: ["CMD-SHELL", "nc -z localhost 4822 || exit 1"]
+      interval: 10s
+      timeout: 5s
+      retries: 3
+      start_period: 10s
   portainer-agent:
     container_name: portainer_agent
-    image: portainer/agent:latest@sha256:a454c023f4b79ae308e372e5a4ab0d37961d6d8ad88fe5945544435203ded198
+    image: portainer/agent:latest@sha256:dc0e8285f8b4c105c3237f1cc0022f92dd265c53ced5f53b9ce7c9741144e879
     volumes:
       - /:/host
       - /var/lib/docker/volumes:/var/lib/docker/volumes
@@ -227,7 +314,7 @@ services:
       GHCR_USER: ${RENOVATE__GHCR_USER}
       GITEA_BOT_PASS: ${RENOVATE__GITEA_BOT_PASS}
       GITEA_BOT_USER: ${RENOVATE__GITEA_BOT_USER}
-    image: renovate/renovate:41.141.0-full@sha256:c59f19a05048acce73d727f7c14b5e27f6f0064e5845d90861fa29be542504ae
+    image: renovate/renovate:43.170.22-full@sha256:934f64671c3f6535f5cce940b921a06aaaf47a347ce7de82b01b4028b223dcda
     restart: unless-stopped
     volumes:
       - ${RIKKU_DOCKER_DIR}/renovate/config.js:/etc/renovate/config.js
@@ -235,7 +322,7 @@ services:
     container_name: renovate-valkey
     healthcheck:
       test: redis-cli ping || exit 1
-    image: docker.io/valkey/valkey:8-alpine@sha256:e706d1213aaba6896c162bb6a3a9e1894e1a435f28f8f856d14fab2e10aa098b
+    image: docker.io/valkey/valkey:9-alpine@sha256:a35428eba9043cc0b79dbe54100f0c92784f2de00ad09b01182bfb1c5c83d1bd
     environment:
       ALLOW_EMPTY_PASSWORD: yes
       VALKEY_DATA_DIR: /data/valkey
@@ -255,6 +342,23 @@ services:
     restart: unless-stopped
     volumes:
       - /var/run/docker.sock:/var/run/docker.sock
+  snapcast-server:
+    image: docker.io/sweisgerber/snapcast:latest@sha256:584b93fb4db3a9ef4afeb2427bc761e6365f1794bb02808da0e940d5a2c16a6e
+    hostname: snapcast-server
+    container_name: snapcast-server
+    environment:
+      TZ: ${TZ}
+    restart: "unless-stopped"
+    ports:
+      - 1704:1704
+      - 1705:1705
+      - 1780:1780
+      - 4953:4953
+      # devices:
+      # - /dev/snd:/dev/snd # optional, only if you want to use snapclient
+    volumes:
+      - ${RIKKU_DOCKER_DIR}/snapcast/config/:/config/
+      - ${RIKKU_DOCKER_DIR}/snapcast/data/:/data/
   upsnap:
     container_name: upsnap
     dns:
@@ -274,7 +378,7 @@ services:
     healthcheck:
       test: curl -fs "http://localhost:5000/api/health" || exit 1
       interval: 10s
-    image: ghcr.io/seriousm4x/upsnap:5@sha256:1d84315eb2811e849ffcab86ac5b5ecb73c0299db0b12766c8179864bdad7641 # images are also available on docker hub: seriousm4x/upsnap:5
+    image: ghcr.io/seriousm4x/upsnap:5@sha256:80884ae345acff00003bc64f379ccd3fbc8cccb8e87dd8987d6691c75437054b # images are also available on docker hub: seriousm4x/upsnap:5
     network_mode: host
     privileged: true
     restart: unless-stopped
@@ -293,7 +397,9 @@ services:
 volumes:
   dockflare_data:
     name: dockflare_data
-  ollama:
-    name: ollama
+  patchmon-pg-data:
+    name: patchmon-pg-data
+  patchmon-redis-data:
+    name: patchmon-redis-data
   renovate-valkey-data:
     name: renovate-valkey-data