Merge pull request '🔧 Renovate: Update (digest) postgres:17-alpine Docker digest to 67f624a' (#352 ) from renovate/postgres-17-alpine into main

🔧 Renovate: Update (digest) postgres:17-alpine Docker digest to 67f624a
Merge pull request '🔧 Renovate: Update (digest) postgres:17-alpine Docker digest to 6a3e868' (#351 ) from renovate/postgres-17-alpine into main
2026-07-07 18:28:52 -04:00 · 2026-07-07 22:28:44 +00:00 · 2026-07-07 18:04:35 -04:00 · 2026-07-07 22:04:28 +00:00 · 2026-07-06 09:33:43 -04:00 · 2026-07-05 07:07:01 +00:00
5 changed files with 145 additions and 25 deletions
@@ -10,8 +10,8 @@ on:
      - "**/docker-compose.yml"

 env:
-  HC_VAULT_VERSION: "1.21.1"
-  TEA_VERSION: "0.10.1"
+  HC_VAULT_VERSION: "1.21.4"
+  TEA_VERSION: "0.14.0"

 jobs:
  check-and-create-pr:
@@ -174,7 +174,7 @@ jobs:
          services: ${{ env.DOCKER_SVC_LIST }}

      - name: Docker Compose Dry Run
-        uses: cssnr/stack-deploy-action@d58b92bcd776afc57ef12f55bafff71200fd218e # v1.4.0
+        uses: cssnr/stack-deploy-action@28c3c6f42b225af7100652b459621c0c966fd901 # v1.5.0
        with:
          mode: compose
          file: docker-compose.yml
@@ -298,7 +298,7 @@ jobs:
          HC_VAULT_SECRETS_PATH: rikku-docker/env

      - name: Docker Compose Deployment
-        uses: cssnr/stack-deploy-action@d58b92bcd776afc57ef12f55bafff71200fd218e # v1.4.0
+        uses: cssnr/stack-deploy-action@28c3c6f42b225af7100652b459621c0c966fd901 # v1.5.0
        with:
          mode: compose
          file: docker-compose.yml
@@ -10,7 +10,7 @@ on:
      - "**/docker-compose.yml"

 env:
-  HC_VAULT_VERSION: "1.21.1"
+  HC_VAULT_VERSION: "1.21.4"
  VAULT_ADDR: ${{ secrets.TREZ_VAULT_ADDR }}
  VAULT_TOKEN: ${{ secrets.VAULT_GITEA_TOKEN }}

@@ -123,7 +123,7 @@ jobs:
          HC_VAULT_SECRETS_PATH: rikku-docker/env

      - name: Docker Compose Deployment
-        uses: cssnr/stack-deploy-action@d58b92bcd776afc57ef12f55bafff71200fd218e # v1.4.0
+        uses: cssnr/stack-deploy-action@28c3c6f42b225af7100652b459621c0c966fd901 # v1.5.0
        with:
          mode: compose
          file: docker-compose.yml
@@ -6,7 +6,7 @@ on:
  workflow_dispatch:

 env:
-  RENOVATE_VERSION: "42.19.10"
+  RENOVATE_VERSION: "42.84.2"

 jobs:
  renovate:
@@ -4,18 +4,22 @@

 | Service | Image | Description |
 | --- | --- | --- |
-| adguard | adguard/adguardhome:v0.107.69 |  |
-| beszel-agent | henrygd/beszel-agent:0.16.1 |  |
-| castsponsorskip | ghcr.io/gabe565/castsponsorskip:0.8.2 |  |
+| adguard | adguard/adguardhome:v0.107.77 |  |
+| beszel-agent | henrygd/beszel-agent:0.18.7 |  |
+| castsponsorskip | ghcr.io/gabe565/castsponsorskip:0.8.3 |  |
 | docker-socket-proxy | ghcr.io/tecnativa/docker-socket-proxy:latest |  |
 | dockflare | alplat/dockflare:stable |  |
 | ha-fusion | ghcr.io/matt8707/ha-fusion:2024.10.1 |  |
 | homeassistant | ghcr.io/home-assistant/home-assistant:stable |  |
-| ollama | ollama/ollama:0.13.0 |  |
+| patchmon-server | ghcr.io/patchmon/patchmon-server:latest |  |
+| patchmon-pg-db | postgres:17-alpine |  |
+| patchmon-redis | redis:7-alpine |  |
+| patchmon-guacd | guacamole/guacd:1.6.0 |  |
 | portainer-agent | portainer/agent:latest |  |
-| renovate | renovate/renovate:42.26.11-full |  |
+| renovate | renovate/renovate:43.170.22-full |  |
 | renovate-valkey | docker.io/valkey/valkey:9-alpine |  |
 | signoz-logspout | pavanputhra/logspout-signoz:2025.07.19-887dfeb |  |
+| snapcast-server | docker.io/sweisgerber/snapcast:latest |  |
 | upsnap | ghcr.io/seriousm4x/upsnap:5 |  |
 | webhook | thecatlady/webhook:2.8.2 |  |

@@ -10,7 +10,7 @@ services:
    container_name: adguard
    environment:
      TZ: ${TZ}
-    image: adguard/adguardhome:v0.107.69@sha256:8a4107ec812023842ccab9e04600c5d39d3be6b15e907c34a36339c184c8fccf
+    image: adguard/adguardhome:v0.107.77@sha256:e6f2b8bcda06064ab055b44933a4f0e983c35558b9cdb8d2e7ab1efcee36d890
    network_mode: host
    privileged: true
    restart: unless-stopped
@@ -29,7 +29,7 @@ services:
      HUB_URL: http://192.168.1.254:22220
    expose:
      - 45876
-    image: henrygd/beszel-agent:0.16.1@sha256:dee59d68ac327a755aec7651dd31b9f9a6d7db3da6f093e16e8c36c1f71a18cd
+    image: henrygd/beszel-agent:0.18.7@sha256:8874e2c53f9de5e063a6a80d6b617e20fa593ac5dc4eb4c6ce1f912f510f38f8
    network_mode: host
    restart: unless-stopped
    volumes:
@@ -38,7 +38,7 @@ services:
      - /var/run/docker.sock:/var/run/docker.sock:ro
  castsponsorskip:
    container_name: castsponsorskip
-    image: ghcr.io/gabe565/castsponsorskip:0.8.2@sha256:fe3a1b45987168b9cbccc394496e42bed5d396cd4869aa70ea402c686e679403
+    image: ghcr.io/gabe565/castsponsorskip:0.8.3@sha256:f556d274aab94c3140058e9f192396bc75e04d8e075769223c1edfc8c4f4daa4
    environment:
      TZ: ${TZ}
      # CSS_PAUSED_INTERVAL:
@@ -72,7 +72,7 @@ services:
      TASKS: 1
      VOLUMES: 1
      LOG_LEVEL: debug
-    image: ghcr.io/tecnativa/docker-socket-proxy:latest@sha256:3400c429c5f9e1b21d62130fb93b16e2e772d4fb7695bd52fc2b743800b9fe9e
+    image: ghcr.io/tecnativa/docker-socket-proxy:latest@sha256:1f3a6f303320723d199d2316a3e82b2e2685d86c275d5e3deeaf182573b47476
    ports:
      - 2375:2375
    privileged: true
@@ -101,16 +101,17 @@ services:
      TUNNEL_NAME: dockflared-tunnel
      TZ: ${TZ}
    healthcheck:
-      test:
-        [
+      test: [
          "CMD-SHELL",
-          "wget -qO- --server-response http://localhost:5000/ping 2>&1 | awk '/^  HTTP/{code=$2} /^[^{]/{next} {print; fflush()} END{exit (code>=400 || code==0)}' >/dev/null",
+          "wget -qO- --server-response http://localhost:5000/ping 2>&1 | awk
+          '/^  HTTP/{code=$2} /^[^{]/{next} {print; fflush()} END{exit
+          (code>=400 || code==0)}' >/dev/null",
        ]
      interval: 1m30s
      timeout: 30s
      retries: 5
      start_period: 30s
-    image: alplat/dockflare:stable@sha256:d5d77c1caeb3a82467499371dd5e7c9ab7c2c03c527d4f1465062b755aa7c8ca # Or :unstable for the latest features
+    image: alplat/dockflare:stable@sha256:ff2807c696b0752767716825e7b3d9f7d4f353e7ea8a323dc2b7cc174ad27ef7 # Or :unstable for the latest features
    # labels:
    #   ## EXAMPLE CF TUNNEL LABELS ###
    #   Enable DockFlare management for this container
@@ -159,7 +160,7 @@ services:
      - /dev/ttyS0:/dev/ttyS0
    environment:
      DISABLE_JEMALLOC: true
-    image: ghcr.io/home-assistant/home-assistant:stable@sha256:f971850a6ec1fb5c5fd4e1748058e9e1f589aaf0da933b8d88bb5dee03f5b5e8
+    image: ghcr.io/home-assistant/home-assistant:stable@sha256:f73512ba4fe06bb4d57636fe3578d0820cdec46f81e8f837ab59e451662ff3cb
    labels:
      com.centurylinklabs.watchtower.monitor-only: true
    network_mode: host
@@ -169,9 +170,103 @@ services:
      - ${RIKKU_DOCKER_DIR}/homeassistant:/config
      - /etc/localtime:/etc/localtime:ro
      - /run/dbus:/run/dbus:ro
+  patchmon-server:
+    container_name: patchmon-server
+    depends_on:
+      patchmon-pg-db:
+        condition: service_healthy
+      patchmon-redis:
+        condition: service_healthy
+      patchmon-guacd:
+        condition: service_healthy
+    environment:
+      CORS_ORIGIN: "*"
+      JWT_SECRET: ${PATCHMON_JWT_SECRET}
+      POSTGRES_HOST: patchmon-pg-db
+      DATABASE_URL: postgresql://patchmon:${PATCHMON_PG_PASSWORD}@patchmon-pg-db:5432/patchmon
+      ENABLE_LOGGING: true
+      GUACD_ADDRESS: patchmon-guacd:4822
+      LOG_LEVEL: info
+      REDIS_HOST: patchmon-redis
+      SESSION_SECRET: ${PATCHMON_SESSION_SECRET}
+      AI_ENCRYPTION_KEY: ${PATCHMON_AI_ENCRYPTION_KEY}
+      REDIS_PORT: 6379
+      REDIS_PASSWORD: ${PATCHMON_REDIS_PASSWORD}
+      REDIS_DB: 0
+      TRUST_PROXY: true
+      TZ: ${TZ}
+    image: ghcr.io/patchmon/patchmon-server:latest@sha256:eaa1bcce290c7003cff01a96cfc893a64cb144e582e9b797875e6381f56b297a
+    ports:
+      - 3000:3000
+    restart: unless-stopped
+  patchmon-pg-db:
+    container_name: patchmon-pg-db
+    image: postgres:17-alpine@sha256:67f624a4ad70edba8d65c82341124fab7054b277b4f7dea4b04be6f939ce2314
+    restart: unless-stopped
+    environment:
+      POSTGRES_PASSWORD: ${PATCHMON_PG_PASSWORD}
+      POSTGRES_USER: patchmon
+      POSTGRES_DB: patchmon
+    expose:
+      - 5432
+    volumes:
+      - patchmon-pg-data:/var/lib/postgresql/data
+    healthcheck:
+      test: ["CMD-SHELL", "pg_isready -U patchmon -d patchmon"]
+      interval: 3s
+      timeout: 5s
+      retries: 7
+  patchmon-redis:
+    container_name: patchmon-redis
+    image: redis:7-alpine@sha256:6ab0b6e7381779332f97b8ca76193e45b0756f38d4c0dcda72dbb3c32061ab99
+    restart: unless-stopped
+    environment:
+      TZ: ${TZ}
+      REDIS_PORT: 6379
+      REDIS_PASSWORD: ${PATCHMON_REDIS_PASSWORD}
+      REDIS_DB: 0
+    expose:
+      - 6379
+    command: redis-server --requirepass ${PATCHMON_REDIS_PASSWORD}
+    volumes:
+      - patchmon-redis-data:/data
+    healthcheck:
+      test:
+        [
+          "CMD",
+          "redis-cli",
+          "--no-auth-warning",
+          "-a",
+          "${PATCHMON_REDIS_PASSWORD}",
+          "ping",
+        ]
+      interval: 3s
+      timeout: 5s
+      retries: 7
+  patchmon-guacd:
+    container_name: patchmon-guacd
+    image: guacamole/guacd:1.6.0@sha256:8974eaa9ba32f713daf311e7cc8cd7e4cdfba1edea39eed75524e78ef4b08f4f
+    expose:
+      - 4822
+    restart: unless-stopped
+    read_only: true
+    tmpfs:
+      - /tmp:size=64m
+    security_opt:
+      - no-new-privileges:true
+    cap_drop:
+      - ALL
+    mem_limit: 512m
+    cpus: "1.0"
+    healthcheck:
+      test: ["CMD-SHELL", "nc -z localhost 4822 || exit 1"]
+      interval: 10s
+      timeout: 5s
+      retries: 3
+      start_period: 10s
  portainer-agent:
    container_name: portainer_agent
-    image: portainer/agent:latest@sha256:d2e5f753e8c668f7a7916621e64d6535f212b0f6ade5389a6fcc1f6830405ccf
+    image: portainer/agent:latest@sha256:e95f767f2caa2bcccaaa130ea73a43b16b880c6c8a841b20a58abf56a8eac63c
    volumes:
      - /:/host
      - /var/lib/docker/volumes:/var/lib/docker/volumes
@@ -219,7 +314,7 @@ services:
      GHCR_USER: ${RENOVATE__GHCR_USER}
      GITEA_BOT_PASS: ${RENOVATE__GITEA_BOT_PASS}
      GITEA_BOT_USER: ${RENOVATE__GITEA_BOT_USER}
-    image: renovate/renovate:42.26.11-full@sha256:3392bc4fe6657f946303b6edae20e6d711d734491f9c28650db6c34e0af672eb
+    image: renovate/renovate:43.170.22-full@sha256:934f64671c3f6535f5cce940b921a06aaaf47a347ce7de82b01b4028b223dcda
    restart: unless-stopped
    volumes:
      - ${RIKKU_DOCKER_DIR}/renovate/config.js:/etc/renovate/config.js
@@ -227,7 +322,7 @@ services:
    container_name: renovate-valkey
    healthcheck:
      test: redis-cli ping || exit 1
-    image: docker.io/valkey/valkey:9-alpine@sha256:b4ee67d73e00393e712accc72cfd7003b87d0fcd63f0eba798b23251bfc9c394
+    image: docker.io/valkey/valkey:9-alpine@sha256:a35428eba9043cc0b79dbe54100f0c92784f2de00ad09b01182bfb1c5c83d1bd
    environment:
      ALLOW_EMPTY_PASSWORD: yes
      VALKEY_DATA_DIR: /data/valkey
@@ -247,6 +342,23 @@ services:
    restart: unless-stopped
    volumes:
      - /var/run/docker.sock:/var/run/docker.sock
+  snapcast-server:
+    image: docker.io/sweisgerber/snapcast:latest@sha256:8859aaf7949781d47787fa048a3c85c7b3ea97aad4270d6f4ae2ff8b341db22c
+    hostname: snapcast-server
+    container_name: snapcast-server
+    environment:
+      TZ: ${TZ}
+    restart: "unless-stopped"
+    ports:
+      - 1704:1704
+      - 1705:1705
+      - 1780:1780
+      - 4953:4953
+      # devices:
+      # - /dev/snd:/dev/snd # optional, only if you want to use snapclient
+    volumes:
+      - ${RIKKU_DOCKER_DIR}/snapcast/config/:/config/
+      - ${RIKKU_DOCKER_DIR}/snapcast/data/:/data/
  upsnap:
    container_name: upsnap
    dns:
@@ -266,7 +378,7 @@ services:
    healthcheck:
      test: curl -fs "http://localhost:5000/api/health" || exit 1
      interval: 10s
-    image: ghcr.io/seriousm4x/upsnap:5@sha256:cbeafcff280d9db36aba467abc2b6110cd8de1e83e7a9d2d6a8e864511ba36e1 # images are also available on docker hub: seriousm4x/upsnap:5
+    image: ghcr.io/seriousm4x/upsnap:5@sha256:92ac19e946e2a4fffbd5049ff230485cbceacd002696a9ca8d4f5449f27d7c5d # images are also available on docker hub: seriousm4x/upsnap:5
    network_mode: host
    privileged: true
    restart: unless-stopped
@@ -285,5 +397,9 @@ services:
 volumes:
  dockflare_data:
    name: dockflare_data
+  patchmon-pg-data:
+    name: patchmon-pg-data
+  patchmon-redis-data:
+    name: patchmon-redis-data
  renovate-valkey-data:
    name: renovate-valkey-data