🔧 Renovate: Update (digest) postgres:15-alpine Docker digest to 1d1095b

Reviewed-on: #1554

.gitea/workflows/check-renovate.yml.hold

@@ -1,20 +0,0 @@
-name: Check Renovate Updates
-
-on:
-  pull_request:
-    branches:
-      - main
-    types: [opened, synchronize, reopened]
-    paths:
-      - 'docker-compose.yml'
-
-jobs:
-  validate:
-    runs-on: ubuntu-latest
-    if: ${{ contains(toLower(github.event.pull_request.user.login), 'renovate') }}
-    steps:
-      - name: Checkout code
-        uses: actions/checkout@v4
-
-      - name: Validate docker-compose.yml
-        run: docker compose config

.gitea/workflows/compose-services-readme.yml

@@ -0,0 +1,35 @@
+name: List of Services README Generation
+on:
+  schedule:
+    - cron: 30 */2 * * *
+  workflow_dispatch:
+jobs:
+  readme-services:
+   name: Generate Services List
+   runs-on: ubuntu-latest
+   steps:
+    - name: Checkout
+      uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
+      with:
+        ref: 'main'
+    - name: Install yq
+      uses: dcarbone/install-yq-action@4075b4dca348d74bd83f2bf82d30f25d7c54539b # v1.3.1
+    - name: Generate service list
+      run: |
+        yq 'explode(.) | .services | to_entries | map({"service": .key, "image": (.value.image | sub("@sha256:.*$"; "")), "description": (.value.labels."homepage.description" // "")})' docker-compose.yml > services.yml
+    - name: Generate Markdown Table
+      uses: gazab/create-markdown-table@6686233d7008e8d8b9d4bbdbfd1fb1ae510019f0 # v1.0.7
+      id: service-table
+      with:
+        file: ./services.yml
+    - name: Regenerate README
+      run: |
+        echo "# List of Services" > README.md
+        echo -e "\n\n" >> README.md
+        echo "${{ steps.service-table.outputs.table }}" >> README.md
+    - name: Add/Commit README.md
+      id: commit-readme
+      uses: EndBug/add-and-commit@a94899bca583c204427a224a7af87c02f9b325d5 # v9.1.4
+      with:
+        message: "chore: Update README"
+        add: "README.md"

.gitea/workflows/pr-cloudflare-docker-deploy.yml

@@ -4,15 +4,15 @@ on:
   workflow_dispatch:
   push:
     branches-ignore:
-      - 'main'
-      - 'renovate/**'
+      - "main"
+      - "renovate/**"
     paths:
-      - '**/docker-compose.yml'
+      - "**/docker-compose.yml"
 
 env:
-  FLARECTL_VERSION: '0.115.0'
-  HC_VAULT_VERSION: '1.18.0'
-  TEA_VERSION: '0.10.1'
+  FLARECTL_VERSION: "0.116.0"
+  HC_VAULT_VERSION: "1.21.2"
+  TEA_VERSION: "0.10.1"
 
 jobs:
   check-and-create-pr:
@@ -20,77 +20,33 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout Code
-        uses: actions/checkout@v4
+        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
         with:
           fetch-depth: 1
 
-      - name: Cache tea CLI
-        id: cache-tea
-        uses: actions/cache@v4
+      - name: Gotify Notification
+        uses: eikendev/gotify-action@ca0339b85ee8db9fda9c0718aaa7f95e17b3c617 # 0.0.4
         with:
-          path: /opt/hostedtoolcache/tea/${{ env.TEA_VERSION }}/x64
-          key: tea-${{ runner.os }}-${{ env.TEA_VERSION }}
+          gotify_api_base: "${{ secrets.RUNNER_GOTIFY_URL }}"
+          gotify_app_token: "${{ secrets.RUNNER_GOTIFY_TOKEN }}"
+          notification_title: "GITEA: PR Check @ Rinoa"
+          notification_message: "Checking for existing PR... 🔍"
 
-      - name: Install tea
-        uses: supplypike/setup-bin@v4
+      - name: PR Check/Creation
+        uses: https://git.trez.wtf/Trez/gitea-auto-pr@main
         with:
-          uri: https://gitea.com/gitea/tea/releases/download/v${{ env.TEA_VERSION }}/tea-${{ env.TEA_VERSION }}-linux-amd64
-          name: tea
-          version: ${{ env.TEA_VERSION }}
+          url: ${{ secrets.TREZ_GITEA_URL }}
+          token: ${{ secrets.BOT_GITEA_TOKEN }}
+          pr-label: docker-compose,manual
+          assignee: ${{ github.actor }}
 
       - name: Gotify Notification
-        uses: eikendev/gotify-action@master
+        uses: eikendev/gotify-action@ca0339b85ee8db9fda9c0718aaa7f95e17b3c617 # 0.0.4
         with:
-          gotify_api_base: '${{ secrets.RINOA_GOTIFY_URL }}'
-          gotify_app_token: '${{ secrets.RINOA_RUNNER_GOTIFY_TOKEN }}'
-          notification_title: 'GITEA: PR Check'
-          notification_message: 'Checking for existing PR... 🔍'
-
-      - name: Check if open PR exists
-        id: check-opened-pr-step
-        continue-on-error: true
-        run: |
-          tea login add \
-            --name gitea-rinoa \
-            --url "${{ secrets.RINOA_GITEA_URL }}" \
-            --user gitea-sonarqube-bot \
-            --password "${{ secrets.BOT_GITEA_PASSWORD }}" \
-            --token ${{ secrets.BOT_GITEA_TOKEN }}
-
-          pr_exists=$(tea pr list \
-            --repo ${{ github.repository }} \
-            --state open \
-            --fields index,title,head \
-            | egrep '\[DOCKER\].*${{ github.ref_name }}' | tail -1 | wc -l)
-
-          echo "exists=$pr_exists" >> $GITHUB_OUTPUT
-
-      - name: Create PR
-        if: ${{ steps.check-opened-pr-step.outputs.exists == '0' }}
-        run: |
-          tea login default gitea-rinoa
-
-          pr_index_old=$(tea pr ls \
-            --repo ${{ github.repository }} \
-            --state all --fields index,title,head \
-            --output csv | sed -e 's|"||g' | \
-            egrep '^[0-9]' | head -1 | awk -F"," '{print $1}')
-
-          pr_index_new=$(expr ${pr_index_old} + 1)
-
-          tea pr c -r ${{ github.repository }} \
-            -t "[DOCKER] Automated PR for ${{ github.ref_name }} - #${pr_index_new}" \
-            -d "Automatically created PR for branch: ${{ github.ref_name }}" \
-            -a ${{ github.actor }} \
-            -L "Docker Compose"
-
-      - name: Gotify Notification
-        uses: eikendev/gotify-action@master
-        with:
-          gotify_api_base: '${{ secrets.RINOA_GOTIFY_URL }}'
-          gotify_app_token: '${{ secrets.RINOA_RUNNER_GOTIFY_TOKEN }}'
-          notification_title: 'GITEA: PR Check'
-          notification_message: 'PR Created 🎟️'
+          gotify_api_base: "${{ secrets.RUNNER_GOTIFY_URL }}"
+          gotify_app_token: "${{ secrets.RUNNER_GOTIFY_TOKEN }}"
+          notification_title: "GITEA: PR Check @ Rinoa"
+          notification_message: "PR Check done 🎟️"
 
   generate-service-list:
     name: Generate list of added/modified/deleted services
@@ -99,21 +55,20 @@ jobs:
     outputs:
       svc_deploy_list: ${{ steps.detect_services.outputs.docker_svc_list }}
     steps:
-
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
 
       - name: Fetch base branch
         run: |
           git fetch origin ${{ github.event.pull_request.base.ref }}
 
       - name: Gotify Notification
-        uses: eikendev/gotify-action@master
+        uses: eikendev/gotify-action@ca0339b85ee8db9fda9c0718aaa7f95e17b3c617 # 0.0.4
         with:
-          gotify_api_base: '${{ secrets.RINOA_GOTIFY_URL }}'
-          gotify_app_token: '${{ secrets.RINOA_RUNNER_GOTIFY_TOKEN }}'
-          notification_title: 'GITEA: Services TBD'
-          notification_message: 'Generating list of services to deploy...'
+          gotify_api_base: "${{ secrets.RUNNER_GOTIFY_URL }}"
+          gotify_app_token: "${{ secrets.RUNNER_GOTIFY_TOKEN }}"
+          notification_title: "GITEA: Services TBD"
+          notification_message: "Generating list of services to deploy..."
 
       - name: Save both versions of docker-compose.yml
         run: |
@@ -123,18 +78,27 @@ jobs:
       - name: Detect added, deleted, and modified services
         id: detect_services
         run: |
+          set +e  # prevent failure on non-zero exit codes
+
           echo "Getting services from main and ${{ github.ref_name }}"
           yq '.services | keys | .[]' docker-compose-main.yml | sort > services_main.txt
           yq '.services | keys | .[]' docker-compose-head.yml | sort > services_head.txt
 
-          echo "Creating list of modified services..."
+          echo "Creating list of service changes..."
           touch service_changes.txt
 
-          comm -13 services_main.txt services_head.txt | while read service; do
-            echo "$service: added" >> service_changes.txt
+          # Detect newly added services
+          comm -13 services_main.txt services_head.txt 2>/dev/null | while read service; do
+            [ -n "$service" ] && echo "$service: added" >> service_changes.txt
           done
 
-          comm -12 services_main.txt services_head.txt | while read service; do
+          # Detect removed services
+          comm -23 services_main.txt services_head.txt 2>/dev/null | while read service; do
+            [ -n "$service" ] && echo "$service: removed" >> service_changes.txt
+          done
+
+          # Detect modified services
+          comm -12 services_main.txt services_head.txt 2>/dev/null | while read service; do
             yq ".services[\"$service\"]" docker-compose-main.yml > tmp_main.yml
             yq ".services[\"$service\"]" docker-compose-head.yml > tmp_head.yml
             if ! diff -q tmp_main.yml tmp_head.yml > /dev/null; then
@@ -143,79 +107,139 @@ jobs:
           done
 
           echo "Detected service changes:"
-          cat service_changes.txt
+          cat service_changes.txt || echo "None"
 
-          mod_svcs=$(cut -d':' -f1 service_changes.txt | sort | uniq)
-          echo "docker_svc_list<<EOF" >> "$GITHUB_OUTPUT"
-          echo "$mod_svcs" >> "$GITHUB_OUTPUT"
+          # Separate categories safely
+          added_svcs=$(grep -E ': added' service_changes.txt 2>/dev/null | cut -d':' -f1 | sort | uniq)
+          modified_svcs=$(grep -E ': modified' service_changes.txt 2>/dev/null | cut -d':' -f1 | sort | uniq)
+          removed_svcs=$(grep -E ': removed' service_changes.txt 2>/dev/null | cut -d':' -f1 | sort | uniq)
+
+          # Gather list of modified/added services
+          mod_svcs=$( (echo "$added_svcs"; echo "$modified_svcs") | tr ' ' '\n' | sort -u | grep -v '^$' || true)
+
+          if [ -z "$mod_svcs" ]; then
+            echo "No modified or added services detected."
+            echo "docker_svc_list<<EOF" >> "$GITHUB_OUTPUT"
+            echo "" >> "$GITHUB_OUTPUT"
+            echo "EOF" >> "$GITHUB_OUTPUT"
+          else
+            echo "Modified/added services:"
+            echo "$mod_svcs"
+
+            # Include direct dependencies (only if head file exists)
+            if [ -f docker-compose-head.yml ]; then
+              echo "Resolving direct dependencies..."
+              deps_list=""
+              for svc in $mod_svcs; do
+                deps=$(yq -r ".services[\"$svc\"].depends_on | keys | .[]" docker-compose-head.yml 2>/dev/null || true)
+                if [ -n "$deps" ]; then
+                  echo "$svc depends on:"
+                  echo "$deps"
+                  deps_list="$deps_list $deps"
+                fi
+              done
+
+              all_svcs=$( (echo "$mod_svcs"; echo "$deps_list") | tr ' ' '\n' | sort -u)
+            else
+              all_svcs="$mod_svcs"
+            fi
+
+            echo "Final service list (including direct dependencies):"
+            echo "$all_svcs"
+
+            echo "docker_svc_list<<EOF" >> "$GITHUB_OUTPUT"
+            echo "$all_svcs" >> "$GITHUB_OUTPUT"
+            echo "EOF" >> "$GITHUB_OUTPUT"
+          fi
+
+          # Output removed services separately
+          echo "Removed services:"
+          echo "${removed_svcs:-None}"
+          echo "removed_svc_list<<EOF" >> "$GITHUB_OUTPUT"
+          echo "$removed_svcs" >> "$GITHUB_OUTPUT"
           echo "EOF" >> "$GITHUB_OUTPUT"
 
-      - name: List of Services for (Re)Deployment
-        run: |
-          echo -e "${{ steps.detect_services.outputs.docker_svc_list }}"
+          # Always exit cleanly
+          exit 0
 
   docker-compose-dry-run:
     name: Docker Compose Dry Run
     needs: [generate-service-list]
     runs-on: ubuntu-latest
     env:
-      VAULT_ADDR: ${{ secrets.RINOA_VAULT_ADDR }}
+      VAULT_ADDR: ${{ secrets.TREZ_VAULT_ADDR }}
       VAULT_TOKEN: ${{ secrets.VAULT_GITEA_TOKEN }}
       VAULT_NAMESPACE: ""
       RINOA_REGISTRY_PASSWORD: ${{ secrets.BOT_GITEA_PASSWORD }}
       DOCKER_SVC_LIST: ${{ needs.generate-service-list.outputs.svc_deploy_list }}
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
 
-      - name: Login to Gitea Container Registry
-        run: |
-          docker login -u gitea-sonarqube-bot -p ${RINOA_REGISTRY_PASSWORD} git.trez.wtf
-
-      - name: Cache Vault install
-        id: cache-vault
-        uses: actions/cache@v4
+      - name: Login to Docker Hub
+        uses: docker/login-action@5e57cd118135c172c3672efd75eb46360885c0ef # v3.6.0
         with:
-          path: /opt/hostedtoolcache/vault/${{ env.HC_VAULT_VERSION }}/x64
-          key: vault-${{ runner.os }}-${{ env.HC_VAULT_VERSION }}
+          username: ${{ secrets.DOCKERHUB_USER }}
+          password: ${{ secrets.DOCKERHUB_PASSWORD }}
 
-      - name: Install Vault (only if not cached)
-        if: steps.cache-vault.outputs.cache-hit != 'true'
-        uses: cpanato/vault-installer@main
+      - name: Login to GitHub Container Registry
+        uses: docker/login-action@5e57cd118135c172c3672efd75eb46360885c0ef # v3.6.0
         with:
-          version: ${{ env.HC_VAULT_VERSION }}
+          registry: ghcr.io
+          username: ${{ secrets.GHCR_USER }}
+          password: ${{ secrets.GHCR_LOGIN_TOKEN }}
+
+      - name: Login to Private Gitea Registry
+        uses: docker/login-action@5e57cd118135c172c3672efd75eb46360885c0ef # v3.6.0
+        with:
+          registry: git.trez.wtf
+          username: ${{ secrets.BOT_GITEA_USER }}
+          password: ${{ secrets.BOT_GITEA_PASSWORD }}
 
       - name: Gotify Notification
-        uses: eikendev/gotify-action@master
+        uses: eikendev/gotify-action@ca0339b85ee8db9fda9c0718aaa7f95e17b3c617 # 0.0.4
         with:
-          gotify_api_base: '${{ secrets.RINOA_GOTIFY_URL }}'
-          gotify_app_token: '${{ secrets.RINOA_RUNNER_GOTIFY_TOKEN }}'
-          notification_title: 'GITEA: Docker Compose Dry Run @ Rinoa'
-          notification_message: 'Starting Docker Compose dry run...'
+          gotify_api_base: "${{ secrets.RUNNER_GOTIFY_URL }}"
+          gotify_app_token: "${{ secrets.RUNNER_GOTIFY_TOKEN }}"
+          notification_title: "GITEA: Docker Compose Dry Run @ Rinoa"
+          notification_message: "Starting Docker Compose dry run..."
 
-      - name: Generate .env file for Docker Compose
-        run: |
-          vault kv get -format=json rinoa-docker/env | jq -r '.data.data' | jq -r 'keys[] as $k | "\($k)='\''\(.[$k])'\''"' > .env
-          echo ${DOCKER_SVC_LIST}
+      - name: Generate .env from Hashicorp Vault
+        uses: https://git.trez.wtf/Trez/hc-vault-env@main
+        with:
+          HC_VAULT_VERSION: ${{ env.HC_VAULT_VERSION }}
+          HC_VAULT_ADDR: ${{ secrets.TREZ_VAULT_ADDR }}
+          HC_VAULT_AUTH: token
+          HC_VAULT_TOKEN: ${{ secrets.VAULT_GITEA_TOKEN }}
+          HC_VAULT_SECRETS_PATH: rinoa-docker/env
+
+      - name: Pre-pull/build service images in parallel
+        continue-on-error: true
+        uses: https://git.trez.wtf/Trez/docker-select-image-pull@main
+        env:
+          DOCKER_HOST: tcp://dockerproxy:2375
+        with:
+          services: ${{ env.DOCKER_SVC_LIST }}
+          compose_profile: "rinoa-apps"
 
       - name: Docker Compose Dry Run
-        uses: hoverkraft-tech/compose-action@v2.2.0
+        uses: hoverkraft-tech/compose-action@05da55b2bb8a5a759d1c4732095044bd9018c050 # v2.4.3
         env:
           DOCKER_HOST: tcp://dockerproxy:2375
         with:
           services: |
             ${{ needs.generate-service-list.outputs.svc_deploy_list }}
           up-flags: -d --remove-orphans --dry-run
-          down-flags: --dry-run
           compose-flags: --dry-run --profile rinoa-apps
+          services-log-level: debug
 
       - name: Gotify Notification
-        uses: eikendev/gotify-action@master
+        uses: eikendev/gotify-action@ca0339b85ee8db9fda9c0718aaa7f95e17b3c617 # 0.0.4
         with:
-          gotify_api_base: '${{ secrets.RINOA_GOTIFY_URL }}'
-          gotify_app_token: '${{ secrets.RINOA_RUNNER_GOTIFY_TOKEN }}'
-          notification_title: 'GITEA: Docker Compose Dry Run @ Rinoa'
-          notification_message: 'Docker Compose dry run completed successfully.'
+          gotify_api_base: "${{ secrets.RUNNER_GOTIFY_URL }}"
+          gotify_app_token: "${{ secrets.RUNNER_GOTIFY_TOKEN }}"
+          notification_title: "GITEA: Docker Compose Dry Run @ Rinoa"
+          notification_message: "Docker Compose dry run completed successfully."
 
   cloudflare-dns-setup:
     name: Cloudflare DNS Setup
@@ -223,40 +247,25 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
         with:
           fetch-depth: 1
 
-      - name: Cache flarectl CLI
-        uses: actions/cache@v4
-        with:
-          path: ~/.flarectl
-          key: flarectl-${{ runner.os }}-${{ env.FLARECTL_VERSION }}-${{ hashFiles('workflow-config.yml') }}
-
       - name: Install flarectl
-        uses: supplypike/setup-bin@v4
+        uses: supplypike/setup-bin@8e3f88b4f143d9b5c3497f0fc12d45c83c123787 # v4.0.1
         with:
           uri: https://github.com/cloudflare/cloudflare-go/releases/download/v${{ env.FLARECTL_VERSION }}/flarectl_${{ env.FLARECTL_VERSION }}_linux_amd64.tar.gz
           name: flarectl
           version: ${{ env.FLARECTL_VERSION }}
 
-      - name: Cache Subdomain Files
-        uses: actions/cache@v4
-        with:
-          path: |
-            compose_subdomains.txt
-            cloudflare_subdomains.txt
-          key: ${{ runner.os }}-subdomains-${{ hashFiles('docker-compose.yml') }}
-
       - name: Grab Subdomains from Docker Compose & Cloudflare
         id: grab-subdomains
         env:
           CF_API_TOKEN: ${{ secrets.CF_API_TOKEN }}
           CF_API_EMAIL: ${{ secrets.CF_API_EMAIL }}
         run: |
-          yq '.services[].labels.swag_url' docker-compose.yml | \
+          yq -r '.services[].labels.swag_url' docker-compose.yml | \
             egrep -v 'null' | \
-            sed -e 's|"||g' | \
             awk -F'.' '{print $1}' | \
             sort > compose_subdomains.txt
 
@@ -264,20 +273,20 @@ jobs:
             --zone "trez.wtf" \
             --type=CNAME \
             --content "trez.wtf" \
-            | jq '.[].Name' | sed -e 's|"||g' | awk -F"." '{print $1}' | \
+            | jq -r '.[].Name' | awk -F"." '{print $1}' | \
             sort > cloudflare_subdomains.txt
 
       - name: Gotify Notification
-        uses: eikendev/gotify-action@master
+        uses: eikendev/gotify-action@ca0339b85ee8db9fda9c0718aaa7f95e17b3c617 # 0.0.4
         with:
-          gotify_api_base: '${{ secrets.RINOA_GOTIFY_URL }}'
-          gotify_app_token: '${{ secrets.RINOA_RUNNER_GOTIFY_TOKEN }}'
-          notification_title: 'GITEA: Cloudflare Setup @ Rinoa'
-          notification_message: 'Starting Cloudflare DNS setup...'
+          gotify_api_base: "${{ secrets.RUNNER_GOTIFY_URL }}"
+          gotify_app_token: "${{ secrets.RUNNER_GOTIFY_TOKEN }}"
+          notification_title: "GITEA: Cloudflare Setup @ Rinoa"
+          notification_message: "Starting Cloudflare DNS setup..."
 
       - name: Compare Subdomains
         id: compare-subdomains
-        uses: LouisBrunner/diff-action@v2.2.0
+        uses: LouisBrunner/diff-action@9ea7b75986aa27143ad4928974c98a5a1bd92170 # v2.2.0
         with:
           old: compose_subdomains.txt
           new: cloudflare_subdomains.txt
@@ -298,81 +307,24 @@ jobs:
           done
 
       - name: Gotify Notification
-        uses: eikendev/gotify-action@master
+        uses: eikendev/gotify-action@ca0339b85ee8db9fda9c0718aaa7f95e17b3c617 # 0.0.4
         with:
-          gotify_api_base: '${{ secrets.RINOA_GOTIFY_URL }}'
-          gotify_app_token: '${{ secrets.RINOA_RUNNER_GOTIFY_TOKEN }}'
-          notification_title: 'GITEA: Cloudflare Setup @ Rinoa'
-          notification_message: 'Cloudflare DNS setup completed successfully.'
-
-  regenerate-readme-modified-services:
-    name: Update README & Generate List of Modified Services
-    runs-on: ubuntu-latest
-    needs: [cloudflare-dns-setup]
-    steps:
-      - name: Checkout
-        uses: actions/checkout@v4
-
-      - name: Install yq
-        uses: dcarbone/install-yq-action@v1
-
-      - name: Gotify Notification
-        uses: eikendev/gotify-action@master
-        with:
-          gotify_api_base: '${{ secrets.RINOA_GOTIFY_URL }}'
-          gotify_app_token: '${{ secrets.RINOA_RUNNER_GOTIFY_TOKEN }}'
-          notification_title: 'GITEA: README Update'
-          notification_message: 'Updating README...'
-
-      - name: Generate service list
-        run: |
-          yq '.services | to_entries | map({"service": .key, "image": .value.image, "description": (.value.labels."homepage.description" // "")})' docker-compose.yml > services.yml
-
-      - name: Generate Markdown Table
-        uses: gazab/create-markdown-table@v1
-        id: service-table
-        with:
-          file: ./services.yml
-
-      - name: Regenerate README
-        run: |
-          echo "# List of Services" > README.md
-          echo -e "\n\n" >> README.md
-          echo "${{ steps.service-table.outputs.table }}" >> README.md
-
-      - name: Add/Commit README.md
-        id: commit-readme
-        uses: EndBug/add-and-commit@v9
-        with:
-          message: "chore: Update README"
-          add: "README.md"
-
-      - name: Gotify Notification
-        uses: eikendev/gotify-action@master
-        with:
-          gotify_api_base: '${{ secrets.RINOA_GOTIFY_URL }}'
-          gotify_app_token: '${{ secrets.RINOA_RUNNER_GOTIFY_TOKEN }}'
-          notification_title: 'GITEA: README Update'
-          notification_message: 'README updated'
+          gotify_api_base: "${{ secrets.RUNNER_GOTIFY_URL }}"
+          gotify_app_token: "${{ secrets.RUNNER_GOTIFY_TOKEN }}"
+          notification_title: "GITEA: Cloudflare Setup @ Rinoa"
+          notification_message: "Cloudflare DNS setup completed successfully."
 
   pr-merge:
     name: PR Merge
-    needs: [regenerate-readme-modified-services]
+    needs: [generate-service-list, docker-compose-dry-run]
     if: github.ref != 'refs/heads/main'
     runs-on: ubuntu-latest
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
-
-      - name: Cache tea CLI
-        id: cache-tea
-        uses: actions/cache@v4
-        with:
-          path: /opt/hostedtoolcache/tea/${{ env.TEA_VERSION }}/x64
-          key: tea-${{ runner.os }}-${{ env.TEA_VERSION }}
+        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
 
       - name: Install tea
-        uses: supplypike/setup-bin@v4
+        uses: supplypike/setup-bin@8e3f88b4f143d9b5c3497f0fc12d45c83c123787 # v4.0.1
         with:
           uri: https://gitea.com/gitea/tea/releases/download/v${{ env.TEA_VERSION }}/tea-${{ env.TEA_VERSION }}-linux-amd64
           name: tea
@@ -383,7 +335,7 @@ jobs:
         run: |
           tea login add \
             --name gitea-rinoa \
-            --url "${{ secrets.RINOA_GITEA_URL }}" \
+            --url "${{ secrets.TREZ_GITEA_URL }}" \
             --user gitea-sonarqube-bot \
             --password "${{ secrets.BOT_GITEA_PASSWORD }}" \
             --token ${{ secrets.BOT_GITEA_TOKEN }}
@@ -406,62 +358,76 @@ jobs:
           echo "pr_index=${pr_index}" >> $GITHUB_OUTPUT
 
       - name: Gotify Notification
-        uses: eikendev/gotify-action@master
+        uses: eikendev/gotify-action@ca0339b85ee8db9fda9c0718aaa7f95e17b3c617 # 0.0.4
         with:
-          gotify_api_base: '${{ secrets.RINOA_GOTIFY_URL }}'
-          gotify_app_token: '${{ secrets.RINOA_RUNNER_GOTIFY_TOKEN }}'
-          notification_title: 'GITEA: PR Merge Successful'
-          notification_message: 'PR #${{ steps.pr_merge.outputs.pr_index }} merged.'
+          gotify_api_base: "${{ secrets.RUNNER_GOTIFY_URL }}"
+          gotify_app_token: "${{ secrets.RUNNER_GOTIFY_TOKEN }}"
+          notification_title: "GITEA: PR Merge Successful"
+          notification_message: "PR #${{ steps.pr_merge.outputs.pr_index }} merged."
 
   docker-compose-deploy:
     name: Docker Compose Deployment
     runs-on: ubuntu-latest
     needs: [generate-service-list, docker-compose-dry-run, pr-merge]
     env:
-      VAULT_ADDR: ${{ secrets.RINOA_VAULT_ADDR }}
+      VAULT_ADDR: ${{ secrets.TREZ_VAULT_ADDR }}
       VAULT_TOKEN: ${{ secrets.VAULT_GITEA_TOKEN }}
       DOCKER_HOST: tcp://dockerproxy:2375
       RINOA_REGISTRY_PASSWORD: ${{ secrets.BOT_GITEA_PASSWORD }}
       DOCKER_SVC_LIST: ${{ needs.generate-service-list.outputs.svc_deploy_list }}
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
         with:
           ref: main
 
-      - name: Cache Vault install
-        id: cache-vault
-        uses: actions/cache@v4
+      - name: Login to Docker Hub
+        uses: docker/login-action@5e57cd118135c172c3672efd75eb46360885c0ef # v3.6.0
         with:
-          path: /opt/hostedtoolcache/vault/${{ env.HC_VAULT_VERSION }}/x64
-          key: vault-${{ runner.os }}-${{ env.HC_VAULT_VERSION }}
+          username: ${{ secrets.DOCKERHUB_USER }}
+          password: ${{ secrets.DOCKERHUB_PASSWORD }}
 
-      - name: Install Vault (only if not cached)
-        uses: cpanato/vault-installer@main
+      - name: Login to GitHub Container Registry
+        uses: docker/login-action@5e57cd118135c172c3672efd75eb46360885c0ef # v3.6.0
         with:
-          version: ${{ env.HC_VAULT_VERSION }}
+          registry: ghcr.io
+          username: ${{ secrets.GHCR_USER }}
+          password: ${{ secrets.GHCR_LOGIN_TOKEN }}
 
-      - name: Login to Gitea Container Registry
-        run: |
-          docker login -u gitea-sonarqube-bot \
-            -p ${RINOA_REGISTRY_PASSWORD} \
-            git.trez.wtf
+      - name: Login to Private Gitea Registry
+        uses: docker/login-action@5e57cd118135c172c3672efd75eb46360885c0ef # v3.6.0
+        with:
+          registry: git.trez.wtf
+          username: ${{ secrets.BOT_GITEA_USER }}
+          password: ${{ secrets.BOT_GITEA_PASSWORD }}
 
       - name: Gotify Notification
-        uses: eikendev/gotify-action@master
+        uses: eikendev/gotify-action@ca0339b85ee8db9fda9c0718aaa7f95e17b3c617 # 0.0.4
         with:
-          gotify_api_base: '${{ secrets.RINOA_GOTIFY_URL }}'
-          gotify_app_token: '${{ secrets.RINOA_RUNNER_GOTIFY_TOKEN }}'
-          notification_title: 'GITEA: Docker Compose Deployment @ Rinoa'
-          notification_message: 'Starting Docker Compose run...'
+          gotify_api_base: "${{ secrets.RUNNER_GOTIFY_URL }}"
+          gotify_app_token: "${{ secrets.RUNNER_GOTIFY_TOKEN }}"
+          notification_title: "GITEA: Docker Compose Deployment @ Rinoa"
+          notification_message: "Starting Docker Compose run..."
 
-      - name: Generate .env file for deployment
-        run: |
-           vault kv get -format=json rinoa-docker/env | jq -r '.data.data' | jq -r 'keys[] as $k | "\($k)='\''\(.[$k])'\''"' > .env
-           echo ${DOCKER_SVC_LIST}
+      - name: Generate .env from Hashicorp Vault
+        uses: https://git.trez.wtf/Trez/hc-vault-env@main
+        with:
+          HC_VAULT_VERSION: ${{ env.HC_VAULT_VERSION }}
+          HC_VAULT_ADDR: ${{ secrets.TREZ_VAULT_ADDR }}
+          HC_VAULT_AUTH: token
+          HC_VAULT_TOKEN: ${{ secrets.VAULT_GITEA_TOKEN }}
+          HC_VAULT_SECRETS_PATH: rinoa-docker/env
+
+      - name: Pre-pull/build service images in parallel
+        uses: https://git.trez.wtf/Trez/docker-select-image-pull@main
+        env:
+          DOCKER_HOST: tcp://dockerproxy:2375
+        with:
+          services: ${{ env.DOCKER_SVC_LIST }}
+          compose_profile: "rinoa-apps"
 
       - name: Docker Compose Deployment
-        uses: hoverkraft-tech/compose-action@v2.2.0
+        uses: hoverkraft-tech/compose-action@05da55b2bb8a5a759d1c4732095044bd9018c050 # v2.4.3
         env:
           DOCKER_HOST: tcp://dockerproxy:2375
         with:
@@ -470,9 +436,10 @@ jobs:
           up-flags: -d --remove-orphans
           down-flags: --dry-run
           compose-flags: --profile rinoa-apps
+          services-log-level: debug
 
       - name: Docker Compose Healthcheck
-        uses: jaracogmbh/docker-compose-health-check-action@v1.0.0
+        uses: jaracogmbh/docker-compose-health-check-action@973fbdccf7c8e396b652d3501984c8e530a9fa80 # v1.0.0
         with:
           max-retries: 30
           retry-interval: 10
@@ -481,9 +448,9 @@ jobs:
           skip-no-healthcheck: "true"
 
       - name: Gotify Notification
-        uses: eikendev/gotify-action@master
+        uses: eikendev/gotify-action@ca0339b85ee8db9fda9c0718aaa7f95e17b3c617 # 0.0.4
         with:
-          gotify_api_base: '${{ secrets.RINOA_GOTIFY_URL }}'
-          gotify_app_token: '${{ secrets.RINOA_RUNNER_GOTIFY_TOKEN }}'
-          notification_title: 'GITEA: Docker Compose Deployment @ Rinoa'
-          notification_message: 'Deployment completed successfully.'
+          gotify_api_base: "${{ secrets.RUNNER_GOTIFY_URL }}"
+          gotify_app_token: "${{ secrets.RUNNER_GOTIFY_TOKEN }}"
+          notification_title: "GITEA: Docker Compose Deployment @ Rinoa"
+          notification_message: "Deployment completed successfully."

.gitea/workflows/renovate-pr-deploy.yml

@@ -0,0 +1,172 @@
+name: Renovate Image Tag Deployment
+
+on:
+  workflow_dispatch:
+  pull_request:
+    types: [closed]
+    branches:
+      - main
+    paths:
+      - "**/docker-compose.yml"
+
+env:
+  HC_VAULT_VERSION: "1.21.2"
+  VAULT_ADDR: ${{ secrets.TREZ_VAULT_ADDR }}
+  VAULT_TOKEN: ${{ secrets.VAULT_GITEA_TOKEN }}
+
+jobs:
+  deploy:
+    name: Renovate PR Deployment
+    if: |
+      github.event.pull_request.merged == true &&
+      github.event.pull_request.user.login == 'renovate-bot'
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout full repository
+        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
+        with:
+          fetch-depth: 0 # required so we can access main^1
+
+      - name: Save docker-compose.yml before merge (old)
+        run: |
+          git fetch origin main
+          if git ls-tree -r origin/main^1 --name-only | grep -q '^docker-compose.yml$'; then
+            git show origin/main^1:docker-compose.yml > docker-compose-old.yml
+          else
+            echo "services: {}" > docker-compose-old.yml
+          fi
+
+      - name: Save docker-compose.yml after merge (new)
+        run: |
+          git show origin/main:docker-compose.yml > docker-compose-new.yml
+
+      - name: Detect services with image tag/digest changes
+        id: detect_services
+        run: |
+          set -euo pipefail
+
+          echo "Flattening docker-compose files..."
+          yq eval '... comments=""' docker-compose-old.yml > docker-compose-old-flat.yml
+          yq eval '... comments=""' docker-compose-new.yml > docker-compose-new-flat.yml
+
+          echo "Getting service names..."
+          yq eval '.services | keys | .[]' docker-compose-old-flat.yml | sort > services_old.txt
+          yq eval '.services | keys | .[]' docker-compose-new-flat.yml | sort > services_new.txt
+
+          echo "Checking for image changes..."
+          : > service_changes.txt
+
+          comm -12 services_old.txt services_new.txt | while read service; do
+            old_image=$(yq eval-all --yaml-fix-merge-anchor-to-spec=true ".services[\"$service\"].image // \"\"" docker-compose-old-flat.yml)
+            new_image=$(yq eval-all --yaml-fix-merge-anchor-to-spec=true ".services[\"$service\"].image // \"\"" docker-compose-new-flat.yml)
+
+            if [ "$old_image" != "$new_image" ]; then
+              echo "$service" >> service_changes.txt
+            fi
+          done
+
+          echo "Detected services with changed images:"
+          cat service_changes.txt || echo "None"
+
+          changed_svcs=$(sort -u service_changes.txt | xargs || true)
+          if [ -z "$changed_svcs" ]; then
+            echo "No image tag/digest changes detected."
+            echo "docker_svc_list<<EOF" >> "$GITHUB_OUTPUT"
+            echo "" >> "$GITHUB_OUTPUT"
+            echo "EOF" >> "$GITHUB_OUTPUT"
+            exit 0
+          fi
+
+          echo "Collecting direct dependencies..."
+          deps_list=""
+          for svc in $changed_svcs; do
+            deps=$(yq -r ".services[\"$svc\"].depends_on | keys | .[]" docker-compose-new-flat.yml 2>/dev/null || true)
+            if [ -n "$deps" ]; then
+              echo "$svc depends on:"
+              echo "$deps"
+              deps_list="$deps_list $deps"
+            fi
+          done
+
+          # Combine changed services and their dependencies, deduplicate
+          all_svcs=$( (echo "$changed_svcs"; echo "$deps_list") | tr ' ' '\n' | sort -u )
+
+          echo "Final service list (including direct dependencies):"
+          echo "$all_svcs"
+
+          # Prepare multiline output for GitHub Actions
+          echo "docker_svc_list<<EOF" >> "$GITHUB_OUTPUT"
+          echo "$all_svcs" >> "$GITHUB_OUTPUT"
+          echo "EOF" >> "$GITHUB_OUTPUT"
+
+      - name: Stop if no image changes
+        if: steps.detect_services.outputs.docker_svc_list == ''
+        run: |
+          echo "No image tag/digest changes detected. Exiting."
+          exit 1
+
+      - name: Login to Docker Hub
+        uses: docker/login-action@5e57cd118135c172c3672efd75eb46360885c0ef # v3.6.0
+        with:
+          username: ${{ secrets.DOCKERHUB_USER }}
+          password: ${{ secrets.DOCKERHUB_PASSWORD }}
+
+      - name: Login to GitHub Container Registry
+        uses: docker/login-action@5e57cd118135c172c3672efd75eb46360885c0ef # v3.6.0
+        with:
+          registry: ghcr.io
+          username: ${{ secrets.GHCR_USER }}
+          password: ${{ secrets.GHCR_LOGIN_TOKEN }}
+
+      - name: Login to Private Gitea Registry
+        uses: docker/login-action@5e57cd118135c172c3672efd75eb46360885c0ef # v3.6.0
+        with:
+          registry: git.trez.wtf
+          username: ${{ secrets.BOT_GITEA_USER }}
+          password: ${{ secrets.BOT_GITEA_PASSWORD }}
+
+      - name: Gotify Notification (Start)
+        uses: eikendev/gotify-action@ca0339b85ee8db9fda9c0718aaa7f95e17b3c617 # 0.0.4
+        with:
+          gotify_api_base: "${{ secrets.RUNNER_GOTIFY_URL }}"
+          gotify_app_token: "${{ secrets.RUNNER_GOTIFY_TOKEN }}"
+          notification_title: "GITEA: [RENOVATE] Docker Compose Deployment @ Rinoa"
+          notification_message: "Starting Docker Compose run..."
+
+      - name: Generate .env from Hashicorp Vault
+        uses: https://git.trez.wtf/Trez/hc-vault-env@main
+        with:
+          HC_VAULT_VERSION: ${{ env.HC_VAULT_VERSION }}
+          HC_VAULT_ADDR: ${{ secrets.TREZ_VAULT_ADDR }}
+          HC_VAULT_AUTH: token
+          HC_VAULT_TOKEN: ${{ secrets.VAULT_GITEA_TOKEN }}
+          HC_VAULT_SECRETS_PATH: rinoa-docker/env
+
+      - name: Docker Compose Deployment
+        uses: hoverkraft-tech/compose-action@05da55b2bb8a5a759d1c4732095044bd9018c050 # v2.4.3
+        env:
+          DOCKER_HOST: tcp://dockerproxy:2375
+        with:
+          services: |
+            ${{ steps.detect_services.outputs.docker_svc_list }}
+          up-flags: -d --remove-orphans
+          down-flags: --dry-run
+          services-log-level: debug
+
+      - name: Docker Compose Healthcheck
+        id: health
+        uses: jaracogmbh/docker-compose-health-check-action@973fbdccf7c8e396b652d3501984c8e530a9fa80 # v1.0.0
+        with:
+          max-retries: 30
+          retry-interval: 10
+          compose-file: "docker-compose.yml"
+          skip-exited: "true"
+          skip-no-healthcheck: "true"
+
+      - name: Gotify Notification (Finish)
+        uses: eikendev/gotify-action@ca0339b85ee8db9fda9c0718aaa7f95e17b3c617 # 0.0.4
+        with:
+          gotify_api_base: "${{ secrets.RUNNER_GOTIFY_URL }}"
+          gotify_app_token: "${{ secrets.RUNNER_GOTIFY_TOKEN }}"
+          notification_title: "GITEA: [RENOVATE] Docker Compose Deployment @ Rinoa"
+          notification_message: "Deployment completed successfully."

.gitea/workflows/renovate-pr-deploy.yml.hold

@@ -1,98 +0,0 @@
-name: Deploy Renovate Updates
-
-on:
-  workflow_run:
-    workflows: ["Check Renovate Updates"]
-    types:
-      - completed
-
-jobs:
-  deploy:
-    runs-on: ubuntu-latest
-    if: >
-      ${{
-        github.event.workflow_run.conclusion == 'success' &&
-        contains(toLower(github.event.workflow_run.head_commit.author.name), 'renovate')
-      }}
-
-    steps:
-      - name: Checkout repository
-        uses: actions/checkout@v4
-        with:
-          fetch-depth: 0  # we need full history to compute merge-base
-
-      - name: Set up Docker
-        uses: docker/setup-buildx-action@v3
-
-      - name: Log in to Docker (if needed)
-        uses: docker/login-action@v2
-        with:
-          username: ${{ secrets.DOCKER_USERNAME }}
-          password: ${{ secrets.DOCKER_PASSWORD }}
-
-      - name: Install yq
-        run: |
-          sudo wget https://github.com/mikefarah/yq/releases/latest/download/yq_linux_amd64 -O /usr/bin/yq
-          sudo chmod +x /usr/bin/yq
-
-      - name: Get modified services including dependencies
-        id: modified_services
-        run: |
-          echo "Finding modified services in docker-compose.yml..."
-
-          # Find merge-base with previous main commit
-          BASE_COMMIT=$(git merge-base HEAD HEAD~1)
-
-          # Extract changed services between merge-base and HEAD
-          CHANGED_SERVICES=$(git diff --name-only $BASE_COMMIT HEAD -- docker-compose.yml \
-            | xargs -r -I{} yq e '.services | keys | .[]' {})
-
-          if [ -z "$CHANGED_SERVICES" ]; then
-            echo "No services changed, skipping."
-            exit 0
-          fi
-
-          declare -A VISITED
-          ALL_DEPLOY=()
-
-          get_deps() {
-            local service=$1
-            if [[ -n "${VISITED[$service]}" ]]; then
-              return
-            fi
-            VISITED[$service]=1
-            ALL_DEPLOY+=("$service")
-
-            # Array style depends_on
-            deps=$(yq e ".services.\"$service\".depends_on[]?" docker-compose.yml 2>/dev/null)
-            for dep in $deps; do
-              get_deps "$dep"
-            done
-
-            # Mapping style depends_on (with condition)
-            deps_map=$(yq e ".services.\"$service\".depends_on | keys[]" docker-compose.yml 2>/dev/null)
-            for dep in $deps_map; do
-              get_deps "$dep"
-            done
-          }
-
-          for svc in $CHANGED_SERVICES; do
-            get_deps "$svc"
-          done
-
-          echo "Services to deploy: ${ALL_DEPLOY[@]}"
-          echo "modified_services=${ALL_DEPLOY[@]}" >> $GITHUB_ENV
-
-      - name: Pull images for modified services
-        if: env.modified_services != ''
-        run: |
-          echo "Pulling images for services: $modified_services"
-          for svc in $modified_services; do
-            docker compose pull $svc || echo "Failed to pull $svc, continuing..."
-          done
-
-      - name: Deploy updated services
-        if: env.modified_services != ''
-        run: |
-          echo "Deploying services: $modified_services"
-          docker compose up -d $modified_services

.gitea/workflows/renovate.yml

@@ -0,0 +1,65 @@
+name: Renovate
+
+on:
+  schedule:
+    - cron: "0/30 * * * *"
+  workflow_dispatch:
+
+env:
+  RENOVATE_VERSION: "41.173.1"
+
+jobs:
+  renovate:
+    runs-on: ubuntu-latest
+    timeout-minutes: 5
+    steps:
+      - name: Checkout
+        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
+
+      - name: Renovate Run
+        env:
+          DOCKER_HOST: tcp://dockerproxy:2375
+          RENOVATE_PLATFORM: gitea
+          RENOVATE_ENDPOINT: https://git.trez.wtf/api/v1
+          RENOVATE_TOKEN: ${{ secrets.RENOVATE_BOT_TOKEN }}
+          LOG_LEVEL: ${{ vars.RENOVATE_LOG_LEVEL }}
+          RENOVATE_GITHUB_COM_TOKEN: ${{ secrets.RENOVATE_GITHUB_TOKEN }}
+          RENOVATE_CONFIG_FILE: renovate.json
+          RENOVATE_REPOSITORIES: trez/rinoa-docker
+          RENOVATE_HOST_RULES: |
+            [
+              {
+                "description": "Docker Hub authentication",
+                "hostType": "docker",
+                "matchHost": "docker.io",
+                "username": "${{ secrets.DOCKERHUB_USER }}",
+                "password": "${{ secrets.DOCKERHUB_PASSWORD }}"
+              },
+              {
+                "description": "GitHub Container Registry (GHCR)",
+                "hostType": "docker",
+                "matchHost": "ghcr.io",
+                "username": "${{ secrets.GHCR_USER }}",
+                "password": "${{ secrets.GHCR_LOGIN_TOKEN }}"
+              },
+              {
+                "description": "Self-hosted Gitea Docker Registry",
+                "hostType": "docker",
+                "matchHost": "git.trez.wtf",
+                "username": "${{ secrets.BOT_GITEA_USER }}",
+                "password": "${{ secrets.BOT_GITEA_PASSWORD }}"
+              }
+            ]
+        run: |
+          docker run --rm \
+            -e RENOVATE_PLATFORM \
+            -e RENOVATE_ENDPOINT \
+            -e RENOVATE_TOKEN \
+            -e LOG_LEVEL \
+            -e RENOVATE_GITHUB_COM_TOKEN \
+            -e RENOVATE_CONFIG_FILE \
+            -e RENOVATE_REPOSITORIES \
+            -e RENOVATE_HOST_RULES \
+            --volumes-from ${{ env.JOB_CONTAINER_NAME }} \
+            -w ${GITHUB_WORKSPACE} \
+            renovate/renovate:${{ env.RENOVATE_VERSION }}-full

README.md

@@ -6,28 +6,31 @@
 | --- | --- | --- |
 | 13ft | ghcr.io/wasi-master/13ft:latest | Web interface for blocking ads and paywalls |
 | actual_server | docker.io/actualbudget/actual-server:latest | Privacy-focused app for managing finances |
-| adguard | adguard/adguardhome:v0.107.65 | Ad-blocking/DNS |
+| adguard | adguard/adguardhome:v0.107.71 | Ad-blocking/DNS |
 | apcupsd-cgi | bnhf/apcupsd-cgi:latest | Web interface for apcupsd |
 | apprise-api | lscr.io/linuxserver/apprise-api:latest | Multi-channel notification API |
 | archivebox | archivebox/archivebox:latest | Open-source and self-hosted web archiving |
 | asciinema | ghcr.io/asciinema/asciinema-server:latest | Platform for hosting and sharing terminal session recordings |
 | asciinema-pg-db | postgres:14-alpine |  |
 | audiobookshelf | ghcr.io/advplyr/audiobookshelf:latest | Podcasts, eBooks, & Audiobooks |
+| audiomuse-ai-flask | ghcr.io/neptunehub/audiomuse-ai:0.7.12-beta | Automatic playlist generation using AI |
+| audiomuse-ai-pg | postgres:15-alpine |  |
+| audiomuse-ai-valkey | docker.io/valkey/valkey:9-alpine |  |
+| audiomuse-ai-worker | ghcr.io/neptunehub/audiomuse-ai:0.7.12-beta |  |
 | authelia | authelia/authelia:master | Authentication/authorization server with MFA & SSO |
 | authelia-pg | postgres:16-alpine |  |
-| authelia-valkey | docker.io/bitnami/valkey:latest |  |
+| authelia-valkey | docker.io/valkey/valkey:9-alpine |  |
+| backrest | garethgeorge/backrest:latest | Data backup |
 | bazarr | lscr.io/linuxserver/bazarr:latest | Subtitle automation for TV shows/movies |
 | beszel | henrygd/beszel:latest | Lightweight server monitoring hub |
 | beszel-agent | henrygd/beszel-agent:latest |  |
 | bitwarden | vaultwarden/server:latest | Credential/Information Vault |
-| bluesky-pds | code.modernleft.org/gravityfargo/bluesky-pds:v0.4.98 |  |
+| bluesky-pds | code.modernleft.org/gravityfargo/bluesky-pds:v0.4.193 |  |
 | browserless | ghcr.io/browserless/chromium:latest |  |
 | bytestash | ghcr.io/jordan-dalby/bytestash:latest | Code Gists/Snippets |
-| castopod | castopod/castopod:latest | Podcast self-hosting |
-| castopod-valkey | docker.io/bitnami/valkey:latest |  |
 | changedetection | ghcr.io/dgtlmoon/changedetection.io | Page change monitoring with alerts |
 | changedetection-chrome | dgtlmoon/sockpuppetbrowser:latest |  |
-| chrome | gcr.io/zenika-hub/alpine-chrome:123 |  |
+| chrome | gcr.io/zenika-hub/alpine-chrome:124 |  |
 | clipcascade | sathvikrao/clipcascade:latest | Online file converter |
 | cloudflareddns | ghcr.io/hotio/cloudflareddns:latest |  |
 | convertx | ghcr.io/c4illin/convertx | Online file converter |
@@ -39,23 +42,22 @@
 | dawarich-app | freikin/dawarich:latest | Self-hosted alternative to Google Location History |
 | dawarich-pg-db | postgis/postgis:17-3.5-alpine |  |
 | dawarich-sidekiq | freikin/dawarich:latest |  |
-| dawarich-valkey | docker.io/bitnami/valkey:latest |  |
+| dawarich-valkey | docker.io/valkey/valkey:9-alpine |  |
 | dead-man-hand | ghcr.io/bkupidura/dead-man-hand:latest |  |
 | docker-socket-proxy | ghcr.io/tecnativa/docker-socket-proxy:latest |  |
 | dockflare | alplat/dockflare:stable | Cloudflare Tunnel controller |
-| dockpeek | ghcr.io/dockpeek/dockpeek:v1.5.8 | Real-time port monitoring and discovery |
+| dockpeek | ghcr.io/dockpeek/dockpeek:v1.7.2 | Real-time port monitoring and discovery |
 | duplicati | lscr.io/linuxserver/duplicati:latest | Data backup |
-| easyappointments | alextselegidis/easyappointments:1.5.2 | Highly customizable appointment scheduler |
 | excalidraw | excalidraw/excalidraw:latest | Virtual whiteboard for sketching hand-drawn like diagrams |
 | explo | ghcr.io/lumepart/explo:latest |  |
 | fastenhealth | ghcr.io/fastenhealth/fasten-onprem:main | Open-source, self-hosted, personal/family electronic medical record aggregator |
 | flaresolverr | ghcr.io/flaresolverr/flaresolverr:latest |  |
-| garage | dxflrs/garage:v2.0.0 |  |
+| garage | dxflrs/garage:v2.1.0 |  |
 | garage-webui | khairul169/garage-webui:latest | S3-compatible storage backend |
 | ghost | ghost:latest | Personal blog |
-| gitea | gitea/gitea:1.24.5 | Private Code Repo |
+| gitea | gitea/gitea:1.25.4 | Private Code Repo |
 | gitea-db | postgres:14 |  |
-| gitea-runner | gitea/act_runner:latest |  |
+| gitea-runner | gitea/act_runner:nightly |  |
 | gitea-sonarqube-bot | justusbunsi/gitea-sonarqube-bot:v0.4.0 |  |
 | gitignore-io | guog/gitignore.io:latest | .gitignore generator |
 | gluetun | qmcgaw/gluetun:latest |  |
@@ -68,13 +70,11 @@
 | immich-pg-db | tensorchord/pgvecto-rs:pg14-v0.2.1 |  |
 | immich-public-proxy | alangrainger/immich-public-proxy:latest | Immich Proxy for public sharing |
 | immich-power-tools | ghcr.io/varun-raj/immich-power-tools:latest |  |
-| immich-valkey | docker.io/bitnami/valkey:latest |  |
+| immich-valkey | docker.io/valkey/valkey:9-alpine |  |
 | influxdb2 | influxdb:2-alpine | Scalable datastore for metrics, events, and real-time analytics |
 | invidious | quay.io/invidious/invidious:latest | Alternative YouTube frontend (privacy-focused, ad-blocking) |
-| invidious-sig-helper | quay.io/invidious/inv-sig-helper:latest |  |
+| invidious-companion | quay.io/invidious/invidious-companion:latest |  |
 | invidious-db | docker.io/library/postgres:14 |  |
-| invoice-ninja | invoiceninja/invoiceninja-debian:5 |  |
-| invoice-ninja_proxy | nginx | Simple invoicing, multiple payment options, expense and vendor management, and more! |
 | it-tools | ghcr.io/corentinth/it-tools:latest | Useful tools for developers and people working in IT |
 | jellyfin | jellyfin/jellyfin | Movie/TV Streaming |
 | jitsi-etherpad | etherpad/etherpad:1.9.7 |  |
@@ -95,25 +95,27 @@
 | lldap | lldap/lldap:stable | LDAP made easy |
 | loggifly | ghcr.io/clemcer/loggifly:latest |  |
 | maloja | krateng/maloja:latest | Simple self-hosted music scrobble database to create personal listening statistics |
-| manyfold | lscr.io/linuxserver/manyfold:latest | Self-hosted digital asset manager for 3D print files |
-| manyfold-valkey | docker.io/bitnami/valkey:latest |  |
+| manyfold | lscr.io/linuxserver/manyfold:0.131.0 | Self-hosted digital asset manager for 3D print files |
+| manyfold-pg-db | postgres:18-alpine |  |
+| manyfold-valkey | docker.io/valkey/valkey:9-alpine |  |
 | mariadb | linuxserver/mariadb |  |
 | mastodon | lscr.io/linuxserver/mastodon:latest | Open-source social network |
 | mastodon-pg-db | postgres:17-alpine |  |
-| mastodon-valkey | docker.io/bitnami/valkey:latest |  |
+| mastodon-valkey | docker.io/valkey/valkey:9-alpine |  |
 | maxun-backend | getmaxun/maxun-backend:latest |  |
 | maxun-frontend | getmaxun/maxun-frontend:latest | No-code web data extraction platform |
-| maxun-pg-db | postgres:13-alpine |  |
-| maxun-valkey | docker.io/bitnami/valkey:latest |  |
-| meilisearch | getmeili/meilisearch:v1.15 |  |
+| maxun-pg-db | postgres:17-alpine |  |
+| maxun-valkey | docker.io/valkey/valkey:9-alpine |  |
 | meme-search-pro | ghcr.io/neonwatty/meme_search_pro:latest | Meme search engine built with Python and Ruby |
 | meme-search-pro-img2txt-gen | ghcr.io/neonwatty/image_to_text_generator:latest |  |
 | meme-search-db | pgvector/pgvector:pg17 |  |
 | mini-qr | ghcr.io/lyqht/mini-qr:latest | Scan and generate customized QR codes easily |
 | minio | minio/minio:RELEASE.2025-04-22T22-12-26Z | S3-compatible storage backend |
 | mixpost | inovector/mixpost:latest | Multi-channel social media manager |
-| mixpost-valkey | docker.io/bitnami/valkey:latest |  |
-| mongodb | bitnami/mongodb:7.0 |  |
+| mixpost-valkey | docker.io/valkey/valkey:9-alpine |  |
+| mgob | stefanprodan/mgob | Headless Automated MongoDB Backups |
+| mongodb | mongo:7 |  |
+| mongodb-exporter | percona/mongodb_exporter:2.37.0 |  |
 | multi-scrobbler | foxxmd/multi-scrobbler | JS App for scrobbling/recording play history from/to multiple sources |
 | n8n | docker.n8n.io/n8nio/n8n | Extendable workflow automation tool to easily automate tasks |
 | navidrome | deluan/navidrome:latest | Music Streaming |
@@ -121,27 +123,21 @@
 | nextcloud | nextcloud/all-in-one:latest | Private Cloud |
 | nocodb | nocodb/nocodb:latest | Turn any SQL-based database into a smart spreadsheet |
 | nocodb-pg-db | postgres:16-alpine |  |
-| nocodb-valkey | docker.io/bitnami/valkey:latest |  |
-| ollama | ollama/ollama:latest |  |
+| nocodb-valkey | docker.io/valkey/valkey:9-alpine |  |
 | ombi | lscr.io/linuxserver/ombi:latest | Media Requests |
 | omnitools | iib0011/omni-tools:latest | Tools for common tasks |
 | omnipoly | kweg/omnipoly:latest | Open-source language translation with LanguageTool, LibreTranslate, & Ollama |
 | open-webui | ghcr.io/open-webui/open-webui:main | User-friendly and extensible AI interface |
-| open-webui-valkey | docker.io/bitnami/valkey:latest |  |
+| open-webui-valkey | docker.io/valkey/valkey:9-alpine |  |
 | paperless-ngx | ghcr.io/paperless-ngx/paperless-ngx:latest | Document indexer & archiver with OCR |
-| paperless-valkey | docker.io/bitnami/valkey:latest |  |
-| penpot-frontend | penpotapp/frontend:latest | Open-source design and prototyping platform |
-| penpot-backend | penpotapp/backend:latest |  |
-| penpot-exporter | penpotapp/exporter:latest |  |
-| penpot-pg-db | postgres:15-alpine |  |
-| penpot-redis | redis:7.2 |  |
+| paperless-valkey | docker.io/valkey/valkey:9-alpine |  |
 | pgbackweb | eduardolat/pgbackweb:latest | Backups for PostgreSQL |
 | pgbackweb-db | postgres:17-alpine |  |
 | planka | ghcr.io/plankanban/planka:2.0.0-rc.3 | Kanban board |
 | planka-pg-db | postgres:16-alpine |  |
 | plant-it | msdeluise/plant-it-server:latest | 🪴 Self-hosted, open source gardening companion app |
-| plant-it-valkey | docker.io/bitnami/valkey:latest |  |
-| plantuml-server | plantuml/plantuml-server:jetty |  |
+| plant-it-valkey | docker.io/valkey/valkey:9-alpine |  |
+| plantuml-server | plantuml/plantuml-server:jetty | Textual diagram generator for UML & other visualizations. |
 | portainer | portainer/portainer-ce:alpine | Service delivery platform for containerized applications |
 | portchecker-web | ghcr.io/dsgnr/portcheckerio-web:latest | Service delivery platform for containerized applications |
 | portchecker-api | ghcr.io/dsgnr/portcheckerio-api:latest |  |
@@ -158,26 +154,24 @@
 | reactive-resume-pg | postgres:16-alpine |  |
 | readarr | lscr.io/linuxserver/readarr:develop | eBook/Audiobook Automation |
 | redlib | quay.io/redlib/redlib:latest | Redlib is a private front-end like Invidious but for Reddit |
-| renovate | renovate/renovate:41.97.7-full |  |
-| renovate-valkey | docker.io/bitnami/valkey:latest |  |
 | rocketchat | registry.rocket.chat/rocketchat/rocket.chat:latest | Fully customizable communications platform with high standards of data protection |
 | romm | rommapp/romm:latest | Beautiful, powerful, self-hosted ROM manager |
-| romm-valkey | docker.io/bitnami/valkey:latest |  |
+| romm-valkey | docker.io/valkey/valkey:9-alpine |  |
 | sabnzbdvpn | ghcr.io/binhex/arch-sabnzbdvpn:latest | NZB Downloader over VPN |
 | sablier | sablierapp/sablier:latest |  |
 | scraparr | ghcr.io/thecfu/scraparr:2 |  |
 | scrutiny | ghcr.io/analogj/scrutiny:master-omnibus | WebUI for smartd S.M.A.R.T monitoring |
 | searxng | searxng/searxng:latest | Anonymized Meta-Search Engine |
-| searxng-valkey | docker.io/bitnami/valkey:latest |  |
-| semaphore-ui | semaphoreui/semaphore:v2.12.14 | Modern UI for Ansible, Terraform, OpenTofu, PowerShell and other DevOps tools |
-| signoz-app | signoz/signoz:v0.92.2 | Logs, metrics, and traces in a single pane |
-| signoz-clickhouse | clickhouse/clickhouse-server:24.1.2-alpine |  |
-| signoz-init-clickhouse | clickhouse/clickhouse-server:24.1.2-alpine |  |
+| searxng-valkey | docker.io/valkey/valkey:9-alpine |  |
+| semaphore-ui | semaphoreui/semaphore:v2.16.51 | Modern UI for Ansible, Terraform, OpenTofu, PowerShell and other DevOps tools |
+| signoz-app | signoz/signoz:v0.96.1 | Logs, metrics, and traces in a single pane |
+| signoz-clickhouse | clickhouse/clickhouse-server:25.5.6-alpine |  |
+| signoz-init-clickhouse | clickhouse/clickhouse-server:25.5.6-alpine |  |
 | signoz-logspout | pavanputhra/logspout-signoz |  |
-| signoz-otel-collector | signoz/signoz-otel-collector:v0.129.0 |  |
-| signoz-schema-migrator-async | signoz/signoz-schema-migrator:v0.129.0 |  |
-| signoz-schema-migrator-sync | signoz/signoz-schema-migrator:v0.129.0 |  |
-| signoz-zookeeper-1 | bitnami/zookeeper:3.7.1 |  |
+| signoz-otel-collector | signoz/signoz-otel-collector:v0.129.13 |  |
+| signoz-schema-migrator-async | signoz/signoz-schema-migrator:v0.129.13 |  |
+| signoz-schema-migrator-sync | signoz/signoz-schema-migrator:v0.129.13 |  |
+| signoz-zookeeper-1 | signoz/zookeeper:3.7.1 |  |
 | sonarqube | mc1arke/sonarqube-with-community-branch-plugin:lts | Code/DevOps quality/security |
 | sonarqube-pg-db | postgres:17-alpine |  |
 | sonarr | lscr.io/linuxserver/sonarr:latest | TV Show Automation |
@@ -186,30 +180,17 @@
 | soularr-dashboard | ghcr.io/mrusse/soularr:main | Dashboard for monitoring Soularr |
 | soulseek | slskd/slskd | Modern client-server application for the Soulseek file-sharing network. |
 | speedtest-tracker | lscr.io/linuxserver/speedtest-tracker:latest | Self-hosted internet performance tracking |
-| stable-diffusion-webui | ghcr.io/neggles/sd-webui-docker:latest |  |
 | stirling-pdf | docker.stirlingpdf.com/stirlingtools/stirling-pdf:latest | PDF Operations |
 | swag | lscr.io/linuxserver/swag:latest | SWAG Dashboard for proxies |
 | tandoor | vabene1111/recipes | Recipes, cookbooks, meal-planning, & grocery lists |
 | tandoor-pg | postgres:16-alpine |  |
-| umami | ghcr.io/umami-software/umami:postgresql-latest | Simple, fast, privacy-focused alternative to Google Analytics |
-| umami-pg-db | postgres:15-alpine |  |
+| tdarr | ghcr.io/haveagitgat/tdarr:2.58.02 | Distributed transcode automation |
 | unmanic | josh5/unmanic:latest | Library Optimizer |
 | uptimekuma | louislam/uptime-kuma:latest | HTTP Endpoint Monitoring |
 | vault | hashicorp/vault:latest | HashiCorp Vault for secrets, key/value stores, etc. |
 | wallos | bellamy/wallos:latest | Subscription Tracking |
-| watchtower | ghcr.io/containrrr/watchtower:latest | Container-based solution for automating Docker container base image updates |
 | web-check | lissy93/web-check | Site scanner for attack vectors, architecture, security configs, and more |
 | whodb | clidey/whodb | Lightweight next-gen database explorer |
 | wizarr | ghcr.io/wizarrrr/wizarr | User invitation management system for Jellyfin, Plex, and Emby |
 | youtubedl | nbr23/youtube-dl-server:latest | YouTube Downloader |
-| zammad-backup | ghcr.io/zammad/zammad:6.5.0-15 |  |
-| zammad-elasticsearch | elasticsearch:8.18.0 |  |
-| zammad-init | ghcr.io/zammad/zammad:6.5.0-15 |  |
-| zammad-memcached | memcached:1.6.38-alpine |  |
-| zammad-nginx | ghcr.io/zammad/zammad:6.5.0-15 | Open-source helpdesk/customer support system |
-| zammad-postgresql | postgres:17.5-alpine |  |
-| zammad-railsserver | ghcr.io/zammad/zammad:6.5.0-15 |  |
-| zammad-redis | redis:7.4.2-alpine |  |
-| zammad-scheduler | ghcr.io/zammad/zammad:6.5.0-15 |  |
-| zammad-websocket | ghcr.io/zammad/zammad:6.5.0-15 |  |
 

extract-docker-images.js

@@ -1,39 +0,0 @@
-const fs = require('fs');
-const yaml = require('js-yaml');
-
-module.exports = function extractDockerImages(fileContent) {
-  const result = [];
-
-  try {
-    const doc = yaml.load(fileContent, { schema: yaml.DEFAULT_SCHEMA });
-
-    if (!doc.services) return [];
-
-    for (const [serviceName, serviceDef] of Object.entries(doc.services)) {
-      let image = serviceDef.image;
-
-      // Resolve anchors/merges if image is not directly present
-      if (!image && serviceDef['<<']) {
-        const merge = Array.isArray(serviceDef['<<']) ? serviceDef['<<'] : [serviceDef['<<']];
-        merge.forEach(m => {
-          if (m && m.image && !image) {
-            image = m.image;
-          }
-        });
-      }
-
-      if (image) {
-        const [depName, currentValue] = image.split(':');
-        result.push({
-          depName: depName,
-          currentValue: currentValue || 'latest',
-          service: serviceName // For Renovate PR titles
-        });
-      }
-    }
-  } catch (err) {
-    console.error('Failed parsing docker-compose.yml:', err);
-  }
-
-  return result;
-};

renovate.json

@@ -1,53 +1,23 @@
 {
   "$schema": "https://docs.renovatebot.com/renovate-schema.json",
-  "extends": ["config:base"],
-  "enabledManagers": ["docker-compose"],
-  "schedule": [
-    "* 3-9 * * 5",
-    "* 3-9 * * 6",
-    "* 3-9 * * 0"
-  ],
-  "prConcurrentLimit": 5,
-  "branchPrefix": "renovate/",
-  "rebaseWhen": "behind-base-branch",
+  "extends": ["local>trez/renovate-config"],
   "packageRules": [
     {
-      "description": "Pin ClickHouse, Zookeeper, Postgres, pgvector, and pgvecto-rs images",
+      "description": "Freeze ClickHouse and Zookeeper",
       "matchDatasources": ["docker"],
       "matchManagers": ["docker-compose"],
       "matchPackageNames": [
-        "signoz-clickhouse-server",
-        "signoz-zookeeper-1",
-        "postgres",
-        "pgvector",
-        "pgvecto-rs"
+        "clickhouse/clickhouse-server",
+        "signoz/zookeeper"
       ],
-      "pinDigests": true,
-      "allowedVersions": "digest"
+      "enabled": false
     },
     {
-      "description": "Alpine-based images only update to Alpine-based versions",
+      "description": "Pin Postgres, pgvector, and pgvecto-rs images",
       "matchDatasources": ["docker"],
       "matchManagers": ["docker-compose"],
-      "matchPackagePatterns": [".*"],
-      "allowedVersions": "/alpine/i"
-    },
-    {
-      "description": "Automerge patch updates for semver tags",
-      "matchDatasources": ["docker"],
-      "matchManagers": ["docker-compose"],
-      "matchUpdateTypes": ["patch"],
-      "automerge": true
-    },
-    {
-      "description": "Require approval for major and minor updates",
-      "matchDatasources": ["docker"],
-      "matchManagers": ["docker-compose"],
-      "matchUpdateTypes": ["minor", "major"],
-      "automerge": false,
-      "requiredStatusChecks": null
+      "matchPackageNames": ["postgres", "pgvector", "pgvecto-rs"],
+      "pinDigests": true
     }
-  ],
-  "branchNameStrict": true,
-  "branchTopic": "{{{depNameSanitized}}}-{{{newVersion}}}"
+  ]
 }