Testing.

Label testing.
Auto Merge of PR 541 - otel-docker-mount-pr-deploy-img-pull_2025-10-08T06-21-13
2025-10-08 06:54:08 -04:00 · 2025-10-08 06:48:59 -04:00 · 2025-10-08 06:38:34 -04:00 · 2025-10-08 06:34:16 -04:00 · 2025-10-08 06:34:02 -04:00 · 2025-10-08 04:31:58 +00:00
11 changed files with 1124 additions and 1124 deletions
@@ -1,20 +0,0 @@
-name: Check Renovate Updates
-
-on:
-  pull_request:
-    branches:
-      - main
-    types: [opened, synchronize, reopened]
-    paths:
-      - 'docker-compose.yml'
-
-jobs:
-  validate:
-    runs-on: ubuntu-latest
-    if: ${{ contains(toLower(github.event.pull_request.user.login), 'renovate') }}
-    steps:
-      - name: Checkout code
-        uses: actions/checkout@v4
-
-      - name: Validate docker-compose.yml
-        run: docker compose config
@@ -0,0 +1,42 @@
+name: List of Services README Generation
+
+on:
+  schedule:
+    - cron: 30 */2 * * *
+  workflow_dispatch:
+
+jobs:
+  readme-services:
+   name: Generate Services List
+   runs-on: ubuntu-latest
+   steps:
+    - name: Checkout
+      uses: actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955 # v4.3.0
+      with:
+        ref: 'main'
+
+    - name: Install yq
+      uses: dcarbone/install-yq-action@4075b4dca348d74bd83f2bf82d30f25d7c54539b # v1.3.1
+
+    - name: Generate service list
+      run: |
+        yq 'explode(.) | .services | to_entries | map({"service": .key, "image": .value.image, "description": (.value.labels."homepage.description" // "")})' docker-compose.yml > services.yml
+
+    - name: Generate Markdown Table
+      uses: gazab/create-markdown-table@6686233d7008e8d8b9d4bbdbfd1fb1ae510019f0 # v1.0.7
+      id: service-table
+      with:
+        file: ./services.yml
+
+    - name: Regenerate README
+      run: |
+        echo "# List of Services" > README.md
+        echo -e "\n\n" >> README.md
+        echo "${{ steps.service-table.outputs.table }}" >> README.md
+
+    - name: Add/Commit README.md
+      id: commit-readme
+      uses: EndBug/add-and-commit@a94899bca583c204427a224a7af87c02f9b325d5 # v9.1.4
+      with:
+        message: "chore: Update README"
+        add: "README.md"
@@ -4,15 +4,15 @@ on:
  workflow_dispatch:
  push:
    branches-ignore:
-      - 'main'
-      - 'renovate/**'
+      - "main"
+      - "renovate/**"
    paths:
-      - '**/docker-compose.yml'
+      - "**/docker-compose.yml"

 env:
-  FLARECTL_VERSION: '0.115.0'
-  HC_VAULT_VERSION: '1.18.0'
-  TEA_VERSION: '0.10.1'
+  FLARECTL_VERSION: "0.116.0"
+  HC_VAULT_VERSION: "1.20.4"
+  TEA_VERSION: "0.10.1"

 jobs:
  check-and-create-pr:
@@ -20,77 +20,33 @@ jobs:
    runs-on: ubuntu-latest
    steps:
      - name: Checkout Code
-        uses: actions/checkout@v4
+        uses: actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955 # v4.3.0
        with:
          fetch-depth: 1

-      - name: Cache tea CLI
-        id: cache-tea
-        uses: actions/cache@v4
+      - name: Gotify Notification
+        uses: eikendev/gotify-action@master
        with:
-          path: /opt/hostedtoolcache/tea/${{ env.TEA_VERSION }}/x64
-          key: tea-${{ runner.os }}-${{ env.TEA_VERSION }}
+          gotify_api_base: "${{ secrets.RUNNER_GOTIFY_URL }}"
+          gotify_app_token: "${{ secrets.RUNNER_GOTIFY_TOKEN }}"
+          notification_title: "GITEA: PR Check @ Rinoa"
+          notification_message: "Checking for existing PR... 🔍"

-      - name: Install tea
-        uses: supplypike/setup-bin@v4
+      - name: PR Check/Creation
+        uses: https://git.trez.wtf/Trez/gitea-auto-pr@main
        with:
-          uri: https://gitea.com/gitea/tea/releases/download/v${{ env.TEA_VERSION }}/tea-${{ env.TEA_VERSION }}-linux-amd64
-          name: tea
-          version: ${{ env.TEA_VERSION }}
+          url: ${{ secrets.TREZ_GITEA_URL }}
+          token: ${{ secrets.BOT_GITEA_TOKEN }}
+          pr-label: docker-compose,manual
+          assignee: ${{ github.actor }}

      - name: Gotify Notification
        uses: eikendev/gotify-action@master
        with:
-          gotify_api_base: '${{ secrets.RINOA_GOTIFY_URL }}'
-          gotify_app_token: '${{ secrets.RINOA_RUNNER_GOTIFY_TOKEN }}'
-          notification_title: 'GITEA: PR Check'
-          notification_message: 'Checking for existing PR... 🔍'
-
-      - name: Check if open PR exists
-        id: check-opened-pr-step
-        continue-on-error: true
-        run: |
-          tea login add \
-            --name gitea-rinoa \
-            --url "${{ secrets.RINOA_GITEA_URL }}" \
-            --user gitea-sonarqube-bot \
-            --password "${{ secrets.BOT_GITEA_PASSWORD }}" \
-            --token ${{ secrets.BOT_GITEA_TOKEN }}
-
-          pr_exists=$(tea pr list \
-            --repo ${{ github.repository }} \
-            --state open \
-            --fields index,title,head \
-            | egrep '\[DOCKER\].*${{ github.ref_name }}' | tail -1 | wc -l)
-
-          echo "exists=$pr_exists" >> $GITHUB_OUTPUT
-
-      - name: Create PR
-        if: ${{ steps.check-opened-pr-step.outputs.exists == '0' }}
-        run: |
-          tea login default gitea-rinoa
-
-          pr_index_old=$(tea pr ls \
-            --repo ${{ github.repository }} \
-            --state all --fields index,title,head \
-            --output csv | sed -e 's|"||g' | \
-            egrep '^[0-9]' | head -1 | awk -F"," '{print $1}')
-
-          pr_index_new=$(expr ${pr_index_old} + 1)
-
-          tea pr c -r ${{ github.repository }} \
-            -t "[DOCKER] Automated PR for ${{ github.ref_name }} - #${pr_index_new}" \
-            -d "Automatically created PR for branch: ${{ github.ref_name }}" \
-            -a ${{ github.actor }} \
-            -L "Docker Compose"
-
-      - name: Gotify Notification
-        uses: eikendev/gotify-action@master
-        with:
-          gotify_api_base: '${{ secrets.RINOA_GOTIFY_URL }}'
-          gotify_app_token: '${{ secrets.RINOA_RUNNER_GOTIFY_TOKEN }}'
-          notification_title: 'GITEA: PR Check'
-          notification_message: 'PR Created 🎟️'
+          gotify_api_base: "${{ secrets.RUNNER_GOTIFY_URL }}"
+          gotify_app_token: "${{ secrets.RUNNER_GOTIFY_TOKEN }}"
+          notification_title: "GITEA: PR Check @ Rinoa"
+          notification_message: "PR Check done 🎟️"

  generate-service-list:
    name: Generate list of added/modified/deleted services
@@ -99,9 +55,8 @@ jobs:
    outputs:
      svc_deploy_list: ${{ steps.detect_services.outputs.docker_svc_list }}
    steps:
-
      - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955 # v4.3.0

      - name: Fetch base branch
        run: |
@@ -110,10 +65,10 @@ jobs:
      - name: Gotify Notification
        uses: eikendev/gotify-action@master
        with:
-          gotify_api_base: '${{ secrets.RINOA_GOTIFY_URL }}'
-          gotify_app_token: '${{ secrets.RINOA_RUNNER_GOTIFY_TOKEN }}'
-          notification_title: 'GITEA: Services TBD'
-          notification_message: 'Generating list of services to deploy...'
+          gotify_api_base: "${{ secrets.RUNNER_GOTIFY_URL }}"
+          gotify_app_token: "${{ secrets.RUNNER_GOTIFY_TOKEN }}"
+          notification_title: "GITEA: Services TBD"
+          notification_message: "Generating list of services to deploy..."

      - name: Save both versions of docker-compose.yml
        run: |
@@ -130,10 +85,12 @@ jobs:
          echo "Creating list of modified services..."
          touch service_changes.txt

+          # Detect newly added services
          comm -13 services_main.txt services_head.txt | while read service; do
-            echo "$service: added" >> service_changes.txt
+            [ -n "$service" ] && echo "$service: added" >> service_changes.txt
          done

+          # Detect modified services
          comm -12 services_main.txt services_head.txt | while read service; do
            yq ".services[\"$service\"]" docker-compose-main.yml > tmp_main.yml
            yq ".services[\"$service\"]" docker-compose-head.yml > tmp_head.yml
@@ -143,11 +100,41 @@ jobs:
          done

          echo "Detected service changes:"
-          cat service_changes.txt
+          cat service_changes.txt || echo "None"

+          # Gather list of modified/added services
          mod_svcs=$(cut -d':' -f1 service_changes.txt | sort | uniq)
+          if [ -z "$mod_svcs" ]; then
+            echo "No modified or added services detected."
+            echo "docker_svc_list<<EOF" >> "$GITHUB_OUTPUT"
+            echo "" >> "$GITHUB_OUTPUT"
+            echo "EOF" >> "$GITHUB_OUTPUT"
+            exit 0
+          fi
+
+          echo "Modified/added services:"
+          echo "$mod_svcs"
+
+          # Include direct dependencies
+          echo "Resolving direct dependencies..."
+          deps_list=""
+          for svc in $mod_svcs; do
+            deps=$(yq -r ".services[\"$svc\"].depends_on | keys | .[]" docker-compose-head.yml 2>/dev/null || true)
+            if [ -n "$deps" ]; then
+              echo "$svc depends on:"
+              echo "$deps"
+              deps_list="$deps_list $deps"
+            fi
+          done
+
+          all_svcs=$( (echo "$mod_svcs"; echo "$deps_list") | tr ' ' '\n' | sort -u)
+
+          echo "Final service list (including direct dependencies):"
+          echo "$all_svcs"
+
+          # Expose to workflow output
          echo "docker_svc_list<<EOF" >> "$GITHUB_OUTPUT"
-          echo "$mod_svcs" >> "$GITHUB_OUTPUT"
+          echo "$all_svcs" >> "$GITHUB_OUTPUT"
          echo "EOF" >> "$GITHUB_OUTPUT"

      - name: List of Services for (Re)Deployment
@@ -159,63 +146,78 @@ jobs:
    needs: [generate-service-list]
    runs-on: ubuntu-latest
    env:
-      VAULT_ADDR: ${{ secrets.RINOA_VAULT_ADDR }}
+      VAULT_ADDR: ${{ secrets.TREZ_VAULT_ADDR }}
      VAULT_TOKEN: ${{ secrets.VAULT_GITEA_TOKEN }}
      VAULT_NAMESPACE: ""
      RINOA_REGISTRY_PASSWORD: ${{ secrets.BOT_GITEA_PASSWORD }}
      DOCKER_SVC_LIST: ${{ needs.generate-service-list.outputs.svc_deploy_list }}
    steps:
      - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955 # v4.3.0

-      - name: Login to Gitea Container Registry
-        run: |
-          docker login -u gitea-sonarqube-bot -p ${RINOA_REGISTRY_PASSWORD} git.trez.wtf
-
-      - name: Cache Vault install
-        id: cache-vault
-        uses: actions/cache@v4
+      - name: Login to Docker Hub
+        uses: docker/login-action@5e57cd118135c172c3672efd75eb46360885c0ef # v3.6.0
        with:
-          path: /opt/hostedtoolcache/vault/${{ env.HC_VAULT_VERSION }}/x64
-          key: vault-${{ runner.os }}-${{ env.HC_VAULT_VERSION }}
+          username: ${{ secrets.DOCKERHUB_USER }}
+          password: ${{ secrets.DOCKERHUB_PASSWORD }}

-      - name: Install Vault (only if not cached)
-        if: steps.cache-vault.outputs.cache-hit != 'true'
-        uses: cpanato/vault-installer@main
+      - name: Login to GitHub Container Registry
+        uses: docker/login-action@5e57cd118135c172c3672efd75eb46360885c0ef # v3.6.0
        with:
-          version: ${{ env.HC_VAULT_VERSION }}
+          registry: ghcr.io
+          username: ${{ secrets.GHCR_USER }}
+          password: ${{ secrets.GHCR_LOGIN_TOKEN }}
+
+      - name: Login to Private Gitea Registry
+        uses: docker/login-action@5e57cd118135c172c3672efd75eb46360885c0ef # v3.6.0
+        with:
+          registry: git.trez.wtf
+          username: ${{ secrets.BOT_GITEA_USER }}
+          password: ${{ secrets.BOT_GITEA_PASSWORD }}

      - name: Gotify Notification
        uses: eikendev/gotify-action@master
        with:
-          gotify_api_base: '${{ secrets.RINOA_GOTIFY_URL }}'
-          gotify_app_token: '${{ secrets.RINOA_RUNNER_GOTIFY_TOKEN }}'
-          notification_title: 'GITEA: Docker Compose Dry Run @ Rinoa'
-          notification_message: 'Starting Docker Compose dry run...'
+          gotify_api_base: "${{ secrets.RUNNER_GOTIFY_URL }}"
+          gotify_app_token: "${{ secrets.RUNNER_GOTIFY_TOKEN }}"
+          notification_title: "GITEA: Docker Compose Dry Run @ Rinoa"
+          notification_message: "Starting Docker Compose dry run..."

-      - name: Generate .env file for Docker Compose
-        run: |
-          vault kv get -format=json rinoa-docker/env | jq -r '.data.data' | jq -r 'keys[] as $k | "\($k)='\''\(.[$k])'\''"' > .env
-          echo ${DOCKER_SVC_LIST}
+      - name: Generate .env from Hashicorp Vault
+        uses: https://git.trez.wtf/Trez/hc-vault-env@main
+        with:
+          HC_VAULT_VERSION: ${{ env.HC_VAULT_VERSION }}
+          HC_VAULT_ADDR: ${{ secrets.TREZ_VAULT_ADDR }}
+          HC_VAULT_USERNAME: ${{ secrets.VAULT_GITEA_USER }}
+          HC_VAULT_PASSWORD: ${{ secrets.VAULT_GITEA_PASSWORD }}
+          HC_VAULT_SECRETS_PATH: rinoa-docker/env
+
+      - name: Pre-pull/build service images in parallel
+        uses: https://git.trez.wtf/Trez/docker-select-image-pull@main
+        env:
+          DOCKER_HOST: tcp://dockerproxy:2375
+        with:
+          services: ${{ env.DOCKER_SVC_LIST }}
+          compose_profile: "rinoa-apps"

      - name: Docker Compose Dry Run
-        uses: hoverkraft-tech/compose-action@v2.2.0
+        uses: hoverkraft-tech/compose-action@b716db5b717cb9b81e391fe638e5aceaa2299e43 # v2.4.0
        env:
          DOCKER_HOST: tcp://dockerproxy:2375
        with:
          services: |
            ${{ needs.generate-service-list.outputs.svc_deploy_list }}
          up-flags: -d --remove-orphans --dry-run
-          down-flags: --dry-run
          compose-flags: --dry-run --profile rinoa-apps
+          services-log-level: debug

      - name: Gotify Notification
        uses: eikendev/gotify-action@master
        with:
-          gotify_api_base: '${{ secrets.RINOA_GOTIFY_URL }}'
-          gotify_app_token: '${{ secrets.RINOA_RUNNER_GOTIFY_TOKEN }}'
-          notification_title: 'GITEA: Docker Compose Dry Run @ Rinoa'
-          notification_message: 'Docker Compose dry run completed successfully.'
+          gotify_api_base: "${{ secrets.RUNNER_GOTIFY_URL }}"
+          gotify_app_token: "${{ secrets.RUNNER_GOTIFY_TOKEN }}"
+          notification_title: "GITEA: Docker Compose Dry Run @ Rinoa"
+          notification_message: "Docker Compose dry run completed successfully."

  cloudflare-dns-setup:
    name: Cloudflare DNS Setup
@@ -223,40 +225,25 @@ jobs:
    runs-on: ubuntu-latest
    steps:
      - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955 # v4.3.0
        with:
          fetch-depth: 1

-      - name: Cache flarectl CLI
-        uses: actions/cache@v4
-        with:
-          path: ~/.flarectl
-          key: flarectl-${{ runner.os }}-${{ env.FLARECTL_VERSION }}-${{ hashFiles('workflow-config.yml') }}
-
      - name: Install flarectl
-        uses: supplypike/setup-bin@v4
+        uses: supplypike/setup-bin@8e3f88b4f143d9b5c3497f0fc12d45c83c123787 # v4.0.1
        with:
          uri: https://github.com/cloudflare/cloudflare-go/releases/download/v${{ env.FLARECTL_VERSION }}/flarectl_${{ env.FLARECTL_VERSION }}_linux_amd64.tar.gz
          name: flarectl
          version: ${{ env.FLARECTL_VERSION }}

-      - name: Cache Subdomain Files
-        uses: actions/cache@v4
-        with:
-          path: |
-            compose_subdomains.txt
-            cloudflare_subdomains.txt
-          key: ${{ runner.os }}-subdomains-${{ hashFiles('docker-compose.yml') }}
-
      - name: Grab Subdomains from Docker Compose & Cloudflare
        id: grab-subdomains
        env:
          CF_API_TOKEN: ${{ secrets.CF_API_TOKEN }}
          CF_API_EMAIL: ${{ secrets.CF_API_EMAIL }}
        run: |
-          yq '.services[].labels.swag_url' docker-compose.yml | \
+          yq -r '.services[].labels.swag_url' docker-compose.yml | \
            egrep -v 'null' | \
-            sed -e 's|"||g' | \
            awk -F'.' '{print $1}' | \
            sort > compose_subdomains.txt

@@ -264,20 +251,20 @@ jobs:
            --zone "trez.wtf" \
            --type=CNAME \
            --content "trez.wtf" \
-            | jq '.[].Name' | sed -e 's|"||g' | awk -F"." '{print $1}' | \
+            | jq -r '.[].Name' | awk -F"." '{print $1}' | \
            sort > cloudflare_subdomains.txt

      - name: Gotify Notification
        uses: eikendev/gotify-action@master
        with:
-          gotify_api_base: '${{ secrets.RINOA_GOTIFY_URL }}'
-          gotify_app_token: '${{ secrets.RINOA_RUNNER_GOTIFY_TOKEN }}'
-          notification_title: 'GITEA: Cloudflare Setup @ Rinoa'
-          notification_message: 'Starting Cloudflare DNS setup...'
+          gotify_api_base: "${{ secrets.RUNNER_GOTIFY_URL }}"
+          gotify_app_token: "${{ secrets.RUNNER_GOTIFY_TOKEN }}"
+          notification_title: "GITEA: Cloudflare Setup @ Rinoa"
+          notification_message: "Starting Cloudflare DNS setup..."

      - name: Compare Subdomains
        id: compare-subdomains
-        uses: LouisBrunner/diff-action@v2.2.0
+        uses: LouisBrunner/diff-action@9ea7b75986aa27143ad4928974c98a5a1bd92170 # v2.2.0
        with:
          old: compose_subdomains.txt
          new: cloudflare_subdomains.txt
@@ -300,79 +287,22 @@ jobs:
      - name: Gotify Notification
        uses: eikendev/gotify-action@master
        with:
-          gotify_api_base: '${{ secrets.RINOA_GOTIFY_URL }}'
-          gotify_app_token: '${{ secrets.RINOA_RUNNER_GOTIFY_TOKEN }}'
-          notification_title: 'GITEA: Cloudflare Setup @ Rinoa'
-          notification_message: 'Cloudflare DNS setup completed successfully.'
-
-  regenerate-readme-modified-services:
-    name: Update README & Generate List of Modified Services
-    runs-on: ubuntu-latest
-    needs: [cloudflare-dns-setup]
-    steps:
-      - name: Checkout
-        uses: actions/checkout@v4
-
-      - name: Install yq
-        uses: dcarbone/install-yq-action@v1
-
-      - name: Gotify Notification
-        uses: eikendev/gotify-action@master
-        with:
-          gotify_api_base: '${{ secrets.RINOA_GOTIFY_URL }}'
-          gotify_app_token: '${{ secrets.RINOA_RUNNER_GOTIFY_TOKEN }}'
-          notification_title: 'GITEA: README Update'
-          notification_message: 'Updating README...'
-
-      - name: Generate service list
-        run: |
-          yq '.services | to_entries | map({"service": .key, "image": .value.image, "description": (.value.labels."homepage.description" // "")})' docker-compose.yml > services.yml
-
-      - name: Generate Markdown Table
-        uses: gazab/create-markdown-table@v1
-        id: service-table
-        with:
-          file: ./services.yml
-
-      - name: Regenerate README
-        run: |
-          echo "# List of Services" > README.md
-          echo -e "\n\n" >> README.md
-          echo "${{ steps.service-table.outputs.table }}" >> README.md
-
-      - name: Add/Commit README.md
-        id: commit-readme
-        uses: EndBug/add-and-commit@v9
-        with:
-          message: "chore: Update README"
-          add: "README.md"
-
-      - name: Gotify Notification
-        uses: eikendev/gotify-action@master
-        with:
-          gotify_api_base: '${{ secrets.RINOA_GOTIFY_URL }}'
-          gotify_app_token: '${{ secrets.RINOA_RUNNER_GOTIFY_TOKEN }}'
-          notification_title: 'GITEA: README Update'
-          notification_message: 'README updated'
+          gotify_api_base: "${{ secrets.RUNNER_GOTIFY_URL }}"
+          gotify_app_token: "${{ secrets.RUNNER_GOTIFY_TOKEN }}"
+          notification_title: "GITEA: Cloudflare Setup @ Rinoa"
+          notification_message: "Cloudflare DNS setup completed successfully."

  pr-merge:
    name: PR Merge
-    needs: [regenerate-readme-modified-services]
+    needs: [generate-service-list, docker-compose-dry-run]
    if: github.ref != 'refs/heads/main'
    runs-on: ubuntu-latest
    steps:
      - name: Checkout
-        uses: actions/checkout@v4
-
-      - name: Cache tea CLI
-        id: cache-tea
-        uses: actions/cache@v4
-        with:
-          path: /opt/hostedtoolcache/tea/${{ env.TEA_VERSION }}/x64
-          key: tea-${{ runner.os }}-${{ env.TEA_VERSION }}
+        uses: actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955 # v4.3.0

      - name: Install tea
-        uses: supplypike/setup-bin@v4
+        uses: supplypike/setup-bin@8e3f88b4f143d9b5c3497f0fc12d45c83c123787 # v4.0.1
        with:
          uri: https://gitea.com/gitea/tea/releases/download/v${{ env.TEA_VERSION }}/tea-${{ env.TEA_VERSION }}-linux-amd64
          name: tea
@@ -383,7 +313,7 @@ jobs:
        run: |
          tea login add \
            --name gitea-rinoa \
-            --url "${{ secrets.RINOA_GITEA_URL }}" \
+            --url "${{ secrets.TREZ_GITEA_URL }}" \
            --user gitea-sonarqube-bot \
            --password "${{ secrets.BOT_GITEA_PASSWORD }}" \
            --token ${{ secrets.BOT_GITEA_TOKEN }}
@@ -408,60 +338,74 @@ jobs:
      - name: Gotify Notification
        uses: eikendev/gotify-action@master
        with:
-          gotify_api_base: '${{ secrets.RINOA_GOTIFY_URL }}'
-          gotify_app_token: '${{ secrets.RINOA_RUNNER_GOTIFY_TOKEN }}'
-          notification_title: 'GITEA: PR Merge Successful'
-          notification_message: 'PR #${{ steps.pr_merge.outputs.pr_index }} merged.'
+          gotify_api_base: "${{ secrets.RUNNER_GOTIFY_URL }}"
+          gotify_app_token: "${{ secrets.RUNNER_GOTIFY_TOKEN }}"
+          notification_title: "GITEA: PR Merge Successful"
+          notification_message: "PR #${{ steps.pr_merge.outputs.pr_index }} merged."

  docker-compose-deploy:
    name: Docker Compose Deployment
    runs-on: ubuntu-latest
    needs: [generate-service-list, docker-compose-dry-run, pr-merge]
    env:
-      VAULT_ADDR: ${{ secrets.RINOA_VAULT_ADDR }}
+      VAULT_ADDR: ${{ secrets.TREZ_VAULT_ADDR }}
      VAULT_TOKEN: ${{ secrets.VAULT_GITEA_TOKEN }}
      DOCKER_HOST: tcp://dockerproxy:2375
      RINOA_REGISTRY_PASSWORD: ${{ secrets.BOT_GITEA_PASSWORD }}
      DOCKER_SVC_LIST: ${{ needs.generate-service-list.outputs.svc_deploy_list }}
    steps:
      - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955 # v4.3.0
        with:
          ref: main

-      - name: Cache Vault install
-        id: cache-vault
-        uses: actions/cache@v4
+      - name: Login to Docker Hub
+        uses: docker/login-action@5e57cd118135c172c3672efd75eb46360885c0ef # v3.6.0
        with:
-          path: /opt/hostedtoolcache/vault/${{ env.HC_VAULT_VERSION }}/x64
-          key: vault-${{ runner.os }}-${{ env.HC_VAULT_VERSION }}
+          username: ${{ secrets.DOCKERHUB_USER }}
+          password: ${{ secrets.DOCKERHUB_PASSWORD }}

-      - name: Install Vault (only if not cached)
-        uses: cpanato/vault-installer@main
+      - name: Login to GitHub Container Registry
+        uses: docker/login-action@5e57cd118135c172c3672efd75eb46360885c0ef # v3.6.0
        with:
-          version: ${{ env.HC_VAULT_VERSION }}
+          registry: ghcr.io
+          username: ${{ secrets.GHCR_USER }}
+          password: ${{ secrets.GHCR_LOGIN_TOKEN }}

-      - name: Login to Gitea Container Registry
-        run: |
-          docker login -u gitea-sonarqube-bot \
-            -p ${RINOA_REGISTRY_PASSWORD} \
-            git.trez.wtf
+      - name: Login to Private Gitea Registry
+        uses: docker/login-action@5e57cd118135c172c3672efd75eb46360885c0ef # v3.6.0
+        with:
+          registry: git.trez.wtf
+          username: ${{ secrets.BOT_GITEA_USER }}
+          password: ${{ secrets.BOT_GITEA_PASSWORD }}

      - name: Gotify Notification
        uses: eikendev/gotify-action@master
        with:
-          gotify_api_base: '${{ secrets.RINOA_GOTIFY_URL }}'
-          gotify_app_token: '${{ secrets.RINOA_RUNNER_GOTIFY_TOKEN }}'
-          notification_title: 'GITEA: Docker Compose Deployment @ Rinoa'
-          notification_message: 'Starting Docker Compose run...'
+          gotify_api_base: "${{ secrets.RUNNER_GOTIFY_URL }}"
+          gotify_app_token: "${{ secrets.RUNNER_GOTIFY_TOKEN }}"
+          notification_title: "GITEA: Docker Compose Deployment @ Rinoa"
+          notification_message: "Starting Docker Compose run..."

-      - name: Generate .env file for deployment
-        run: |
-           vault kv get -format=json rinoa-docker/env | jq -r '.data.data' | jq -r 'keys[] as $k | "\($k)='\''\(.[$k])'\''"' > .env
-           echo ${DOCKER_SVC_LIST}
+      - name: Generate .env from Hashicorp Vault
+        uses: https://git.trez.wtf/Trez/hc-vault-env@main
+        with:
+          HC_VAULT_VERSION: ${{ env.HC_VAULT_VERSION }}
+          HC_VAULT_ADDR: ${{ secrets.TREZ_VAULT_ADDR }}
+          HC_VAULT_USERNAME: ${{ secrets.VAULT_GITEA_USER }}
+          HC_VAULT_PASSWORD: ${{ secrets.VAULT_GITEA_PASSWORD }}
+          HC_VAULT_SECRETS_PATH: rinoa-docker/env
+
+      - name: Pre-pull/build service images in parallel
+        uses: https://git.trez.wtf/Trez/docker-select-image-pull@main
+        env:
+          DOCKER_HOST: tcp://dockerproxy:2375
+        with:
+          services: ${{ env.DOCKER_SVC_LIST }}
+          compose_profile: "rinoa-apps"

      - name: Docker Compose Deployment
-        uses: hoverkraft-tech/compose-action@v2.2.0
+        uses: hoverkraft-tech/compose-action@b716db5b717cb9b81e391fe638e5aceaa2299e43 # v2.4.0
        env:
          DOCKER_HOST: tcp://dockerproxy:2375
        with:
@@ -470,9 +414,10 @@ jobs:
          up-flags: -d --remove-orphans
          down-flags: --dry-run
          compose-flags: --profile rinoa-apps
+          services-log-level: debug

      - name: Docker Compose Healthcheck
-        uses: jaracogmbh/docker-compose-health-check-action@v1.0.0
+        uses: jaracogmbh/docker-compose-health-check-action@973fbdccf7c8e396b652d3501984c8e530a9fa80 # v1.0.0
        with:
          max-retries: 30
          retry-interval: 10
@@ -483,7 +428,7 @@ jobs:
      - name: Gotify Notification
        uses: eikendev/gotify-action@master
        with:
-          gotify_api_base: '${{ secrets.RINOA_GOTIFY_URL }}'
-          gotify_app_token: '${{ secrets.RINOA_RUNNER_GOTIFY_TOKEN }}'
-          notification_title: 'GITEA: Docker Compose Deployment @ Rinoa'
-          notification_message: 'Deployment completed successfully.'
+          gotify_api_base: "${{ secrets.RUNNER_GOTIFY_URL }}"
+          gotify_app_token: "${{ secrets.RUNNER_GOTIFY_TOKEN }}"
+          notification_title: "GITEA: Docker Compose Deployment @ Rinoa"
+          notification_message: "Deployment completed successfully."
@@ -0,0 +1,146 @@
+name: Renovate Image Tag Deployment
+
+on:
+  workflow_dispatch:
+  pull_request:
+    types: [closed]
+    branches:
+      - main
+    paths:
+      - "**/docker-compose.yml"
+
+env:
+  HC_VAULT_VERSION: "1.20.4"
+  VAULT_ADDR: ${{ secrets.TREZ_VAULT_ADDR }}
+  VAULT_TOKEN: ${{ secrets.VAULT_GITEA_TOKEN }}
+
+jobs:
+  deploy:
+    name: Renovate PR Deployment
+    if: |
+      github.event.pull_request.merged == true &&
+      github.event.pull_request.user.login == 'renovate-bot'
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout full repository
+        uses: actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955 # v4.3.0
+        with:
+          fetch-depth: 0 # required so we can access main^1
+
+      - name: Save docker-compose.yml before merge (old)
+        run: |
+          git fetch origin main
+          if git ls-tree -r origin/main^1 --name-only | grep -q '^docker-compose.yml$'; then
+            git show origin/main^1:docker-compose.yml > docker-compose-old.yml
+          else
+            echo "services: {}" > docker-compose-old.yml
+          fi
+
+      - name: Save docker-compose.yml after merge (new)
+        run: |
+          git show origin/main:docker-compose.yml > docker-compose-new.yml
+
+      - name: Detect services with image tag/digest changes
+        id: detect_services
+        run: |
+          set -euo pipefail
+
+          echo "Flattening docker-compose files..."
+          yq eval '... comments=""' docker-compose-old.yml > docker-compose-old-flat.yml
+          yq eval '... comments=""' docker-compose-new.yml > docker-compose-new-flat.yml
+
+          echo "Getting service names..."
+          yq eval '.services | keys | .[]' docker-compose-old-flat.yml | sort > services_old.txt
+          yq eval '.services | keys | .[]' docker-compose-new-flat.yml | sort > services_new.txt
+
+          echo "Checking for image changes..."
+          : > service_changes.txt
+
+          comm -12 services_old.txt services_new.txt | while read service; do
+            old_image=$(yq eval-all --yaml-fix-merge-anchor-to-spec=true ".services[\"$service\"].image // \"\"" docker-compose-old-flat.yml)
+            new_image=$(yq eval-all --yaml-fix-merge-anchor-to-spec=true ".services[\"$service\"].image // \"\"" docker-compose-new-flat.yml)
+
+            if [ "$old_image" != "$new_image" ]; then
+              echo "$service" >> service_changes.txt
+            fi
+          done
+
+          echo "Detected services with changed images:"
+          cat service_changes.txt || true
+
+          # Prepare multiline output for GitHub Actions
+          echo "docker_svc_list<<EOF" >> "$GITHUB_OUTPUT"
+          sort -u service_changes.txt >> "$GITHUB_OUTPUT"
+          echo "EOF" >> "$GITHUB_OUTPUT"
+
+      - name: Stop if no image changes
+        if: steps.detect_services.outputs.docker_svc_list == ''
+        run: |
+          echo "No image tag/digest changes detected. Exiting."
+          exit 1
+
+      - name: Login to Docker Hub
+        uses: docker/login-action@5e57cd118135c172c3672efd75eb46360885c0ef # v3.6.0
+        with:
+          username: ${{ secrets.DOCKERHUB_USER }}
+          password: ${{ secrets.DOCKERHUB_PASSWORD }}
+
+      - name: Login to GitHub Container Registry
+        uses: docker/login-action@5e57cd118135c172c3672efd75eb46360885c0ef # v3.6.0
+        with:
+          registry: ghcr.io
+          username: ${{ secrets.GHCR_USER }}
+          password: ${{ secrets.GHCR_LOGIN_TOKEN }}
+
+      - name: Login to Private Gitea Registry
+        uses: docker/login-action@5e57cd118135c172c3672efd75eb46360885c0ef # v3.6.0
+        with:
+          registry: git.trez.wtf
+          username: ${{ secrets.BOT_GITEA_USER }}
+          password: ${{ secrets.BOT_GITEA_PASSWORD }}
+
+      - name: Gotify Notification (Start)
+        uses: eikendev/gotify-action@master
+        with:
+          gotify_api_base: "${{ secrets.RUNNER_GOTIFY_URL }}"
+          gotify_app_token: "${{ secrets.RUNNER_GOTIFY_TOKEN }}"
+          notification_title: "GITEA: [RENOVATE] Docker Compose Deployment @ Rinoa"
+          notification_message: "Starting Docker Compose run..."
+
+      - name: Generate .env from Hashicorp Vault
+        uses: https://git.trez.wtf/Trez/hc-vault-env@main
+        with:
+          HC_VAULT_VERSION: ${{ env.HC_VAULT_VERSION }}
+          HC_VAULT_ADDR: ${{ secrets.TREZ_VAULT_ADDR }}
+          HC_VAULT_USERNAME: ${{ secrets.VAULT_GITEA_USER }}
+          HC_VAULT_PASSWORD: ${{ secrets.VAULT_GITEA_PASSWORD }}
+          HC_VAULT_SECRETS_PATH: rinoa-docker/env
+
+      - name: Docker Compose Deployment
+        uses: hoverkraft-tech/compose-action@b716db5b717cb9b81e391fe638e5aceaa2299e43 # v2.4.0
+        env:
+          DOCKER_HOST: tcp://dockerproxy:2375
+        with:
+          services: |
+            ${{ steps.detect_services.outputs.docker_svc_list }}
+          up-flags: -d --remove-orphans
+          down-flags: --dry-run
+          services-log-level: debug
+
+      - name: Docker Compose Healthcheck
+        id: health
+        uses: jaracogmbh/docker-compose-health-check-action@973fbdccf7c8e396b652d3501984c8e530a9fa80 # v1.0.0
+        with:
+          max-retries: 30
+          retry-interval: 10
+          compose-file: "docker-compose.yml"
+          skip-exited: "true"
+          skip-no-healthcheck: "true"
+
+      - name: Gotify Notification (Finish)
+        uses: eikendev/gotify-action@master
+        with:
+          gotify_api_base: "${{ secrets.RUNNER_GOTIFY_URL }}"
+          gotify_app_token: "${{ secrets.RUNNER_GOTIFY_TOKEN }}"
+          notification_title: "GITEA: [RENOVATE] Docker Compose Deployment @ Rinoa"
+          notification_message: "Deployment completed successfully."
@@ -1,98 +0,0 @@
-name: Deploy Renovate Updates
-
-on:
-  workflow_run:
-    workflows: ["Check Renovate Updates"]
-    types:
-      - completed
-
-jobs:
-  deploy:
-    runs-on: ubuntu-latest
-    if: >
-      ${{
-        github.event.workflow_run.conclusion == 'success' &&
-        contains(toLower(github.event.workflow_run.head_commit.author.name), 'renovate')
-      }}
-
-    steps:
-      - name: Checkout repository
-        uses: actions/checkout@v4
-        with:
-          fetch-depth: 0  # we need full history to compute merge-base
-
-      - name: Set up Docker
-        uses: docker/setup-buildx-action@v3
-
-      - name: Log in to Docker (if needed)
-        uses: docker/login-action@v2
-        with:
-          username: ${{ secrets.DOCKER_USERNAME }}
-          password: ${{ secrets.DOCKER_PASSWORD }}
-
-      - name: Install yq
-        run: |
-          sudo wget https://github.com/mikefarah/yq/releases/latest/download/yq_linux_amd64 -O /usr/bin/yq
-          sudo chmod +x /usr/bin/yq
-
-      - name: Get modified services including dependencies
-        id: modified_services
-        run: |
-          echo "Finding modified services in docker-compose.yml..."
-
-          # Find merge-base with previous main commit
-          BASE_COMMIT=$(git merge-base HEAD HEAD~1)
-
-          # Extract changed services between merge-base and HEAD
-          CHANGED_SERVICES=$(git diff --name-only $BASE_COMMIT HEAD -- docker-compose.yml \
-            | xargs -r -I{} yq e '.services | keys | .[]' {})
-
-          if [ -z "$CHANGED_SERVICES" ]; then
-            echo "No services changed, skipping."
-            exit 0
-          fi
-
-          declare -A VISITED
-          ALL_DEPLOY=()
-
-          get_deps() {
-            local service=$1
-            if [[ -n "${VISITED[$service]}" ]]; then
-              return
-            fi
-            VISITED[$service]=1
-            ALL_DEPLOY+=("$service")
-
-            # Array style depends_on
-            deps=$(yq e ".services.\"$service\".depends_on[]?" docker-compose.yml 2>/dev/null)
-            for dep in $deps; do
-              get_deps "$dep"
-            done
-
-            # Mapping style depends_on (with condition)
-            deps_map=$(yq e ".services.\"$service\".depends_on | keys[]" docker-compose.yml 2>/dev/null)
-            for dep in $deps_map; do
-              get_deps "$dep"
-            done
-          }
-
-          for svc in $CHANGED_SERVICES; do
-            get_deps "$svc"
-          done
-
-          echo "Services to deploy: ${ALL_DEPLOY[@]}"
-          echo "modified_services=${ALL_DEPLOY[@]}" >> $GITHUB_ENV
-
-      - name: Pull images for modified services
-        if: env.modified_services != ''
-        run: |
-          echo "Pulling images for services: $modified_services"
-          for svc in $modified_services; do
-            docker compose pull $svc || echo "Failed to pull $svc, continuing..."
-          done
-
-      - name: Deploy updated services
-        if: env.modified_services != ''
-        run: |
-          echo "Deploying services: $modified_services"
-          docker compose up -d $modified_services
@@ -0,0 +1,33 @@
+name: Renovate
+
+on:
+  schedule:
+    - cron: "0/30 * * * *"
+  workflow_dispatch:
+
+env:
+  RENOVATE_VERSION: "41.138.5"
+
+jobs:
+  renovate:
+    runs-on: ubuntu-latest
+    timeout-minutes: 5
+    steps:
+      - name: Checkout
+        uses: actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955 # v4.3.0
+
+      - name: Renovate Run
+        env:
+          DOCKER_HOST: tcp://dockerproxy:2375
+        run: |
+          docker run --rm \
+            -e RENOVATE_PLATFORM=gitea \
+            -e RENOVATE_ENDPOINT=https://git.trez.wtf/api/v1 \
+            -e RENOVATE_TOKEN=${{ secrets.RENOVATE_BOT_TOKEN }} \
+            -e LOG_LEVEL=${{ vars.RENOVATE_LOG_LEVEL }} \
+            -e RENOVATE_GITHUB_COM_TOKEN=${{ secrets.RENOVATE_GITHUB_TOKEN }} \
+            -e RENOVATE_CONFIG_FILE=renovate.json \
+            -e RENOVATE_REPOSITORIES=trez/rinoa-docker \
+            --volumes-from ${{ env.JOB_CONTAINER_NAME }} \
+            -w ${GITHUB_WORKSPACE} \
+            renovate/renovate:${{ env.RENOVATE_VERSION }}-full
@@ -0,0 +1 @@
+2025-10-08T06-54-08
@@ -4,204 +4,202 @@

 | Service | Image | Description |
 | --- | --- | --- |
-| 13ft | ghcr.io/wasi-master/13ft:latest | Web interface for blocking ads and paywalls |
-| actual_server | docker.io/actualbudget/actual-server:latest | Privacy-focused app for managing finances |
-| adguard | adguard/adguardhome:v0.107.65 | Ad-blocking/DNS |
-| apcupsd-cgi | bnhf/apcupsd-cgi:latest | Web interface for apcupsd |
-| apprise-api | lscr.io/linuxserver/apprise-api:latest | Multi-channel notification API |
-| archivebox | archivebox/archivebox:latest | Open-source and self-hosted web archiving |
-| asciinema | ghcr.io/asciinema/asciinema-server:latest | Platform for hosting and sharing terminal session recordings |
-| asciinema-pg-db | postgres:14-alpine |  |
-| audiobookshelf | ghcr.io/advplyr/audiobookshelf:latest | Podcasts, eBooks, & Audiobooks |
-| authelia | authelia/authelia:master | Authentication/authorization server with MFA & SSO |
-| authelia-pg | postgres:16-alpine |  |
-| authelia-valkey | docker.io/bitnami/valkey:latest |  |
-| bazarr | lscr.io/linuxserver/bazarr:latest | Subtitle automation for TV shows/movies |
-| beszel | henrygd/beszel:latest | Lightweight server monitoring hub |
-| beszel-agent | henrygd/beszel-agent:latest |  |
-| bitwarden | vaultwarden/server:latest | Credential/Information Vault |
-| bluesky-pds | code.modernleft.org/gravityfargo/bluesky-pds:v0.4.98 |  |
-| browserless | ghcr.io/browserless/chromium:latest |  |
-| bytestash | ghcr.io/jordan-dalby/bytestash:latest | Code Gists/Snippets |
-| castopod | castopod/castopod:latest | Podcast self-hosting |
-| castopod-valkey | docker.io/bitnami/valkey:latest |  |
-| changedetection | ghcr.io/dgtlmoon/changedetection.io | Page change monitoring with alerts |
-| changedetection-chrome | dgtlmoon/sockpuppetbrowser:latest |  |
-| chrome | gcr.io/zenika-hub/alpine-chrome:123 |  |
-| clipcascade | sathvikrao/clipcascade:latest | Online file converter |
-| cloudflareddns | ghcr.io/hotio/cloudflareddns:latest |  |
-| convertx | ghcr.io/c4illin/convertx | Online file converter |
-| crowdsec | crowdsecurity/crowdsec:latest |  |
-| crowdsec-dashboard | metabase/metabase | Real-time & crowdsourced protection against aggressive IPs |
-| cyber-chef | mpepping/cyberchef:latest | Web app for encryption, encoding, compression, and data analysis |
-| czkawka | jlesage/czkawka | Smart file management |
-| dagu | ghcr.io/dagu-org/dagu:alpine | Cron alternative with a web UI |
-| dawarich-app | freikin/dawarich:latest | Self-hosted alternative to Google Location History |
-| dawarich-pg-db | postgis/postgis:17-3.5-alpine |  |
-| dawarich-sidekiq | freikin/dawarich:latest |  |
-| dawarich-valkey | docker.io/bitnami/valkey:latest |  |
-| dead-man-hand | ghcr.io/bkupidura/dead-man-hand:latest |  |
-| docker-socket-proxy | ghcr.io/tecnativa/docker-socket-proxy:latest |  |
-| dockflare | alplat/dockflare:stable | Cloudflare Tunnel controller |
-| dockpeek | ghcr.io/dockpeek/dockpeek:v1.5.8 | Real-time port monitoring and discovery |
-| duplicati | lscr.io/linuxserver/duplicati:latest | Data backup |
-| easyappointments | alextselegidis/easyappointments:1.5.2 | Highly customizable appointment scheduler |
-| excalidraw | excalidraw/excalidraw:latest | Virtual whiteboard for sketching hand-drawn like diagrams |
-| explo | ghcr.io/lumepart/explo:latest |  |
-| fastenhealth | ghcr.io/fastenhealth/fasten-onprem:main | Open-source, self-hosted, personal/family electronic medical record aggregator |
-| flaresolverr | ghcr.io/flaresolverr/flaresolverr:latest |  |
-| garage | dxflrs/garage:v2.0.0 |  |
-| garage-webui | khairul169/garage-webui:latest | S3-compatible storage backend |
-| ghost | ghost:latest | Personal blog |
-| gitea | gitea/gitea:1.24.5 | Private Code Repo |
-| gitea-db | postgres:14 |  |
-| gitea-runner | gitea/act_runner:latest |  |
-| gitea-sonarqube-bot | justusbunsi/gitea-sonarqube-bot:v0.4.0 |  |
-| gitignore-io | guog/gitignore.io:latest | .gitignore generator |
-| gluetun | qmcgaw/gluetun:latest |  |
-| gotify | gotify/server | Notification System |
-| guacamole | flcontainers/guacamole:latest | Client-less remote desktop gateway |
-| homepage | ghcr.io/gethomepage/homepage:latest |  |
-| hugo | hugomods/hugo:exts | Static site |
-| immich-server | ghcr.io/immich-app/immich-server:release | High performance self-hosted photo and video management solution |
-| immich-machine-learning | ghcr.io/immich-app/immich-machine-learning:release |  |
-| immich-pg-db | tensorchord/pgvecto-rs:pg14-v0.2.1 |  |
-| immich-public-proxy | alangrainger/immich-public-proxy:latest | Immich Proxy for public sharing |
-| immich-power-tools | ghcr.io/varun-raj/immich-power-tools:latest |  |
-| immich-valkey | docker.io/bitnami/valkey:latest |  |
-| influxdb2 | influxdb:2-alpine | Scalable datastore for metrics, events, and real-time analytics |
-| invidious | quay.io/invidious/invidious:latest | Alternative YouTube frontend (privacy-focused, ad-blocking) |
-| invidious-sig-helper | quay.io/invidious/inv-sig-helper:latest |  |
-| invidious-db | docker.io/library/postgres:14 |  |
-| invoice-ninja | invoiceninja/invoiceninja-debian:5 |  |
-| invoice-ninja_proxy | nginx | Simple invoicing, multiple payment options, expense and vendor management, and more! |
-| it-tools | ghcr.io/corentinth/it-tools:latest | Useful tools for developers and people working in IT |
-| jellyfin | jellyfin/jellyfin | Movie/TV Streaming |
-| jitsi-etherpad | etherpad/etherpad:1.9.7 |  |
+| 13ft | ghcr.io/wasi-master/13ft:latest@sha256:563ce7794a7173250c25c9162495bf2f510dd714067d74363c9ab2bd0e5a994f | Web interface for blocking ads and paywalls |
+| actual_server | docker.io/actualbudget/actual-server:latest@sha256:32dceb536149fcfe6e5292a6a568403c363e9fd59a41596da002b994a0b2216e | Privacy-focused app for managing finances |
+| adguard | adguard/adguardhome:v0.107.67@sha256:927dc14b3e3cbd359e84658914590270a77d54446a6565e9498bef3444c286a4 | Ad-blocking/DNS |
+| apcupsd-cgi | bnhf/apcupsd-cgi:latest@sha256:e8733930739719aca608fd97aecfb0aa5f53aaf7681bf4bbccd49dbf67132bf8 | Web interface for apcupsd |
+| apprise-api | lscr.io/linuxserver/apprise-api:latest@sha256:31fc75e049546a808fb287af2d26b934c6417d1961c739e8fb583066de99bfca | Multi-channel notification API |
+| archivebox | archivebox/archivebox:latest@sha256:fdf2936192aa1e909b0c3f286f60174efa24078555be4b6b90a07f2cef1d4909 | Open-source and self-hosted web archiving |
+| asciinema | ghcr.io/asciinema/asciinema-server:latest@sha256:8da830a6eb0b6715becf31b2495877aa5d661674f29c52a3a3363110847c5598 | Platform for hosting and sharing terminal session recordings |
+| asciinema-pg-db | postgres:14-alpine@sha256:49f7dcce1efddd8d86ae3f37dcba206b5655d9fac3d3872d2823177fd6c1e7fa |  |
+| audiobookshelf | ghcr.io/advplyr/audiobookshelf:latest@sha256:dd4a3079d26bfe9f0ea63de3e3eff483dfa25fef05ef850a5a9d121dca3794b2 | Podcasts, eBooks, & Audiobooks |
+| authelia | authelia/authelia:master@sha256:e9fb691f9d835d79cd56d7250224780341f43531006f1ed9e12bf021e8d47552 | Authentication/authorization server with MFA & SSO |
+| authelia-pg | postgres:16-alpine@sha256:84fb5d5bdd7d47f1889f325e534f3ce643f853f460832c8a61949f5391b8dc42 |  |
+| authelia-valkey | docker.io/valkey/valkey:8-alpine@sha256:e706d1213aaba6896c162bb6a3a9e1894e1a435f28f8f856d14fab2e10aa098b |  |
+| bazarr | lscr.io/linuxserver/bazarr:latest@sha256:005f97fcab0fd7402cd7ff3c09f5ff4da4c63ca51be487e90d5c4dc8a8f85a45 | Subtitle automation for TV shows/movies |
+| beszel | henrygd/beszel:latest@sha256:a019a9f05ba6b16d2f990ed21cedab99741ae408ec22eef2fb84be3a16640d33 | Lightweight server monitoring hub |
+| beszel-agent | henrygd/beszel-agent:latest@sha256:17fe8c1bf093bc65fba8808093de6b3a3a8ed915bc59eef9815ea42c889aab6a |  |
+| bitwarden | vaultwarden/server:latest@sha256:84fd8a47f58d79a1ad824c27be0a9492750c0fa5216b35c749863093bfa3c3d7 | Credential/Information Vault |
+| bluesky-pds | code.modernleft.org/gravityfargo/bluesky-pds:v0.4.158@sha256:44810dc5cf9c78135d20dfd60e0999e2db0dfc5fd56dc7e45e8844d1b57c54bd |  |
+| browserless | ghcr.io/browserless/chromium:latest@sha256:ef2affc38cd47b23e62851e8be3644a97a485faa0de899ffbd74e1c3883e88b4 |  |
+| bytestash | ghcr.io/jordan-dalby/bytestash:latest@sha256:9c17b5510ca45c976fe23b0d4705ad416aa58d4bf756a70e03ef1f08cf7801fd | Code Gists/Snippets |
+| castopod | castopod/castopod:latest@sha256:e59262a89b035d1cb7decd7dcc387670c5ba81e31b67c7e0e89ef827d7f58ea9 | Podcast self-hosting |
+| castopod-valkey | docker.io/valkey/valkey:8-alpine@sha256:e706d1213aaba6896c162bb6a3a9e1894e1a435f28f8f856d14fab2e10aa098b |  |
+| changedetection | ghcr.io/dgtlmoon/changedetection.io@sha256:d924bacc4640cfe2dbffcdbb221caa740d00dd6e24fa6877ea6b797d8cd29f99 | Page change monitoring with alerts |
+| changedetection-chrome | dgtlmoon/sockpuppetbrowser:latest@sha256:9f2df6791a4cd9b2c3138cb62b5a8de7f27953cab84729fe09d28cbd341a8973 |  |
+| chrome | gcr.io/zenika-hub/alpine-chrome:123@sha256:e38563d4475a3d791e986500a2e4125c9afd13798067138881cf770b1f6f3980 |  |
+| clipcascade | sathvikrao/clipcascade:latest@sha256:0f7aadec03af6b22a157466ade3ed1730dfd3b390d2989e55c0180e1d12d736f | Online file converter |
+| cloudflareddns | ghcr.io/hotio/cloudflareddns:latest@sha256:5c3d73dec0b80e712ac3fefa660f403875e78ba643fd97563fc39531e403e281 |  |
+| convertx | ghcr.io/c4illin/convertx@sha256:346589f154332997329fdc888417d4b24c49cc9140eab80e637a68cfbdd8041b | Online file converter |
+| crowdsec | crowdsecurity/crowdsec:latest@sha256:26841bec239f53c74f5ac35ca89166b0566c511a449c4852d3187c8a62faf4ed |  |
+| crowdsec-dashboard | metabase/metabase@sha256:f8a99822a7d3e2ee0874412b1835c99996addeb2101a183de7b6d55e5f6018cb | Real-time & crowdsourced protection against aggressive IPs |
+| cyber-chef | mpepping/cyberchef:latest@sha256:1772a04fd261f971da89cf6212147afe55a37b4a93421db928a78e01de3d65ea | Web app for encryption, encoding, compression, and data analysis |
+| czkawka | jlesage/czkawka@sha256:03109f40d1bc41ebe24c2fd3ee81429950338591bbb64c4cf39ec6160fee75a4 | Smart file management |
+| dagu | ghcr.io/dagu-org/dagu:alpine@sha256:da97d58fde48b39aa9a5456b3fafeb8f05691c6925922d2d89b9a87514c36638 | Cron alternative with a web UI |
+| dawarich-app | freikin/dawarich:latest@sha256:ca06ad58ac7a26d30cd26d84242f12ac0b27227c2c095a0d03c0d167e9cb909a | Self-hosted alternative to Google Location History |
+| dawarich-pg-db | postgis/postgis:17-3.5-alpine@sha256:b5316941603622f8c10ccff770885cd3adf940555cb8f65b0e3d9c9040722492 |  |
+| dawarich-sidekiq | freikin/dawarich:latest@sha256:ca06ad58ac7a26d30cd26d84242f12ac0b27227c2c095a0d03c0d167e9cb909a |  |
+| dawarich-valkey | docker.io/valkey/valkey:8-alpine@sha256:e706d1213aaba6896c162bb6a3a9e1894e1a435f28f8f856d14fab2e10aa098b |  |
+| dead-man-hand | ghcr.io/bkupidura/dead-man-hand:latest@sha256:31905f19678f60d55ecdfa63dad009c07e2055cb5db0c608c8cab5de4467050e |  |
+| docker-socket-proxy | ghcr.io/tecnativa/docker-socket-proxy:latest@sha256:3400c429c5f9e1b21d62130fb93b16e2e772d4fb7695bd52fc2b743800b9fe9e |  |
+| dockflare | alplat/dockflare:stable@sha256:f37b8b0080a7ee9a448b5c34ce2043ec71e9378ae92736487ec8e6b6ce69bdba | Cloudflare Tunnel controller |
+| dockpeek | ghcr.io/dockpeek/dockpeek:v1.6.5@sha256:6807298f51c5eedf34c6f44dc7cbdaecd6bd2d789cea9f50489d0786539abd4c | Real-time port monitoring and discovery |
+| duplicati | lscr.io/linuxserver/duplicati:latest@sha256:6f9d58c8183dcfee25f0a36077b14ef278f06e51c47aa4d44c51f1d5360f44a9 | Data backup |
+| easyappointments | alextselegidis/easyappointments:1.5.2@sha256:484f183a7f5bcc9c0486674de4af01c785ab73fc2ee962dc35db7d0ba69d2825 | Highly customizable appointment scheduler |
+| excalidraw | excalidraw/excalidraw:latest@sha256:b5b9454af5f9c4403ea3b8ef06f2a3e29ac68e79e7d457f373f4d4a4b603d4bc | Virtual whiteboard for sketching hand-drawn like diagrams |
+| explo | ghcr.io/lumepart/explo:latest@sha256:2c6fe1e5fbe0ceb17c653191001e7cb96eff0ae82539b44f61b024caa0fbfd14 |  |
+| fastenhealth | ghcr.io/fastenhealth/fasten-onprem:main@sha256:992a3fe0096500475cc29f5a83234481a6079652d064bc6e2c4e660860af7fba | Open-source, self-hosted, personal/family electronic medical record aggregator |
+| flaresolverr | ghcr.io/flaresolverr/flaresolverr:latest@sha256:5379a9209c86870558d77c8cdf7efdf300aecf0447617a05dc77e0491d53f34c |  |
+| garage | dxflrs/garage:v2.1.0@sha256:4c9b34c113e61358466e83fd6e7d66e6d18657ede14b776eb78a93ee8da7cf6a |  |
+| garage-webui | khairul169/garage-webui:latest@sha256:17c793551873155065bf9a022dabcde874de808a1f26e648d4b82e168806439c | S3-compatible storage backend |
+| ghost | ghost:latest@sha256:ffc213a6f2db7210b69396dc4330b4a9c5e27c8b044ae453854d53bd3937a6ec | Personal blog |
+| gitea | gitea/gitea:1.24.6@sha256:2edc102cbb636ae1ddac5fa0c715aa5b03079dee13ac6800b2cef6d4e912e718 | Private Code Repo |
+| gitea-db | postgres:14@sha256:fbd63b8e1eb2b318d342e8ad279891f622aa5ff69bd95e5683cc915301218bcf |  |
+| gitea-runner | gitea/act_runner:latest@sha256:8477d5b61b655caad4449888bae39f1f34bebd27db56cb15a62dccb3dcf3a944 |  |
+| gitea-sonarqube-bot | justusbunsi/gitea-sonarqube-bot:v0.4.0@sha256:18dd43b470d9a470e27d5999dd7dcbb44423d5c4466ae56dd7c1722f23115673 |  |
+| gitignore-io | guog/gitignore.io:latest@sha256:27b0bc3e9eb81adaee39fb6f77169ea9cbef164bcab049d29bcab68d154013ad | .gitignore generator |
+| gluetun | qmcgaw/gluetun:latest@sha256:9b429a254a359f7553b0260e2f194901a1fd6fc4ac09f0749c7de6620cb11b1a |  |
+| gotify | gotify/server@sha256:2ae0e4e689f183137c8247884382fcb174d5a72253ce1897e7e5267090093fc8 | Notification System |
+| guacamole | flcontainers/guacamole:latest@sha256:81a420f386ef8cbb4697208e13ea90f6a10a54619981241bed672e4a41b5f77f | Client-less remote desktop gateway |
+| homepage | ghcr.io/gethomepage/homepage:latest@sha256:e7fc26f914cf5e7dcd6c566e24ca218addb879aa76478ad4a553b1f9ae48b1d7 |  |
+| hugo | hugomods/hugo:exts@sha256:89c0472bdfc5f9ff051ae9f54942428c62edb1d2ec3527bf1a4e63e24aa48356 | Static site |
+| immich-server | ghcr.io/immich-app/immich-server:release@sha256:8286638680f0a38a7cb380be64ed77d1d1cfe6d0e0b843f64bff92b24289078d | High performance self-hosted photo and video management solution |
+| immich-machine-learning | ghcr.io/immich-app/immich-machine-learning:release@sha256:45626a33361ef7ed361de41b0d2dc19e5949442cdf0a8eb64b157dc8a04e9855 |  |
+| immich-pg-db | tensorchord/pgvecto-rs:pg14-v0.2.1@sha256:9172feae86a211bc502db4ec2d3309a57329060b031d91796d39f45d1d698ef3 |  |
+| immich-public-proxy | alangrainger/immich-public-proxy:latest@sha256:bf9ae2b60f9cd69867789a2a492510443aa61cf01ab085475a08496ef35e67d0 | Immich Proxy for public sharing |
+| immich-power-tools | ghcr.io/varun-raj/immich-power-tools:latest@sha256:abfe87c08d6c08575649d7f4af04bd61ab2e5d3d54bdba693700595f70c92d0a |  |
+| immich-valkey | docker.io/valkey/valkey:8-alpine@sha256:e706d1213aaba6896c162bb6a3a9e1894e1a435f28f8f856d14fab2e10aa098b |  |
+| influxdb2 | influxdb:2-alpine@sha256:fa166d3bdf6beeecf57791b70e558f6ef54e1e6cea95fb7728b45314bc48543b | Scalable datastore for metrics, events, and real-time analytics |
+| invidious | quay.io/invidious/invidious:latest@sha256:2836b5b8226a53a9cc2afdbd5f5fe6bccdd200f2e17cd92a828b4dc8d8b5cc06 | Alternative YouTube frontend (privacy-focused, ad-blocking) |
+| invidious-companion | quay.io/invidious/invidious-companion:latest@sha256:62e5ec92802bc6da3e7ca6f39879d869e20d065c5c6d9cfa8ec2296057c48a3d |  |
+| invidious-db | docker.io/library/postgres:14@sha256:fbd63b8e1eb2b318d342e8ad279891f622aa5ff69bd95e5683cc915301218bcf |  |
+| invoice-ninja | invoiceninja/invoiceninja-debian:5@sha256:5505dffeb378e4ea926c761177025881f251b049dc1dba15af3384e5ca5568b4 |  |
+| invoice-ninja_proxy | nginx@sha256:f79cde317d4d172a392978344034eed6dff5728a8e6d7a42f507504c23ecf8b8 | Simple invoicing, multiple payment options, expense and vendor management, and more! |
+| it-tools | ghcr.io/corentinth/it-tools:latest@sha256:8b8128748339583ca951af03dfe02a9a4d7363f61a216226fc28030731a5a61f | Useful tools for developers and people working in IT |
+| jellyfin | jellyfin/jellyfin@sha256:7ae36aab93ef9b6aaff02b37f8bb23df84bb2d7a3f6054ec8fc466072a648ce2 | Movie/TV Streaming |
+| jitsi-etherpad | etherpad/etherpad:1.9.7@sha256:d1d6a772dd49e2d920fda874cdae2d4a43f24ba5713a1e330b6342fbab3eb5ec |  |
 | jitsi-jibri | jitsi/jibri:stable |  |
 | jitsi-jicofo | jitsi/jicofo:stable |  |
 | jitsi-jigasi | jitsi/jigasi:stable |  |
 | jitsi-jvb | jitsi/jvb:stable |  |
 | jitsi-prosody | jitsi/prosody:stable |  |
 | jitsi-web | jitsi/web:stable | Web Conferencing |
-| joplin-db | postgres:17-alpine |  |
-| joplin | joplin/server:latest | Open-source note taking & to-do |
-| karakeep | ghcr.io/karakeep-app/karakeep:release | Self-hosted bookmark-everything app with a touch of AI for data hoarders |
-| languagetool | elestio/languagetool:latest |  |
-| libretranslate | libretranslate/libretranslate | Open-source machine translation API |
-| lidarr | lscr.io/linuxserver/lidarr:latest | Music Automation |
-| lidify | thewicklowwolf/lidify:latest | Music Discovery a la Last.fm, Spotify, Pandora, etc. |
-| linkstack | linkstackorg/linkstack:latest | Personal profile |
-| lldap | lldap/lldap:stable | LDAP made easy |
-| loggifly | ghcr.io/clemcer/loggifly:latest |  |
-| maloja | krateng/maloja:latest | Simple self-hosted music scrobble database to create personal listening statistics |
-| manyfold | lscr.io/linuxserver/manyfold:latest | Self-hosted digital asset manager for 3D print files |
-| manyfold-valkey | docker.io/bitnami/valkey:latest |  |
-| mariadb | linuxserver/mariadb |  |
-| mastodon | lscr.io/linuxserver/mastodon:latest | Open-source social network |
-| mastodon-pg-db | postgres:17-alpine |  |
-| mastodon-valkey | docker.io/bitnami/valkey:latest |  |
-| maxun-backend | getmaxun/maxun-backend:latest |  |
-| maxun-frontend | getmaxun/maxun-frontend:latest | No-code web data extraction platform |
-| maxun-pg-db | postgres:13-alpine |  |
-| maxun-valkey | docker.io/bitnami/valkey:latest |  |
-| meilisearch | getmeili/meilisearch:v1.15 |  |
-| meme-search-pro | ghcr.io/neonwatty/meme_search_pro:latest | Meme search engine built with Python and Ruby |
-| meme-search-pro-img2txt-gen | ghcr.io/neonwatty/image_to_text_generator:latest |  |
-| meme-search-db | pgvector/pgvector:pg17 |  |
-| mini-qr | ghcr.io/lyqht/mini-qr:latest | Scan and generate customized QR codes easily |
-| minio | minio/minio:RELEASE.2025-04-22T22-12-26Z | S3-compatible storage backend |
-| mixpost | inovector/mixpost:latest | Multi-channel social media manager |
-| mixpost-valkey | docker.io/bitnami/valkey:latest |  |
-| mongodb | bitnami/mongodb:7.0 |  |
-| multi-scrobbler | foxxmd/multi-scrobbler | JS App for scrobbling/recording play history from/to multiple sources |
-| n8n | docker.n8n.io/n8nio/n8n | Extendable workflow automation tool to easily automate tasks |
-| navidrome | deluan/navidrome:latest | Music Streaming |
-| netalertx | jokobsk/netalertx:latest | Network Monitoring |
-| nextcloud | nextcloud/all-in-one:latest | Private Cloud |
-| nocodb | nocodb/nocodb:latest | Turn any SQL-based database into a smart spreadsheet |
-| nocodb-pg-db | postgres:16-alpine |  |
-| nocodb-valkey | docker.io/bitnami/valkey:latest |  |
-| ollama | ollama/ollama:latest |  |
-| ombi | lscr.io/linuxserver/ombi:latest | Media Requests |
-| omnitools | iib0011/omni-tools:latest | Tools for common tasks |
-| omnipoly | kweg/omnipoly:latest | Open-source language translation with LanguageTool, LibreTranslate, & Ollama |
-| open-webui | ghcr.io/open-webui/open-webui:main | User-friendly and extensible AI interface |
-| open-webui-valkey | docker.io/bitnami/valkey:latest |  |
-| paperless-ngx | ghcr.io/paperless-ngx/paperless-ngx:latest | Document indexer & archiver with OCR |
-| paperless-valkey | docker.io/bitnami/valkey:latest |  |
-| penpot-frontend | penpotapp/frontend:latest | Open-source design and prototyping platform |
-| penpot-backend | penpotapp/backend:latest |  |
-| penpot-exporter | penpotapp/exporter:latest |  |
-| penpot-pg-db | postgres:15-alpine |  |
-| penpot-redis | redis:7.2 |  |
-| pgbackweb | eduardolat/pgbackweb:latest | Backups for PostgreSQL |
-| pgbackweb-db | postgres:17-alpine |  |
-| planka | ghcr.io/plankanban/planka:2.0.0-rc.3 | Kanban board |
-| planka-pg-db | postgres:16-alpine |  |
-| plant-it | msdeluise/plant-it-server:latest | 🪴 Self-hosted, open source gardening companion app |
-| plant-it-valkey | docker.io/bitnami/valkey:latest |  |
-| plantuml-server | plantuml/plantuml-server:jetty |  |
-| portainer | portainer/portainer-ce:alpine | Service delivery platform for containerized applications |
-| portchecker-web | ghcr.io/dsgnr/portcheckerio-web:latest | Service delivery platform for containerized applications |
-| portchecker-api | ghcr.io/dsgnr/portcheckerio-api:latest |  |
-| postal-smtp | ghcr.io/postalserver/postal:latest |  |
-| postal-web | ghcr.io/postalserver/postal:latest | OSS Mail delivery platform |
-| postal-worker | ghcr.io/postalserver/postal:latest |  |
-| protonmail-bridge | shenxn/protonmail-bridge |  |
-| prowlarr | lscr.io/linuxserver/prowlarr:latest | Index aggregator |
-| qbit-manage | ghcr.io/stuffanthings/qbit_manage:latest |  |
-| qbittorrentvpn | ghcr.io/binhex/arch-qbittorrentvpn:latest | Fast and stable torrent client |
-| radarec | thewicklowwolf/radarec:latest | Movie discovery based on library/tastes |
-| radarr | lscr.io/linuxserver/radarr:latest | Movie Automation |
-| reactive-resume | amruthpillai/reactive-resume:latest | Open-source resume builder |
-| reactive-resume-pg | postgres:16-alpine |  |
-| readarr | lscr.io/linuxserver/readarr:develop | eBook/Audiobook Automation |
-| redlib | quay.io/redlib/redlib:latest | Redlib is a private front-end like Invidious but for Reddit |
-| renovate | renovate/renovate:41.97.7-full |  |
-| renovate-valkey | docker.io/bitnami/valkey:latest |  |
+| joplin-db | postgres:17-alpine@sha256:5d14c08a257610d8e27c52ce0f10de5d9cce4c232e1277d44d7d6fb628b3d1a7 |  |
+| joplin | joplin/server:latest@sha256:95b67dc6a4e77a974ac2bcc86818cbbfe5495e7b62d06a66f848a877878dce53 | Open-source note taking & to-do |
+| karakeep | ghcr.io/karakeep-app/karakeep:release@sha256:abd7d6b11b1b8fa3593d1971f886a74850ba8d6a99291218b150207d5a60378e | Self-hosted bookmark-everything app with a touch of AI for data hoarders |
+| languagetool | elestio/languagetool:latest@sha256:85a32bdef9e7d87125977a201bfe7aa4310e67cab8abfa370157a9fc67cda4cd |  |
+| libretranslate | libretranslate/libretranslate@sha256:3727db3ce8224fb6afddd5227739ac6e58f060bcc59f12ae24a351dba47dd4f6 | Open-source machine translation API |
+| lidarr | lscr.io/linuxserver/lidarr:latest@sha256:e9ab17c7d4738a735a50b6e8f129d09a4166081f33b140d5d93177b2b12b069d | Music Automation |
+| lidify | thewicklowwolf/lidify:latest@sha256:958eaddeef8195470b974ee03512d9a5c31ad2af3167f7824448fb026fa9c94a | Music Discovery a la Last.fm, Spotify, Pandora, etc. |
+| linkstack | linkstackorg/linkstack:latest@sha256:abd691b4293b020a317de8794737671e0315159efcb868e8a4124d6f0611f7ae | Personal profile |
+| lldap | lldap/lldap:stable@sha256:9e605a66c02514bfcffd1b67cafb1e98d50992216bb2871d7ae44622047dd09d | LDAP made easy |
+| loggifly | ghcr.io/clemcer/loggifly:latest@sha256:cf1968ac30dc34dd85a8358a48d0f9bb959cbbfe6b3beef6e7732ab703518812 |  |
+| maloja | krateng/maloja:latest@sha256:4ecea26058d2ca5168a8d53820279942d28f0606664cea6425f42371d5d88f95 | Simple self-hosted music scrobble database to create personal listening statistics |
+| manyfold | lscr.io/linuxserver/manyfold:latest@sha256:b8f40d6f0b4bdd59d13d97c97c21d1e24b0276c8c4b8341855d2ca50bc9df25e | Self-hosted digital asset manager for 3D print files |
+| manyfold-valkey | docker.io/valkey/valkey:8-alpine@sha256:e706d1213aaba6896c162bb6a3a9e1894e1a435f28f8f856d14fab2e10aa098b |  |
+| mariadb | linuxserver/mariadb@sha256:caa3b6d9165a7bd44f7247dbb703aa8bc99988dea469983b73397f3cc0adb6ea |  |
+| mastodon | lscr.io/linuxserver/mastodon:latest@sha256:9cd791ad033e9a3c4bc8ab191b2b56d80c07b72fe632f8b2e215888eba22009e | Open-source social network |
+| mastodon-pg-db | postgres:17-alpine@sha256:5d14c08a257610d8e27c52ce0f10de5d9cce4c232e1277d44d7d6fb628b3d1a7 |  |
+| mastodon-valkey | docker.io/valkey/valkey:8-alpine@sha256:e706d1213aaba6896c162bb6a3a9e1894e1a435f28f8f856d14fab2e10aa098b |  |
+| maxun-backend | getmaxun/maxun-backend:latest@sha256:a5a5df99e2f5aed1838336b0b4aa75c083b949da96c8e1b3a2820b8cf44b459c |  |
+| maxun-frontend | getmaxun/maxun-frontend:latest@sha256:e5c889a2b8176646f0dc25662d6eb29e5b7b507b90c4250b0d18e3598b4636c5 | No-code web data extraction platform |
+| maxun-pg-db | postgres:17-alpine@sha256:5d14c08a257610d8e27c52ce0f10de5d9cce4c232e1277d44d7d6fb628b3d1a7 |  |
+| maxun-valkey | docker.io/valkey/valkey:8-alpine@sha256:e706d1213aaba6896c162bb6a3a9e1894e1a435f28f8f856d14fab2e10aa098b |  |
+| meilisearch | getmeili/meilisearch:v1.22@sha256:14ef9f50add5243fb8dfd13b60df82a76f3c653f0f03b8fee7b5464ab2f0f303 |  |
+| meme-search-pro | ghcr.io/neonwatty/meme_search_pro:latest@sha256:bf3c20a6a0407ffa594d3e2fe8611073c0499659c90f44a28decd5e701e9e1f6 | Meme search engine built with Python and Ruby |
+| meme-search-pro-img2txt-gen | ghcr.io/neonwatty/image_to_text_generator:latest@sha256:e8445afab38e2eae1fcb95101dd26cf66708ef72127b291cab748050b4700cb8 |  |
+| meme-search-db | pgvector/pgvector:pg17@sha256:9ae02a756ba16a2d69dd78058e25915e36e189bb36ddf01ceae86390d7ed786a |  |
+| mini-qr | ghcr.io/lyqht/mini-qr:latest@sha256:af6b47968cb2c400d701eb3f6defe06c79a75a2af7a423bf272df3e3ccbbacd8 | Scan and generate customized QR codes easily |
+| minio | minio/minio:RELEASE.2025-04-22T22-12-26Z@sha256:a1ea29fa28355559ef137d71fc570e508a214ec84ff8083e39bc5428980b015e | S3-compatible storage backend |
+| mixpost | inovector/mixpost:latest@sha256:088a0eed84289e9a408294acea969c1eebf80dff803d165629fe20c3442b0f8c | Multi-channel social media manager |
+| mixpost-valkey | docker.io/valkey/valkey:8-alpine@sha256:e706d1213aaba6896c162bb6a3a9e1894e1a435f28f8f856d14fab2e10aa098b |  |
+| mgob | stefanprodan/mgob@sha256:d089c6d105d7d0f9db5222786cb93d85b1bf61e28b21ad717cea90f92570c8f3 | Headless Automated MongoDB Backups |
+| mongodb | mongo:7@sha256:062ee16916ad234f6a4e276e8905e22803c206c2e0711c3f90aec722bf641aa6 |  |
+| multi-scrobbler | foxxmd/multi-scrobbler@sha256:e23ddda129ea2a8e9a009ef73d62af910ac25e6213c833680886b7002c5bb6fa | JS App for scrobbling/recording play history from/to multiple sources |
+| n8n | docker.n8n.io/n8nio/n8n@sha256:4da14e676858f0e7eb0fc08e49ca8902447987d00a52343917153464289400c1 | Extendable workflow automation tool to easily automate tasks |
+| navidrome | deluan/navidrome:latest@sha256:2ae037d464de9f802d047165a13b1c9dc2bdbb14920a317ae4aef1233adc0a3c | Music Streaming |
+| netalertx | jokobsk/netalertx:latest@sha256:9304e29cd71bf9ddc9f33d6a7ddb3d71bab71815e077ab330f86bcc081598a79 | Network Monitoring |
+| nextcloud | nextcloud/all-in-one:latest@sha256:9be7362a88a21bb1c11d6d5085317685d57ea8b28b7375be39fd71e66340cbf3 | Private Cloud |
+| nocodb | nocodb/nocodb:latest@sha256:8fd57018accf775fb5390392910e4b0ef6bb154f17c5732b478eb76c40ee8d1e | Turn any SQL-based database into a smart spreadsheet |
+| nocodb-pg-db | postgres:16-alpine@sha256:84fb5d5bdd7d47f1889f325e534f3ce643f853f460832c8a61949f5391b8dc42 |  |
+| nocodb-valkey | docker.io/valkey/valkey:8-alpine@sha256:e706d1213aaba6896c162bb6a3a9e1894e1a435f28f8f856d14fab2e10aa098b |  |
+| ollama | ollama/ollama:latest@sha256:c622a7adec67cf5bd7fe1802b7e26aa583a955a54e91d132889301f50c3e0bd0 |  |
+| ombi | lscr.io/linuxserver/ombi:latest@sha256:c4ed349ce5fe893c522ee8c5760ca1522c90e628c85c2c1752070cb0f6f2067f | Media Requests |
+| omnitools | iib0011/omni-tools:latest@sha256:a59959d929e5ff0e89c20f5d78ab008c919b5dda05f9e20ee7c0d0229b374d03 | Tools for common tasks |
+| omnipoly | kweg/omnipoly:latest@sha256:dc0b21f959446714ed467efca92b8094230d9c7404d1c0f3e17910a295d31e9b | Open-source language translation with LanguageTool, LibreTranslate, & Ollama |
+| open-webui | ghcr.io/open-webui/open-webui:main@sha256:5a93a2c0943336d1bc8e3d86773172a7b007e6cb27676f9268e8b272738b70f0 | User-friendly and extensible AI interface |
+| open-webui-valkey | docker.io/valkey/valkey:8-alpine@sha256:e706d1213aaba6896c162bb6a3a9e1894e1a435f28f8f856d14fab2e10aa098b |  |
+| paperless-ngx | ghcr.io/paperless-ngx/paperless-ngx:latest@sha256:3421ebe06ed27662d014046cf5089e612de853aae0c676a2bc72f73b38080e57 | Document indexer & archiver with OCR |
+| paperless-valkey | docker.io/valkey/valkey:8-alpine@sha256:e706d1213aaba6896c162bb6a3a9e1894e1a435f28f8f856d14fab2e10aa098b |  |
+| penpot-frontend | penpotapp/frontend:latest@sha256:91b80791f37b44c9aba3490720ae90fc01c691562c0862abeebcb8bc0a7198d2 | Open-source design and prototyping platform |
+| penpot-backend | penpotapp/backend:latest@sha256:cfae17cff120a73c80e2237b7f664b44765b859a874896a377f09d8083463514 |  |
+| penpot-exporter | penpotapp/exporter:latest@sha256:79c4988d0ac1986e3e8a7a1e1041d54869bcf1b17779f0cc6553795666f685e4 |  |
+| penpot-pg-db | postgres:15-alpine@sha256:52af010baaeb34a287e7b5ea9696720727bd5bace64f9c18068ee187a6d6a4b2 |  |
+| penpot-redis | redis:7.4@sha256:d7432711a2a5c99c2e9dd0e006061cd274d7cb7a9e77f07ffe2ea99e21244677 |  |
+| pgbackweb | eduardolat/pgbackweb:latest@sha256:56358e7adff53250ec0b43cf2764e723e45872fa2b92b9608fdddfeebaafbed7 | Backups for PostgreSQL |
+| pgbackweb-db | postgres:17-alpine@sha256:5d14c08a257610d8e27c52ce0f10de5d9cce4c232e1277d44d7d6fb628b3d1a7 |  |
+| planka | ghcr.io/plankanban/planka:2.0.0-rc.3@sha256:5a2a69ec7159a2f9c6679c31698e4b5b17ccf254d5bfc6e9be43e411b6de0c3d | Kanban board |
+| planka-pg-db | postgres:16-alpine@sha256:84fb5d5bdd7d47f1889f325e534f3ce643f853f460832c8a61949f5391b8dc42 |  |
+| plant-it | msdeluise/plant-it-server:latest@sha256:23ddf8660087d6b9f5dbdca2ca09817b84db45cb2d9d6e2e0176e70f514629e7 | 🪴 Self-hosted, open source gardening companion app |
+| plant-it-valkey | docker.io/valkey/valkey:8-alpine@sha256:e706d1213aaba6896c162bb6a3a9e1894e1a435f28f8f856d14fab2e10aa098b |  |
+| plantuml-server | plantuml/plantuml-server:jetty@sha256:d672e1faf68d9f455d162502bf69edde5d8b0fbe25cf2d01ded9611156dab3ef | Textual diagram generator for UML & other visualizations. |
+| portainer | portainer/portainer-ce:alpine@sha256:c6908c1a2d036668799d51fb4d5ba5a5b3905509c7ac1b832c0fc0ef4c152f0e | Service delivery platform for containerized applications |
+| portchecker-web | ghcr.io/dsgnr/portcheckerio-web:latest@sha256:8bea203e8785541c0acac7860de9f70849b05806e0c6db1d83dfc1b8407a6077 | Service delivery platform for containerized applications |
+| portchecker-api | ghcr.io/dsgnr/portcheckerio-api:latest@sha256:7783796d791c3e10aedba9d5f7fc2b934bb0e7afa75bc89054b70b886ed39e5c |  |
+| postal-smtp | ghcr.io/postalserver/postal:latest@sha256:ff9a42deeda9b236ac36df012dab843b14726da8f3c2464c18c371f23107d986 |  |
+| postal-web | ghcr.io/postalserver/postal:latest@sha256:ff9a42deeda9b236ac36df012dab843b14726da8f3c2464c18c371f23107d986 | OSS Mail delivery platform |
+| postal-worker | ghcr.io/postalserver/postal:latest@sha256:ff9a42deeda9b236ac36df012dab843b14726da8f3c2464c18c371f23107d986 |  |
+| protonmail-bridge | shenxn/protonmail-bridge@sha256:3717b4441130675dc9131196de9f9c5287d2ea21b138d83b0486429e1737638a |  |
+| prowlarr | lscr.io/linuxserver/prowlarr:latest@sha256:964485823771c102427a0c1cd896cf6b576add6f21bd041498b92cb040ee7270 | Index aggregator |
+| qbit-manage | ghcr.io/stuffanthings/qbit_manage:latest@sha256:64f749b97604d607747fc8b790821cf0317d8107385ea111afe1ed1c9d1d5b11 |  |
+| qbittorrentvpn | ghcr.io/binhex/arch-qbittorrentvpn:latest@sha256:e6556875ffa483ff603c0ed76c0c10122efad1edee2d9f5e4a94244accd5b3a3 | Fast and stable torrent client |
+| radarec | thewicklowwolf/radarec:latest@sha256:df726f35e3a1ef2f0cd482a6cf993bac8782804efd38ee8004c8694f7e8f526e | Movie discovery based on library/tastes |
+| radarr | lscr.io/linuxserver/radarr:latest@sha256:f174546a0ad7eb9a9170e4142bef6f74ef3ebfe6209528fded40630369406dc0 | Movie Automation |
+| reactive-resume | amruthpillai/reactive-resume:latest@sha256:46999abe24b0d41fb8b3c32e479f06035fa755db8c3243d03335e74fa6a2e74f | Open-source resume builder |
+| reactive-resume-pg | postgres:16-alpine@sha256:84fb5d5bdd7d47f1889f325e534f3ce643f853f460832c8a61949f5391b8dc42 |  |
+| readarr | lscr.io/linuxserver/readarr:develop@sha256:eb37f58646a901dc7727cf448cae36daaefaba79de33b5058dab79aa4c04aefb | eBook/Audiobook Automation |
+| redlib | quay.io/redlib/redlib:latest@sha256:c1fcda90dca9447d4aa7e18fd3ef85cc2044c29263490159e1ae4b472d0f285c | Redlib is a private front-end like Invidious but for Reddit |
 | rocketchat | registry.rocket.chat/rocketchat/rocket.chat:latest | Fully customizable communications platform with high standards of data protection |
-| romm | rommapp/romm:latest | Beautiful, powerful, self-hosted ROM manager |
-| romm-valkey | docker.io/bitnami/valkey:latest |  |
-| sabnzbdvpn | ghcr.io/binhex/arch-sabnzbdvpn:latest | NZB Downloader over VPN |
-| sablier | sablierapp/sablier:latest |  |
-| scraparr | ghcr.io/thecfu/scraparr:2 |  |
-| scrutiny | ghcr.io/analogj/scrutiny:master-omnibus | WebUI for smartd S.M.A.R.T monitoring |
-| searxng | searxng/searxng:latest | Anonymized Meta-Search Engine |
-| searxng-valkey | docker.io/bitnami/valkey:latest |  |
-| semaphore-ui | semaphoreui/semaphore:v2.12.14 | Modern UI for Ansible, Terraform, OpenTofu, PowerShell and other DevOps tools |
-| signoz-app | signoz/signoz:v0.92.2 | Logs, metrics, and traces in a single pane |
-| signoz-clickhouse | clickhouse/clickhouse-server:24.1.2-alpine |  |
-| signoz-init-clickhouse | clickhouse/clickhouse-server:24.1.2-alpine |  |
-| signoz-logspout | pavanputhra/logspout-signoz |  |
-| signoz-otel-collector | signoz/signoz-otel-collector:v0.129.0 |  |
-| signoz-schema-migrator-async | signoz/signoz-schema-migrator:v0.129.0 |  |
-| signoz-schema-migrator-sync | signoz/signoz-schema-migrator:v0.129.0 |  |
+| romm | rommapp/romm:latest@sha256:f9a66d759f255ddbc5cd635bf6b66efe17f75babda5863aad318ade1845d7d68 | Beautiful, powerful, self-hosted ROM manager |
+| romm-valkey | docker.io/valkey/valkey:8-alpine@sha256:e706d1213aaba6896c162bb6a3a9e1894e1a435f28f8f856d14fab2e10aa098b |  |
+| sabnzbdvpn | ghcr.io/binhex/arch-sabnzbdvpn:latest@sha256:bbd64cb8343589f027a69e6174ab96f1bf31f4328fd75351b44330aa146cd7fd | NZB Downloader over VPN |
+| sablier | sablierapp/sablier:latest@sha256:4d4096b59a6e1496bd3106c1a90a7fdd161aafb73d58539b8c749c69380dedae |  |
+| scraparr | ghcr.io/thecfu/scraparr:2@sha256:cfe07f005aa6e93221dd0bb540600aaa51ea1215968595806863f9df3dc3b26c |  |
+| scrutiny | ghcr.io/analogj/scrutiny:master-omnibus@sha256:cc88f7babededd75ec01a631bf53671d8be0acbe0c8a80f7ba4d41454a5fc52b | WebUI for smartd S.M.A.R.T monitoring |
+| searxng | searxng/searxng:latest@sha256:9438a9be3df82652ebc804a2ace2ab335704d92a6dc0e5b29d771acd404e9f6c | Anonymized Meta-Search Engine |
+| searxng-valkey | docker.io/valkey/valkey:8-alpine@sha256:e706d1213aaba6896c162bb6a3a9e1894e1a435f28f8f856d14fab2e10aa098b |  |
+| semaphore-ui | semaphoreui/semaphore:v2.16.31@sha256:7c9617ecd6233a019c85f52b122108c1113458c3cf91554145f3c56d4dbc25b3 | Modern UI for Ansible, Terraform, OpenTofu, PowerShell and other DevOps tools |
+| signoz-app | signoz/signoz:v0.96.1@sha256:e2cded000c87adb0366c9ae4f292e034515458552d151879195071ba4f078b4e | Logs, metrics, and traces in a single pane |
+| signoz-clickhouse | clickhouse/clickhouse-server:25.5.6-alpine |  |
+| signoz-init-clickhouse | clickhouse/clickhouse-server:25.5.6-alpine |  |
+| signoz-logspout | pavanputhra/logspout-signoz@sha256:6da8ce12279a5262de8b2d5c083ce82d4c878c4eab702b4d328afe147ed7553b |  |
+| signoz-otel-collector | signoz/signoz-otel-collector:v0.129.7@sha256:618523c986658f5677b6fd44ab4dc3487bab03582ce9e92760e50d83246f7034 |  |
+| signoz-schema-migrator-async | signoz/signoz-schema-migrator:v0.129.7@sha256:721c55284b32da6af8932d1fe6939410b6f0d10da74fc666f9856fa1e1f5763b |  |
+| signoz-schema-migrator-sync | signoz/signoz-schema-migrator:v0.129.7@sha256:721c55284b32da6af8932d1fe6939410b6f0d10da74fc666f9856fa1e1f5763b |  |
 | signoz-zookeeper-1 | bitnami/zookeeper:3.7.1 |  |
-| sonarqube | mc1arke/sonarqube-with-community-branch-plugin:lts | Code/DevOps quality/security |
-| sonarqube-pg-db | postgres:17-alpine |  |
-| sonarr | lscr.io/linuxserver/sonarr:latest | TV Show Automation |
-| sonashow | thewicklowwolf/sonashow:latest | TV show discovery based on library/tastes |
-| soularr | mrusse08/soularr:latest |  |
-| soularr-dashboard | ghcr.io/mrusse/soularr:main | Dashboard for monitoring Soularr |
-| soulseek | slskd/slskd | Modern client-server application for the Soulseek file-sharing network. |
-| speedtest-tracker | lscr.io/linuxserver/speedtest-tracker:latest | Self-hosted internet performance tracking |
-| stable-diffusion-webui | ghcr.io/neggles/sd-webui-docker:latest |  |
-| stirling-pdf | docker.stirlingpdf.com/stirlingtools/stirling-pdf:latest | PDF Operations |
-| swag | lscr.io/linuxserver/swag:latest | SWAG Dashboard for proxies |
-| tandoor | vabene1111/recipes | Recipes, cookbooks, meal-planning, & grocery lists |
-| tandoor-pg | postgres:16-alpine |  |
-| umami | ghcr.io/umami-software/umami:postgresql-latest | Simple, fast, privacy-focused alternative to Google Analytics |
-| umami-pg-db | postgres:15-alpine |  |
-| unmanic | josh5/unmanic:latest | Library Optimizer |
-| uptimekuma | louislam/uptime-kuma:latest | HTTP Endpoint Monitoring |
-| vault | hashicorp/vault:latest | HashiCorp Vault for secrets, key/value stores, etc. |
-| wallos | bellamy/wallos:latest | Subscription Tracking |
-| watchtower | ghcr.io/containrrr/watchtower:latest | Container-based solution for automating Docker container base image updates |
-| web-check | lissy93/web-check | Site scanner for attack vectors, architecture, security configs, and more |
-| whodb | clidey/whodb | Lightweight next-gen database explorer |
-| wizarr | ghcr.io/wizarrrr/wizarr | User invitation management system for Jellyfin, Plex, and Emby |
-| youtubedl | nbr23/youtube-dl-server:latest | YouTube Downloader |
+| sonarqube | mc1arke/sonarqube-with-community-branch-plugin:lts@sha256:70b055c294a2a751357ee65d5d55139c93f87faed436d0075034da38b2edafa1 | Code/DevOps quality/security |
+| sonarqube-pg-db | postgres:17-alpine@sha256:5d14c08a257610d8e27c52ce0f10de5d9cce4c232e1277d44d7d6fb628b3d1a7 |  |
+| sonarr | lscr.io/linuxserver/sonarr:latest@sha256:328d322af2bb8d7211a9c43a26ff5e658ba3e6f47a695e8fb9ff806bfeab0f04 | TV Show Automation |
+| sonashow | thewicklowwolf/sonashow:latest@sha256:4b40df407bf31577668bfb3191e007ac78c349d81bfde7463ec8433d417ebd3d | TV show discovery based on library/tastes |
+| soularr | mrusse08/soularr:latest@sha256:71a0b9e5a522d76bb0ffdb6d720d681fde22417b3a5acc9ecae61c89d05d8afc |  |
+| soularr-dashboard | ghcr.io/mrusse/soularr:main@sha256:61181c5809845d2c49c8c3c182c0280c5c91069cd2e5d7c341ddd8bfa2c01598 | Dashboard for monitoring Soularr |
+| soulseek | slskd/slskd@sha256:28df5325f301537ea8669b2ef90112a30cc9f2efd3eb714c9a778460b5dc6288 | Modern client-server application for the Soulseek file-sharing network. |
+| speedtest-tracker | lscr.io/linuxserver/speedtest-tracker:latest@sha256:99b5a8ac3b6c04e0560676a39d6f346cb523fabc08039ed1f1ab34cabbefcd84 | Self-hosted internet performance tracking |
+| stable-diffusion-webui | ghcr.io/neggles/sd-webui-docker:latest@sha256:1795fe796e1dad0d8d3baa9ef7c38a255b69c0878b76869feecc617bfd015e53 |  |
+| stirling-pdf | docker.stirlingpdf.com/stirlingtools/stirling-pdf:latest@sha256:ae74a9f00f374e628c484c2f4bb96c08406a3e8b8cb3825ea821df9dd8a7fdd7 | PDF Operations |
+| swag | lscr.io/linuxserver/swag:latest@sha256:08af17ae67c12e9b42a17d33fe538f67853020294c1f89c8e9d5b213c89c47ae | SWAG Dashboard for proxies |
+| tandoor | vabene1111/recipes@sha256:94a048d2ca34209654ecb984e29de1f621625b632925b28243735f1de4187d58 | Recipes, cookbooks, meal-planning, & grocery lists |
+| tandoor-pg | postgres:16-alpine@sha256:84fb5d5bdd7d47f1889f325e534f3ce643f853f460832c8a61949f5391b8dc42 |  |
+| umami | ghcr.io/umami-software/umami:postgresql-latest@sha256:77264ce6951c6b131a91d99f1cfd720d9efac1eaaa12e104f21cf49408dd77e0 | Simple, fast, privacy-focused alternative to Google Analytics |
+| umami-pg-db | postgres:15-alpine@sha256:52af010baaeb34a287e7b5ea9696720727bd5bace64f9c18068ee187a6d6a4b2 |  |
+| unmanic | josh5/unmanic:latest@sha256:c01264beede4bb9f4c7e86fa9874377ae898f22122a28c642654b20f1b600b46 | Library Optimizer |
+| uptimekuma | louislam/uptime-kuma:latest@sha256:431fee3be822b04861cf0e35daf4beef6b7cb37391c5f26c3ad6e12ce280fe18 | HTTP Endpoint Monitoring |
+| vault | hashicorp/vault:latest@sha256:268bb80aa9c6d13d65fcfa05c0c268caca068952240a8087291a6ce0b66e3a10 | HashiCorp Vault for secrets, key/value stores, etc. |
+| wallos | bellamy/wallos:latest@sha256:f7489083991465b8b24a919b87f5c325d9ec57f7208fa40746578efadde3db3f | Subscription Tracking |
+| web-check | lissy93/web-check@sha256:f2d1dc726958c1d79ac459cac84eb26eb4f203a4d27447f336695a8c1884f1e3 | Site scanner for attack vectors, architecture, security configs, and more |
+| whodb | clidey/whodb@sha256:ee5324a4bf95a6d8cfe62cc949c5f39a7f8b66f905b05681ce7a367298fe329b | Lightweight next-gen database explorer |
+| wizarr | ghcr.io/wizarrrr/wizarr@sha256:0681c279ebe80e73d0536a791d7ea2bcacaa4e6b865fbc026481d76315bf8e0a | User invitation management system for Jellyfin, Plex, and Emby |
+| youtubedl | nbr23/youtube-dl-server:latest@sha256:af3dfd77a9aa03f3d8f9b18264780562c3bf9302a6bbf7f8e52f1b5c46a076b7 | YouTube Downloader |
 | zammad-backup | ghcr.io/zammad/zammad:6.5.0-15 |  |
 | zammad-elasticsearch | elasticsearch:8.18.0 |  |
 | zammad-init | ghcr.io/zammad/zammad:6.5.0-15 |  |
@@ -1,39 +0,0 @@
-const fs = require('fs');
-const yaml = require('js-yaml');
-
-module.exports = function extractDockerImages(fileContent) {
-  const result = [];
-
-  try {
-    const doc = yaml.load(fileContent, { schema: yaml.DEFAULT_SCHEMA });
-
-    if (!doc.services) return [];
-
-    for (const [serviceName, serviceDef] of Object.entries(doc.services)) {
-      let image = serviceDef.image;
-
-      // Resolve anchors/merges if image is not directly present
-      if (!image && serviceDef['<<']) {
-        const merge = Array.isArray(serviceDef['<<']) ? serviceDef['<<'] : [serviceDef['<<']];
-        merge.forEach(m => {
-          if (m && m.image && !image) {
-            image = m.image;
-          }
-        });
-      }
-
-      if (image) {
-        const [depName, currentValue] = image.split(':');
-        result.push({
-          depName: depName,
-          currentValue: currentValue || 'latest',
-          service: serviceName // For Renovate PR titles
-        });
-      }
-    }
-  } catch (err) {
-    console.error('Failed parsing docker-compose.yml:', err);
-  }
-
-  return result;
-};
@@ -1,53 +1,23 @@
 {
  "$schema": "https://docs.renovatebot.com/renovate-schema.json",
-  "extends": ["config:base"],
-  "enabledManagers": ["docker-compose"],
-  "schedule": [
-    "* 3-9 * * 5",
-    "* 3-9 * * 6",
-    "* 3-9 * * 0"
-  ],
-  "prConcurrentLimit": 5,
-  "branchPrefix": "renovate/",
-  "rebaseWhen": "behind-base-branch",
+  "extends": ["local>trez/renovate-config"],
  "packageRules": [
    {
-      "description": "Pin ClickHouse, Zookeeper, Postgres, pgvector, and pgvecto-rs images",
+      "description": "Freeze ClickHouse and Zookeeper",
      "matchDatasources": ["docker"],
      "matchManagers": ["docker-compose"],
      "matchPackageNames": [
-        "signoz-clickhouse-server",
-        "signoz-zookeeper-1",
-        "postgres",
-        "pgvector",
-        "pgvecto-rs"
+        "clickhouse/clickhouse-server",
+        "bitnami/zookeeper"
      ],
-      "pinDigests": true,
-      "allowedVersions": "digest"
+      "enabled": false
    },
    {
-      "description": "Alpine-based images only update to Alpine-based versions",
+      "description": "Pin Postgres, pgvector, and pgvecto-rs images",
      "matchDatasources": ["docker"],
      "matchManagers": ["docker-compose"],
-      "matchPackagePatterns": [".*"],
-      "allowedVersions": "/alpine/i"
-    },
-    {
-      "description": "Automerge patch updates for semver tags",
-      "matchDatasources": ["docker"],
-      "matchManagers": ["docker-compose"],
-      "matchUpdateTypes": ["patch"],
-      "automerge": true
-    },
-    {
-      "description": "Require approval for major and minor updates",
-      "matchDatasources": ["docker"],
-      "matchManagers": ["docker-compose"],
-      "matchUpdateTypes": ["minor", "major"],
-      "automerge": false,
-      "requiredStatusChecks": null
+      "matchPackageNames": ["postgres", "pgvector", "pgvecto-rs"],
+      "pinDigests": true
    }
-  ],
-  "branchNameStrict": true,
-  "branchTopic": "{{{depNameSanitized}}}-{{{newVersion}}}"
+  ]
 }