Update renovate/renovate Docker tag to v41.74.2

Reviewed-on: https://gitea.akshun-lab.uk/akshun/public-k3s/pulls/199

.gitea/workflows/renovate.yml

@@ -13,7 +13,7 @@ jobs:
         uses: actions/checkout@v4
 
       - name: Run Renovate
-        uses: docker://renovate/renovate:41.73.0
+        uses: docker://renovate/renovate:41.74.2
         env:
           LOG_LEVEL: info
           RENOVATE_TOKEN: ${{ secrets.RENOVATE_TOKEN }}

cluster/apps/flaresolverr/flaresolverr.yml

@@ -18,7 +18,7 @@ spec:
     spec:
       containers:
       - name: flaresolverr
-        image: ghcr.io/flaresolverr/flaresolverr:v3.3.24
+        image: ghcr.io/flaresolverr/flaresolverr:v3.3.25
         ports:
         - containerPort: 8191
         env:

cluster/apps/ghostfolio/ghostfolio.yml

@@ -78,7 +78,7 @@ spec:
               key: postgres-password
       containers:
       - name: ghostfolio
-        image: docker.io/ghostfolio/ghostfolio:2.190.0
+        image: docker.io/ghostfolio/ghostfolio:2.191.1
         securityContext:
           capabilities:
             drop:

cluster/apps/gitea/gitea-db.yml

@@ -24,7 +24,7 @@ spec:
           mountPath: /var/lib/postgresql/data
       containers:
       - name: gitea-db
-        image: postgres:15.13
+        image: postgres:15.14
         ports:
         - containerPort: 5432
         env:

cluster/apps/immich/immich-db.yml

@@ -15,7 +15,7 @@ spec:
     spec:
       containers:
       - name: redis
-        image: docker.io/valkey/valkey:8-bookworm@sha256:5b8f8c333bef895c925f56629d6ba90aea95a4f7391f62411e625267c600b19c
+        image: docker.io/valkey/valkey:8-bookworm@sha256:d067a06d5448c2038de8eb0b9b30749b703d8bec39712b6a11d6a5591770318b
         env:
         - name: REDIS_HOSTNAME
           value: "immich-redis"

cluster/apps/immich/immich.yml

@@ -40,7 +40,7 @@ spec:
           done
       containers:
       - name: immich-server
-        image: ghcr.io/immich-app/immich-server:v1.137.3
+        image: ghcr.io/immich-app/immich-server:v1.138.0
         ports:
         - containerPort: 2283
         env:
@@ -63,7 +63,7 @@ spec:
         - mountPath: /usr/src/app/upload
           name: pictures
       - name: immich-machine-learning
-        image: ghcr.io/immich-app/immich-machine-learning:v1.137.3-cuda
+        image: ghcr.io/immich-app/immich-machine-learning:v1.138.0-cuda
         ports:
         - containerPort: 3003
         env:

cluster/apps/invidious/invidious.yml

@@ -44,7 +44,7 @@ spec:
         - name: postgres-data
           mountPath: /var/lib/postgresql/data
       - name: postgres
-        image: postgres:15.13
+        image: postgres:15.14
         restartPolicy: Always
         env:
         - name: POSTGRES_DB

cluster/apps/jellyseerr/jellyseerr.yml

@@ -40,7 +40,7 @@ spec:
               key: OPENVPN_USER
       containers:
       - name: jellyseerr
-        image: fallenbagel/jellyseerr:2.7.2
+        image: fallenbagel/jellyseerr:2.7.3
         ports:
         - containerPort: 5055
         env:

cluster/apps/nextcloud/nextcloud.yml

@@ -28,7 +28,7 @@ spec:
             done
       containers:
       - name: nextcloud
-        image: lscr.io/linuxserver/nextcloud:31.0.7
+        image: lscr.io/linuxserver/nextcloud:31.0.8
         ports:
         - containerPort: 443
         env:

cluster/apps/pihole/pihole-pvc.yml

@@ -0,0 +1,14 @@
+---
+apiVersion: v1
+kind: PersistentVolumeClaim
+metadata:
+  name: pihole-ceph
+  namespace: default
+spec:
+  accessModes:
+    - ReadWriteOnce
+  volumeMode: Filesystem
+  resources:
+    requests:
+      storage: 1Gi
+  storageClassName: csi-rbd-sc

cluster/apps/pihole/pihole-svc.yml

@@ -0,0 +1,15 @@
+---
+apiVersion: v1
+kind: Service
+metadata:
+  name: pihole-tcp-service
+  namespace: default
+spec:
+  type: LoadBalancer
+  selector:
+    app: pihole
+  ports:
+  - port: 8585
+    targetPort: 80
+    protocol: TCP
+    name: web

cluster/apps/pihole/pihole.yml

@@ -0,0 +1,42 @@
+---
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: pihole
+  namespace: default
+spec:
+  strategy:
+    type: Recreate
+  selector:
+    matchLabels:
+      app: pihole
+  template:
+    metadata:
+      labels:
+        app: pihole
+    spec:
+      hostNetwork: true
+      containers:
+      - name: pihole
+        image: pihole/pihole@sha256:2a0985b8a039e6a3496c9076e238e48044d74ca12b18b061f8e4be48d35debf8
+        securityContext:
+          capabilities:
+            add:
+            - NET_ADMIN
+        env:
+        - name: TZ
+          value: "Asia/Kolkata"
+        - name: FTLCONF_dns_listeningMode
+          value: "all"
+        - name: FTLCONF_webserver_api_password
+          valueFrom:
+            secretKeyRef:
+              name: pihole-secrets
+              key: api_password
+        volumeMounts:
+        - name: pihole-data
+          mountPath: /etc/pihole
+      volumes:
+      - name: pihole-data
+        persistentVolumeClaim:
+          claimName: pihole-ceph

cluster/config/secrets/pihole-secrets-sealed.yml

@@ -0,0 +1,15 @@
+---
+apiVersion: bitnami.com/v1alpha1
+kind: SealedSecret
+metadata:
+  creationTimestamp: null
+  name: pihole-secrets
+  namespace: default
+spec:
+  encryptedData:
+    api_password: AgBgf97R5491tvpuCK7ZgJ5Qxg697XiuSs2jKM3FMVOStcSXDJv/+0QjJdZbmZ+jww0TeGDiZ2mPOkPsEKBETDDtR4X1zCPKIzxzOY9Gs3cX2N92NWeFQFwNN7LBF5b1CIb1Sh7OAmOtJUMv3woMbH06myfQlMuLhIxoHaRzicUJBven/DLJaYGXXHNMx5uLQv7VoPL0GyQtmo1Bf1yefGCzip+XZQ0zr+NB3pxDSYJDN/lq/VbBSZo/2I3G+RneGbA7W/JrliL/y7kgzjOFvTyxrH8e+d8BE0j5Kqzb92vRJnyOVaznzjI7pOpEO0txBEq93z5kbv7XYTXF0DKb7wjE7WDV1AUukRAhFSw1iqURL4Bew5Ni9imdHre56XfDiT6tlAee8uX7/WJ7mpWfE9YPLLhcV0IxvXanG6NAQdBJpkz6D/qSFjQg0RK5w3m8iqKUwba2enUwD2VZdbImTkAkDNRiVOuY36JJEza49pRU+aH9TC0kLk1w6Uv6DL400sUhRAHX7g+swHTPLy/KMe5lHSwmpQNRjUO7tkNTzf7JjFhKkCD/+NOIwTgY/x4PFMIctkBPkqOwiWgcy2aQ57vCSLxvY9nQkaFRsvOaIwVixfWsFqB12DH5mH+tYU7YzCgUo3ubv7RqDk4Z2WzMzowgkUeVHiCnxeJOuEKxudRXirDORkpGdbYZ5tT8WBTOMWo08u5XGv1MS8pxag==
+  template:
+    metadata:
+      name: pihole-secrets
+      namespace: default
+    type: Opaque

renovate.json

@@ -3,6 +3,7 @@
   "extends": [
     "config:recommended"
   ],
+  "prHourlyLimit": 0,
   "ignorePaths": [
     "**/disabled/**"
   ],