.woodpecker/build-ci-images.yml

@@ -243,7 +243,8 @@ steps:
       - AUTH=$(printf '%s:%s' "$GITEA_USER" "$GITEA_TOKEN" | base64 | tr -d '\n')
       - GH_AUTH=$(printf '%s:%s' "$GHCR_USER" "$GHCR_TOKEN" | base64 | tr -d '\n')
       - printf '{"auths":{"gitea.renner.uno":{"auth":"%s"},"ghcr.io":{"auth":"%s"}}}' "$AUTH" "$GH_AUTH" > /kaniko/.docker/config.json
-      - TAG=$(date +%Y-%m-%d)
+      # konairius/ gets one tag per build: Gitea's cleanup rule counts tags.
+      - TAG=$(date +%Y-%m-%d-%H%M)
       - |
         /kaniko/executor \
           --context . \
@@ -251,9 +252,7 @@ steps:
           --destination gitea.renner.uno/gitea_admin/alpine-jq:$TAG \
           --destination gitea.renner.uno/gitea_admin/alpine-jq:latest \
           --destination gitea.renner.uno/konairius/alpine-jq:$TAG \
-          --destination gitea.renner.uno/konairius/alpine-jq:latest \
-          --destination ghcr.io/konairius/alpine-jq:$TAG \
-          --destination ghcr.io/konairius/alpine-jq:latest
+          --destination ghcr.io/konairius/alpine-jq:$TAG
 
   # Runtime image, not CI tooling: upstream containernetworking/plugins binaries
   # baked in, consumed by the multus cni-plugins-installer DaemonSet. Replaces a
@@ -295,7 +294,8 @@ steps:
       - AUTH=$(printf '%s:%s' "$GITEA_USER" "$GITEA_TOKEN" | base64 | tr -d '\n')
       - GH_AUTH=$(printf '%s:%s' "$GHCR_USER" "$GHCR_TOKEN" | base64 | tr -d '\n')
       - printf '{"auths":{"gitea.renner.uno":{"auth":"%s"},"ghcr.io":{"auth":"%s"}}}' "$AUTH" "$GH_AUTH" > /kaniko/.docker/config.json
-      - TAG=$(date +%Y-%m-%d)
+      # konairius/ gets one tag per build: Gitea's cleanup rule counts tags.
+      - TAG=$(date +%Y-%m-%d-%H%M)
       - |
         /kaniko/executor \
           --context . \
@@ -303,9 +303,7 @@ steps:
           --destination gitea.renner.uno/gitea_admin/cni-plugins:$TAG \
           --destination gitea.renner.uno/gitea_admin/cni-plugins:latest \
           --destination gitea.renner.uno/konairius/cni-plugins:$TAG \
-          --destination gitea.renner.uno/konairius/cni-plugins:latest \
-          --destination ghcr.io/konairius/cni-plugins:$TAG \
-          --destination ghcr.io/konairius/cni-plugins:latest
+          --destination ghcr.io/konairius/cni-plugins:$TAG
 
   # Runtime image, not CI tooling: alpine + the openssl CLI, for shell scripts
   # needing s_client/x509. Named for what it is; first consumer is the paperless
@@ -336,7 +334,8 @@ steps:
       - AUTH=$(printf '%s:%s' "$GITEA_USER" "$GITEA_TOKEN" | base64 | tr -d '\n')
       - GH_AUTH=$(printf '%s:%s' "$GHCR_USER" "$GHCR_TOKEN" | base64 | tr -d '\n')
       - printf '{"auths":{"gitea.renner.uno":{"auth":"%s"},"ghcr.io":{"auth":"%s"}}}' "$AUTH" "$GH_AUTH" > /kaniko/.docker/config.json
-      - TAG=$(date +%Y-%m-%d)
+      # konairius/ gets one tag per build: Gitea's cleanup rule counts tags.
+      - TAG=$(date +%Y-%m-%d-%H%M)
       - |
         /kaniko/executor \
           --context . \
@@ -344,9 +343,7 @@ steps:
           --destination gitea.renner.uno/gitea_admin/alpine-openssl:$TAG \
           --destination gitea.renner.uno/gitea_admin/alpine-openssl:latest \
           --destination gitea.renner.uno/konairius/alpine-openssl:$TAG \
-          --destination gitea.renner.uno/konairius/alpine-openssl:latest \
-          --destination ghcr.io/konairius/alpine-openssl:$TAG \
-          --destination ghcr.io/konairius/alpine-openssl:latest
+          --destination ghcr.io/konairius/alpine-openssl:$TAG
 
   # Heating CAN readers: open3e (Vitocal/VX3) + E3onCAN (E380 meter), one image
   # run as two services on edge-1. Replaces pip-into-venv on the host, where an

.woodpecker/hermes-image.yml

@@ -1,5 +1,5 @@
 # Builds ci/images/hermes (nousresearch/hermes-agent plus the agent's CLIs) as
-# gitea.renner.uno/konairius/hermes:build.<unix-ts> and :latest.
+# gitea.renner.uno/konairius/hermes:YYYY-MM-DD-HHMM, one tag per build.
 when:
   - event: push
     branch: main
@@ -20,10 +20,9 @@ steps:
       - mkdir -p /kaniko/.docker
       - AUTH=$(printf '%s:%s' registry-bot "$GITEA_TOKEN" | base64 | tr -d '\n')
       - printf '{"auths":{"gitea.renner.uno":{"auth":"%s"}}}' "$AUTH" > /kaniko/.docker/config.json
-      - TAG="build.$(date +%s)"
+      - TAG=$(date +%Y-%m-%d-%H%M)
       - |
         /kaniko/executor \
           --context . \
           --dockerfile Containerfile \
-          --destination gitea.renner.uno/konairius/hermes:$TAG \
-          --destination gitea.renner.uno/konairius/hermes:latest
+          --destination gitea.renner.uno/konairius/hermes:$TAG

kubernetes/apps/authentik/blueprints-configmap.yaml

@@ -705,8 +705,9 @@ data:
             # AND (&(sambaDomainName=...)(objectClass=sambaDomain))
             # return entries instead of short-circuiting. Built from
             # the samba-bridge repo at
-            # gitea.renner.uno/konairius/authentik-samba-bridge .
-            container_image: gitea.renner.uno/konairius/authentik-samba-bridge-ldap-outpost:2026.8.4-3c8f413
+            # gitea.renner.uno/konairius/authentik-samba-bridge ; the tag is
+            # tracked by Flux in helmrelease.yaml global.env.
+            container_image: !Env SAMBA_BRIDGE_LDAP_OUTPOST_IMAGE
             object_naming_template: "ak-outpost-%(name)s"
             kubernetes_namespace: authentik
             kubernetes_replicas: 1

kubernetes/apps/authentik/helmrelease.yaml

@@ -50,15 +50,7 @@ spec:
       # https://gitea.renner.uno/konairius/authentik-samba-bridge .
       image:
         repository: gitea.renner.uno/konairius/authentik-samba-bridge-server
-        # Pinned to a specific build for two reasons:
-        # 1. K8s does not pull on every reschedule when tag=latest, so
-        #    a floating tag means we don't actually pick up rebuilds
-        #    without a manual rollout-restart (which is forbidden per
-        #    "no pod invasion" rule).
-        # 2. Pinning means the deployed binary is traceable to a
-        #    specific repo commit. Bump the tag whenever a new build
-        #    is published from gitea.renner.uno/konairius/authentik-samba-bridge .
-        tag: "2026.8.4-3c8f413"
+        tag: "2026.8.4-3c8f413" # {"$imagepolicy": "flux-system:authentik-samba-bridge-server:tag"}
       envFrom:
         # SAMBA_BRIDGE_DOMAIN_SID / _ENABLED_GROUP / _UID_OFFSET
         # consumed by the bridge module at Django app startup. Missing
@@ -100,6 +92,10 @@ spec:
             secretKeyRef:
               name: ldap-outpost-tls
               key: tls.key
+        # Patched LDAP outpost image, set via `!Env` in the k8s-outposts
+        # blueprint (blueprints-configmap.yaml).
+        - name: SAMBA_BRIDGE_LDAP_OUTPOST_IMAGE
+          value: gitea.renner.uno/konairius/authentik-samba-bridge-ldap-outpost:2026.8.4-3c8f413 # {"$imagepolicy": "flux-system:authentik-samba-bridge-ldap-outpost"}
         # Key of the authentik-gate-sync API token, set via `!Env` in the
         # gate-sync blueprint (gate-sync.yaml).
         - name: AUTHENTIK_GATE_SYNC_TOKEN

kubernetes/apps/hermes/skills/homelab-gitea-pr/SKILL.md

@@ -84,7 +84,7 @@ missing permission and the one step that grants it.
 9. **After the owner says "merged", verify the effect, not the merge.** Check
    `GET /repos/<o>/<r>/commits/<merge_sha>/statuses` for the expected
    `ci/woodpecker/push/<pipeline>` context (only cron contexts = the push pipeline never
-   triggered), the registry tag list for a new `build.<ts>`, `flux get images policy <name>`,
+   triggered), the registry tag list for a new `YYYY-MM-DD-HHMM` tag, `flux get images policy <name>`,
    and the Deployment image. Report each as observed; say plainly what you couldn't see
    (e.g. Woodpecker UI) instead of guessing the cause.
    - With several PRs in flight, query the state of every one; "merged" may mean only one

kubernetes/apps/hermes/skills/homelab-gitea-pr/references/in-house-images.md

@@ -7,8 +7,8 @@ Use when a homelab change adds or modifies an image built from `ci/images/<name>
 | Concern | Owner | How |
 |---|---|---|
 | Versions of base images and bundled tools | **Renovate** (`renovate.json`, `dockerfile` manager) | Express every version as an image reference: `FROM <img>:<tag>@<digest>` and `COPY --from=<img>:<tag>@<digest> <path> /usr/local/bin/<tool>`. Renovate opens the bump PR; merging it is the trigger. |
-| Building the image | **Woodpecker**, on push to the default branch of `ci/images/<name>/**` (+ `event: manual`) | kaniko, tag `build.$(date +%s)` + `latest`. |
-| Rolling a built tag out | **Flux image automation** | `ImageRepository` + `ImagePolicy` (`filterTags.pattern '^build\.(?P<ts>\d+)$'`, `extract '$ts'`, `numerical asc`) and the `# {"$imagepolicy": "flux-system:<name>"}` marker on every image line. |
+| Building the image | **Woodpecker**, on push to the default branch of `ci/images/<name>/**` (+ `event: manual`) | kaniko, exactly one tag `$(date +%Y-%m-%d-%H%M)`. No `latest`, `main` or sha tags: Gitea's konairius cleanup rule counts each tag as a version and keeps only the newest. |
+| Rolling a built tag out | **Flux image automation** | `ImageRepository` + `ImagePolicy` (`filterTags.pattern '^\d{4}-\d{2}-\d{2}(-\d{4})?$'`, `alphabetical asc`) and the `# {"$imagepolicy": "flux-system:<name>"}` marker on every image line. No hand-written pins. |
 
 Never add cron polling / "decide" steps that compare upstream releases — that duplicates
 Renovate. Never curl binaries with hand-maintained sha256 lines when the tool ships an
@@ -47,4 +47,4 @@ image: `COPY --from` a digest-pinned image is tracked and needs no checksums.
 - Check what the base image's last `USER` is before adding one (`grep -n '^USER'` in the
   upstream Dockerfile).
 - Rollout order is two PRs: image + pipeline first; the manifest switch only with a real
-  `build.<ts>` (see SKILL.md, Multi-stage changes).
+  date tag (see SKILL.md, Multi-stage changes).

kubernetes/apps/home-assistant/mqtt-account-controller.yaml

@@ -223,9 +223,7 @@ spec:
           type: RuntimeDefault
       containers:
         - name: controller
-          # Woodpecker builds main-<sha> on every merge to main; no sortable
-          # tag, so bumps are manual (same as ical-proxy).
-          image: gitea.renner.uno/konairius/mqtt-account-controller:main-b1f294d@sha256:8081adfee171c36cfa83734e5e7ccc3aad3debf1c0154488de70143674cde85f
+          image: gitea.renner.uno/konairius/mqtt-account-controller:main-b1f294d@sha256:8081adfee171c36cfa83734e5e7ccc3aad3debf1c0154488de70143674cde85f # {"$imagepolicy": "flux-system:mqtt-account-controller"}
           env:
             - name: BROKER_URL
               value: ssl://mosquitto.home-assistant.svc.cluster.local:8884

kubernetes/apps/home-assistant/zigbee2mqtt-deployment.yaml

@@ -66,7 +66,7 @@ spec:
           # (machine.registries.mirrors, applied by bootstrap.sh), and containerd
           # keeps the repository path when it falls through — so the path has to
           # exist on both registries. Steady state still pulls from Gitea.
-          image: gitea.renner.uno/konairius/alpine-jq:2026-09-04
+          image: gitea.renner.uno/konairius/alpine-jq:2026-09-04 # {"$imagepolicy": "flux-system:alpine-jq"}
           command:
             - sh
             - -c

kubernetes/apps/ical-proxy/deployment.yaml

@@ -17,44 +17,7 @@ spec:
     spec:
       containers:
         - name: ical-proxy
-          # Pinned to a commit build rather than :latest.
-          #
-          # :latest never rolls. The tag moves when a build publishes, but
-          # nothing tells the Deployment about it: the pod template is
-          # unchanged, so Kubernetes has no reason to replace anything, and
-          # this image is deliberately NOT enrolled in Flux image automation
-          # — see kubernetes/infrastructure/image-automation/README.md, which
-          # lists gitea.renner.uno/konairius/ical-proxy as having "only main, latest,
-          # and main-<sha> commit builds; no release tags", so there is no
-          # ImagePolicy watching it. The pods therefore sat on a 21-day-old
-          # image while :latest moved underneath them, and the only way to
-          # pick up a new build was a manual restart.
-          #
-          # A pinned tag makes the rollout a git change: Flux applies the new
-          # pod template and Kubernetes rolls it, which is also what makes
-          # what is RUNNING recoverable from this repo rather than "whatever
-          # :latest meant the last time a pod happened to restart".
-          #
-          # The image comes from the Gitea package registry, built by
-          # Woodpecker (.woodpecker.yml in konairius/ical-proxy) on every
-          # push to main. It is amd64-only and pulls without credentials, so
-          # no imagePullSecret. main-4783abe adds two hardening changes on
-          # top of main-db90a59: an SSRF guard (upstreams and redirect hops
-          # resolving to private/loopback/link-local addresses are refused;
-          # public redirects are still followed, up to 5) and a cap of 20
-          # concurrent /proxy upstream fetches (over the cap: 429 +
-          # Retry-After). main-73b5d97 then raises the server WriteTimeout
-          # from 10s to 40s (the 30s upstream fetch timeout + 10s headroom),
-          # so a slow-but-legitimate upstream is no longer cut off before
-          # /proxy can answer. main-926ead0 caps the upstream response body
-          # at 2 MiB (larger feeds get 413 instead of being buffered whole,
-          # REN-230) and logs upstream fetch failures with the host,
-          # answering 502 instead of 500. The summary_match/summary_replace
-          # parameters this deployment needs are unchanged.
-          #
-          # Bumping this is a manual, reviewed edit. The tag format is
-          # main-<short-sha>, the first 7 characters of the main commit.
-          image: gitea.renner.uno/konairius/ical-proxy:main-926ead0
+          image: gitea.renner.uno/konairius/ical-proxy:main-926ead0 # {"$imagepolicy": "flux-system:ical-proxy"}
           ports:
             - containerPort: 8080
               name: http

kubernetes/apps/paperless/paperless.yaml

@@ -155,7 +155,7 @@ spec:
           # exist on both registries — hence konairius/, which matches the ghcr
           # namespace. Steady state still pulls from Gitea and never leaves the
           # network.
-          image: gitea.renner.uno/konairius/alpine-openssl:2026-09-04
+          image: gitea.renner.uno/konairius/alpine-openssl:2026-09-04 # {"$imagepolicy": "flux-system:alpine-openssl"}
           command:
             - sh
             - -c

kubernetes/apps/trmnl/renderer.yaml

@@ -184,7 +184,7 @@ spec:
           # (machine.registries.mirrors, applied by bootstrap.sh), and containerd
           # keeps the repository path, so it has to exist on both registries.
           # Steady state still pulls from Gitea.
-          image: gitea.renner.uno/konairius/alpine-jq:2026-09-04
+          image: gitea.renner.uno/konairius/alpine-jq:2026-09-04 # {"$imagepolicy": "flux-system:alpine-jq"}
           command:
             - sh
             - -c

kubernetes/infrastructure/image-automation/README.md

@@ -59,12 +59,23 @@ existing `flux-system` GitRepository whose Secret was created by
 | firefox | `1.x` | `-rolling-daily` suffix extract; rejects arch-prefixed duplicates |
 | mmwave-configurator | `2.x` | Plain 3-component filter (rejects `addon-`/`-armv7`/`-arm64`/`-amd64` variants) |
 | cnpg-barman-plugin | `0.x` | v-prefix filter; marker lives in upstream-imported manifest (see below) |
+| hermes, wiki, shelly-manager, vsftpd, ical-proxy, mqtt-account-controller, authentik-samba-bridge-{server,ldap-outpost} | `YYYY-MM-DD-HHMM` | In-house (konairius); newest tag wins |
+| alpine-jq, alpine-openssl, cni-plugins | `YYYY-MM-DD-HHMM` | In-house (build-ci-images.yml, konairius/ copy); newest tag wins |
+
+## In-house konairius images: one tag per build
+
+Gitea's package cleanup rule for konairius counts every tag as one
+version and keeps the most recent one. A build that pushes several tags
+(sha, `main`, `latest`) leaves only the last-pushed tag, so every
+konairius image is pushed with exactly one tag, `YYYY-MM-DD-HHMM` (UTC),
+and every consumer follows it through an ImagePolicy rather than a
+hand-written pin.
 
 ## Not enrolled (structurally impossible)
 
 - `woodpeckerci/woodpecker-cli` — the lint image in
   `.woodpecker/ci-manifests-test.yml`. It publishes a perfectly good
-  version stream (`v3.16.0-alpine`), so unlike the three below this is
+  version stream (`v3.16.0-alpine`), so unlike the two below this is
   **not** a tag-format problem. It cannot be enrolled because
   **image-automation can only patch YAML that is a Kubernetes manifest** —
   a maintainer states it plainly in fluxcd/flux2#2826: *"Flux can only
@@ -87,15 +98,13 @@ existing `flux-system` GitRepository whose Secret was created by
 
 ## Not enrolled (deliberate)
 
-These three images publish no usable version stream — there is nothing
+These two images publish no usable version stream — there is nothing
 for image-policy to sort against:
 
 - `fauria/vsftpd` — only `:latest` is published.
 - `openthread/otbr` — only Ubuntu codenames (`focal`, `jammy`,
   `hirsute`) and `:latest`/`:test`/`:reference-device`; no semver
   release stream.
-- `gitea.renner.uno/konairius/ical-proxy` — only `main`, `latest`, and
-  `main-<sha>` commit builds; no release tags.
 
 The security-scan agent will continue to surface vuln findings on
 these as "Skipped / Flux image-automation owns this" even without

kubernetes/infrastructure/image-automation/alpine-jq.yaml

@@ -0,0 +1,23 @@
+apiVersion: image.toolkit.fluxcd.io/v1
+kind: ImageRepository
+metadata:
+  name: alpine-jq
+  namespace: flux-system
+spec:
+  image: gitea.renner.uno/konairius/alpine-jq
+  interval: 30m
+---
+# build-ci-images.yml tags each build YYYY-MM-DD-HHMM (older builds YYYY-MM-DD); newest wins.
+apiVersion: image.toolkit.fluxcd.io/v1
+kind: ImagePolicy
+metadata:
+  name: alpine-jq
+  namespace: flux-system
+spec:
+  imageRepositoryRef:
+    name: alpine-jq
+  filterTags:
+    pattern: '^\d{4}-\d{2}-\d{2}(-\d{4})?$'
+  policy:
+    alphabetical:
+      order: asc

kubernetes/infrastructure/image-automation/alpine-openssl.yaml

@@ -0,0 +1,23 @@
+apiVersion: image.toolkit.fluxcd.io/v1
+kind: ImageRepository
+metadata:
+  name: alpine-openssl
+  namespace: flux-system
+spec:
+  image: gitea.renner.uno/konairius/alpine-openssl
+  interval: 30m
+---
+# build-ci-images.yml tags each build YYYY-MM-DD-HHMM (older builds YYYY-MM-DD); newest wins.
+apiVersion: image.toolkit.fluxcd.io/v1
+kind: ImagePolicy
+metadata:
+  name: alpine-openssl
+  namespace: flux-system
+spec:
+  imageRepositoryRef:
+    name: alpine-openssl
+  filterTags:
+    pattern: '^\d{4}-\d{2}-\d{2}(-\d{4})?$'
+  policy:
+    alphabetical:
+      order: asc

kubernetes/infrastructure/image-automation/authentik-samba-bridge.yaml

@@ -0,0 +1,46 @@
+apiVersion: image.toolkit.fluxcd.io/v1
+kind: ImageRepository
+metadata:
+  name: authentik-samba-bridge-server
+  namespace: flux-system
+spec:
+  image: gitea.renner.uno/konairius/authentik-samba-bridge-server
+  interval: 30m
+---
+# konairius/authentik-samba-bridge CI tags each build YYYY-MM-DD-HHMM; newest wins.
+apiVersion: image.toolkit.fluxcd.io/v1
+kind: ImagePolicy
+metadata:
+  name: authentik-samba-bridge-server
+  namespace: flux-system
+spec:
+  imageRepositoryRef:
+    name: authentik-samba-bridge-server
+  filterTags:
+    pattern: '^\d{4}-\d{2}-\d{2}(-\d{4})?$'
+  policy:
+    alphabetical:
+      order: asc
+---
+apiVersion: image.toolkit.fluxcd.io/v1
+kind: ImageRepository
+metadata:
+  name: authentik-samba-bridge-ldap-outpost
+  namespace: flux-system
+spec:
+  image: gitea.renner.uno/konairius/authentik-samba-bridge-ldap-outpost
+  interval: 30m
+---
+apiVersion: image.toolkit.fluxcd.io/v1
+kind: ImagePolicy
+metadata:
+  name: authentik-samba-bridge-ldap-outpost
+  namespace: flux-system
+spec:
+  imageRepositoryRef:
+    name: authentik-samba-bridge-ldap-outpost
+  filterTags:
+    pattern: '^\d{4}-\d{2}-\d{2}(-\d{4})?$'
+  policy:
+    alphabetical:
+      order: asc

kubernetes/infrastructure/image-automation/cni-plugins.yaml

@@ -0,0 +1,23 @@
+apiVersion: image.toolkit.fluxcd.io/v1
+kind: ImageRepository
+metadata:
+  name: cni-plugins
+  namespace: flux-system
+spec:
+  image: gitea.renner.uno/konairius/cni-plugins
+  interval: 30m
+---
+# build-ci-images.yml tags each build YYYY-MM-DD-HHMM (older builds YYYY-MM-DD); newest wins.
+apiVersion: image.toolkit.fluxcd.io/v1
+kind: ImagePolicy
+metadata:
+  name: cni-plugins
+  namespace: flux-system
+spec:
+  imageRepositoryRef:
+    name: cni-plugins
+  filterTags:
+    pattern: '^\d{4}-\d{2}-\d{2}(-\d{4})?$'
+  policy:
+    alphabetical:
+      order: asc

kubernetes/infrastructure/image-automation/hermes.yaml

@@ -7,7 +7,7 @@ spec:
   image: gitea.renner.uno/konairius/hermes
   interval: 10m
 ---
-# .woodpecker/hermes-image.yml tags every build `build.<unix-ts>`; latest push wins.
+# .woodpecker/hermes-image.yml tags each build YYYY-MM-DD-HHMM; newest wins.
 apiVersion: image.toolkit.fluxcd.io/v1
 kind: ImagePolicy
 metadata:
@@ -17,8 +17,7 @@ spec:
   imageRepositoryRef:
     name: hermes
   filterTags:
-    pattern: '^build\.(?P<ts>\d+)$'
-    extract: '$ts'
+    pattern: '^\d{4}-\d{2}-\d{2}(-\d{4})?$'
   policy:
-    numerical:
+    alphabetical:
       order: asc

kubernetes/infrastructure/image-automation/ical-proxy.yaml

@@ -0,0 +1,23 @@
+apiVersion: image.toolkit.fluxcd.io/v1
+kind: ImageRepository
+metadata:
+  name: ical-proxy
+  namespace: flux-system
+spec:
+  image: gitea.renner.uno/konairius/ical-proxy
+  interval: 30m
+---
+# konairius/ical-proxy CI tags each build YYYY-MM-DD-HHMM; newest wins.
+apiVersion: image.toolkit.fluxcd.io/v1
+kind: ImagePolicy
+metadata:
+  name: ical-proxy
+  namespace: flux-system
+spec:
+  imageRepositoryRef:
+    name: ical-proxy
+  filterTags:
+    pattern: '^\d{4}-\d{2}-\d{2}(-\d{4})?$'
+  policy:
+    alphabetical:
+      order: asc

kubernetes/infrastructure/image-automation/kustomization.yaml

@@ -2,22 +2,28 @@ apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
 resources:
   - update-automation.yaml
+  - alpine-jq.yaml
+  - alpine-openssl.yaml
   - audiobookshelf.yaml
   - authentik-gate-sync.yaml
+  - authentik-samba-bridge.yaml
   - backup-verify.yaml
   - ceph.yaml
   - cloudflare-lb-sync.yaml
+  - cni-plugins.yaml
   - cnpg-barman-plugin.yaml
   - gatus.yaml
   - gitea-mcp.yaml
   - gotenberg.yaml
   - hermes.yaml
   - home-assistant.yaml
+  - ical-proxy.yaml
   - immich.yaml
   - kuma-sync.yaml
   - lidarr.yaml
   - matter-server.yaml
   - mmwave-configurator.yaml
+  - mqtt-account-controller.yaml
   - music-assistant.yaml
   - navidrome.yaml
   - netbird-ingress.yaml

kubernetes/infrastructure/image-automation/mqtt-account-controller.yaml

@@ -0,0 +1,23 @@
+apiVersion: image.toolkit.fluxcd.io/v1
+kind: ImageRepository
+metadata:
+  name: mqtt-account-controller
+  namespace: flux-system
+spec:
+  image: gitea.renner.uno/konairius/mqtt-account-controller
+  interval: 30m
+---
+# konairius/mqtt-account-controller CI tags each build YYYY-MM-DD-HHMM; newest wins.
+apiVersion: image.toolkit.fluxcd.io/v1
+kind: ImagePolicy
+metadata:
+  name: mqtt-account-controller
+  namespace: flux-system
+spec:
+  imageRepositoryRef:
+    name: mqtt-account-controller
+  filterTags:
+    pattern: '^\d{4}-\d{2}-\d{2}(-\d{4})?$'
+  policy:
+    alphabetical:
+      order: asc

kubernetes/infrastructure/image-automation/shelly-manager.yaml

@@ -7,9 +7,7 @@ spec:
   image: gitea.renner.uno/konairius/shelly-manager
   interval: 30m
 ---
-# CI publishes `build.<unix-ts>` alongside SHA and `main` tags so the
-# ImagePolicy has a sortable tag stream to track. Numerical desc =
-# latest push wins. The SHA-only tags are filtered out by the pattern.
+# konairius/shelly-manager CI tags each build YYYY-MM-DD-HHMM; newest wins.
 apiVersion: image.toolkit.fluxcd.io/v1
 kind: ImagePolicy
 metadata:
@@ -19,8 +17,7 @@ spec:
   imageRepositoryRef:
     name: shelly-manager
   filterTags:
-    pattern: '^build\.(?P<ts>\d+)$'
-    extract: '$ts'
+    pattern: '^\d{4}-\d{2}-\d{2}(-\d{4})?$'
   policy:
-    numerical:
+    alphabetical:
       order: asc

kubernetes/infrastructure/image-automation/vsftpd.yaml

@@ -7,9 +7,7 @@ spec:
   image: gitea.renner.uno/konairius/vsftpd
   interval: 30m
 ---
-# CI publishes `build.<unix-ts>` alongside SHA and `main` tags so the
-# ImagePolicy has a sortable tag stream to track. Numerical desc =
-# latest push wins. The SHA-only tags are filtered out by the pattern.
+# konairius/vsftpd CI tags each build YYYY-MM-DD-HHMM; newest wins.
 apiVersion: image.toolkit.fluxcd.io/v1
 kind: ImagePolicy
 metadata:
@@ -19,8 +17,7 @@ spec:
   imageRepositoryRef:
     name: vsftpd
   filterTags:
-    pattern: '^build\.(?P<ts>\d+)$'
-    extract: '$ts'
+    pattern: '^\d{4}-\d{2}-\d{2}(-\d{4})?$'
   policy:
-    numerical:
+    alphabetical:
       order: asc

kubernetes/infrastructure/image-automation/wiki.yaml

@@ -7,7 +7,7 @@ spec:
   image: gitea.renner.uno/konairius/wiki
   interval: 10m
 ---
-# The Wiki release pipeline tags every main build `build.<unix-ts>`; latest push wins.
+# konairius/Wiki CI tags each build YYYY-MM-DD-HHMM; newest wins.
 apiVersion: image.toolkit.fluxcd.io/v1
 kind: ImagePolicy
 metadata:
@@ -17,8 +17,7 @@ spec:
   imageRepositoryRef:
     name: wiki
   filterTags:
-    pattern: '^build\.(?P<ts>\d+)$'
-    extract: '$ts'
+    pattern: '^\d{4}-\d{2}-\d{2}(-\d{4})?$'
   policy:
-    numerical:
+    alphabetical:
       order: asc

kubernetes/infrastructure/multus/cni-plugins-installer.yaml

@@ -74,7 +74,7 @@ spec:
           # No imagePullSecret: the ghcr namespace is private and its credential
           # is in machine.registries too, because a Secret would have to come
           # from OpenBao, which needs Ceph, which needs these binaries.
-          image: gitea.renner.uno/konairius/cni-plugins:2026-10-05
+          image: gitea.renner.uno/konairius/cni-plugins:2026-10-05 # {"$imagepolicy": "flux-system:cni-plugins"}
           command:
             - sh
             - -c

renovate.json

@@ -45,7 +45,14 @@
         "ghcr.io/paperless-ngx/paperless-ngx",
         "ghcr.io/usetrmnl/terminus",
         "ghcr.io/usetrmnl/trmnl-ha-amd64",
+        "gitea.renner.uno/konairius/alpine-jq",
+        "gitea.renner.uno/konairius/alpine-openssl",
+        "gitea.renner.uno/konairius/authentik-samba-bridge-ldap-outpost",
+        "gitea.renner.uno/konairius/authentik-samba-bridge-server",
+        "gitea.renner.uno/konairius/cni-plugins",
         "gitea.renner.uno/konairius/hermes",
+        "gitea.renner.uno/konairius/ical-proxy",
+        "gitea.renner.uno/konairius/mqtt-account-controller",
         "gitea.renner.uno/konairius/shelly-manager",
         "gitea.renner.uno/konairius/vsftpd",
         "gitea.renner.uno/konairius/wiki",