homelab/renovate.json

{
  "$schema": "https://docs.renovatebot.com/renovate-schema.json",
  "extends": [
    "local>k.renner/renovate-config"
  ],
  "enabledManagers": [
    "flux",
    "kubernetes",
    "woodpecker",
    "dockerfile"
  ],
  "ignorePaths": [
    "kubernetes/clusters/homelab/flux-system/**"
  ],
  "flux": {
    "managerFilePatterns": [
      "/^kubernetes/.+\\.ya?ml$/"
    ]
  },
  "kubernetes": {
    "managerFilePatterns": [
      "/^kubernetes/.+\\.ya?ml$/"
    ]
  },
  "packageRules": [
    {
      "description": "Flux image automation (kubernetes/infrastructure/image-automation) already bumps these images. Renovate must not open a second, competing update. Keep this list equal to the ImageRepository images there.",
      "matchDatasources": [
        "docker"
      ],
      "matchPackageNames": [
        "apache/tika",
        "deluan/navidrome",
        "eclipse-mosquitto",
        "everythingsmarthome/everything-presence-mmwave-configurator",
        "ghcr.io/advplyr/audiobookshelf",
        "ghcr.io/cloudnative-pg/plugin-barman-cloud",
        "ghcr.io/cloudnative-pg/plugin-barman-cloud-sidecar",
        "ghcr.io/home-assistant/home-assistant",
        "ghcr.io/immich-app/immich-machine-learning",
        "ghcr.io/immich-app/immich-server",
        "ghcr.io/matter-js/python-matter-server",
        "ghcr.io/music-assistant/server",
        "ghcr.io/paperless-ngx/paperless-ngx",
        "ghcr.io/usetrmnl/terminus",
        "ghcr.io/usetrmnl/trmnl-ha-amd64",
        "gitea.renner.uno/k.renner/shelly-manager",
        "gitea.renner.uno/k.renner/vsftpd",
        "gitea.renner.uno/konairius/paperclip",
        "gitea.renner.uno/konairius/wiki",
        "gotenberg/gotenberg",
        "lscr.io/linuxserver/lidarr",
        "netbirdio/netbird",
        "quay.io/ceph/ceph",
        "redis",
        "rhasspy/wyoming-openwakeword",
        "rhasspy/wyoming-speech-to-phrase",
        "rhasspy/wyoming-whisper",
        "shenxn/protonmail-bridge",
        "twinproduction/gatus",
        "valkey/valkey",
        "velero/velero-plugin-for-aws",
        "woodpeckerci/woodpecker-agent",
        "woodpeckerci/woodpecker-server"
      ],
      "enabled": false
    },
    {
      "description": "homelab only: pinning a digest changes the pod spec and restarts the workload. Keep these out of the version-update PR, so a reviewer can merge them in a window, separately.",
      "matchUpdateTypes": [
        "pinDigest"
      ],
      "groupName": "pin image digests",
      "groupSlug": "pin-image-digests"
    },
    {
      "description": "Cilium and Rook-Ceph: a minor version is a planned change with a window (maintainer duties). One PR per update, never in the weekly group.",
      "matchPackageNames": [
        "cilium",
        "rook-ceph",
        "rook-ceph-cluster"
      ],
      "matchUpdateTypes": [
        "minor",
        "major"
      ],
      "groupName": null
    },
    {
      "description": "agent-sandbox (REN-285): the chart comes from the git tag and the controller image is pinned separately in the HelmRelease values. Both must move together, in one PR.",
      "matchPackageNames": [
        "kubernetes-sigs/agent-sandbox",
        "registry.k8s.io/agent-sandbox/agent-sandbox-controller"
      ],
      "groupName": "agent-sandbox",
      "groupSlug": "agent-sandbox"
    },
    {
      "description": "agent-sandbox held below 1.0.0 (REN-298): the Paperclip Kubernetes sandbox plugin (0.1.0-alpha.1) uses Sandbox v1alpha1, which 1.0.0 removed. Lift this rule when the plugin moves to v1beta1.",
      "matchPackageNames": [
        "kubernetes-sigs/agent-sandbox",
        "registry.k8s.io/agent-sandbox/agent-sandbox-controller"
      ],
      "allowedVersions": "<1.0.0"
    },
    {
      "description": "Our own images (gitea.renner.uno) are pinned by DATED TAG, never by digest (REN-315, ci-manifests-test no-digest-pins). Registry GC deletes their old digests, and a pod that restarts on a deleted digest cannot pull. Existing digest pins still get digest updates.",
      "matchDatasources": [
        "docker"
      ],
      "matchPackageNames": [
        "gitea.renner.uno/**"
      ],
      "pinDigests": false
    },
    {
      "description": "Home Assistant namespace: one PR of its own, so Hestia can do the HA-impact review and it merges 02:00-05:00 (REN-240, REN-315).",
      "matchFileNames": [
        "kubernetes/apps/home-assistant/**"
      ],
      "matchUpdateTypes": [
        "patch",
        "minor",
        "digest",
        "pin"
      ],
      "groupName": "home-assistant non-major",
      "groupSlug": "home-assistant-minor-patch"
    },
    {
      "description": "CI only (pipelines and CI images): nothing here reaches the cluster, so it merges without a window (REN-315).",
      "matchFileNames": [
        ".woodpecker/**",
        "ci/images/**"
      ],
      "matchUpdateTypes": [
        "patch",
        "minor",
        "digest",
        "pin"
      ],
      "groupName": "CI non-major",
      "groupSlug": "ci-minor-patch"
    },
    {
      "description": "Stateful apps and the CNI: one PR each, never in a group (REN-315). A git revert does not undo a DB migration or a CNI change, so each needs its own review and, where it can disrupt the cluster, a window.",
      "matchUpdateTypes": [
        "patch",
        "minor",
        "digest",
        "pin"
      ],
      "matchPackageNames": [
        "gitea/gitea"
      ],
      "groupName": "gitea",
      "groupSlug": "gitea"
    },
    {
      "description": "authentik: chart and images together, one PR (REN-315, DB migrations).",
      "matchUpdateTypes": [
        "patch",
        "minor",
        "digest",
        "pin"
      ],
      "matchPackageNames": [
        "authentik",
        "ghcr.io/goauthentik/**"
      ],
      "groupName": "authentik",
      "groupSlug": "authentik"
    },
    {
      "description": "InfluxDB: chart and image together, one PR (REN-315, data migrations).",
      "matchUpdateTypes": [
        "patch",
        "minor",
        "digest",
        "pin"
      ],
      "matchPackageNames": [
        "influxdb",
        "influxdb2"
      ],
      "groupName": "influxdb",
      "groupSlug": "influxdb"
    },
    {
      "description": "OpenBao: chart and image together, one PR (REN-315, raft storage, the secrets backend). rangeStrategy bump: the default (replace) rewrote the bounded chart range \">=0.28.4 <0.29.0\" to \"<0.30.0\" (homelab #1054) and dropped the lower bound. bump keeps the shape, e.g. \">=0.29.6 <0.30.0\".",
      "matchUpdateTypes": [
        "patch",
        "minor",
        "digest",
        "pin"
      ],
      "matchPackageNames": [
        "openbao",
        "quay.io/openbao/openbao"
      ],
      "groupName": "openbao",
      "groupSlug": "openbao"
    },
    {
      "matchDatasources": [
        "helm"
      ],
      "matchPackageNames": [
        "openbao"
      ],
      "rangeStrategy": "bump"
    },
    {
      "description": "Multus, whereabouts and the CNI plugins: one PR for the directory (REN-315). A CNI change can cut pod networking on every node.",
      "matchFileNames": [
        "kubernetes/infrastructure/multus/**"
      ],
      "matchUpdateTypes": [
        "patch",
        "minor",
        "digest",
        "pin"
      ],
      "groupName": "multus CNI",
      "groupSlug": "multus"
    },
    {
      "description": "LinuxServer tags are <semver>-ls<n>; the default docker versioning reads -ls<n> as a compatibility suffix and never proposes a new one. Beets (REN-350) is Renovate-tracked, not Flux image automation.",
      "matchDatasources": [
        "docker"
      ],
      "matchPackageNames": [
        "lscr.io/linuxserver/beets"
      ],
      "versioning": "regex:^(?<major>\\d+)\\.(?<minor>\\d+)\\.(?<patch>\\d+)-ls(?<build>\\d+)$"
    }
  ]
}