From 012bceeabbe159559639ecd60028e7dcb18228e4 Mon Sep 17 00:00:00 2001
From: jtbx <ccc@jtbx.de>
Date: Fri, 28 Aug 2026 12:11:03 +0200
Subject: [PATCH 1/3] public-reverse-proxy(host): Increase nginx worker fd
 limit

By default the limit on file descriptors is at a 1024 hard limit and 520k hard limit.
Unsure how this affects nginx, but each client connection needs two file descriptors.
So let's try to set the limit of open files explicitly.
---
 resources/chaosknoten/public-reverse-proxy/nginx/nginx.conf | 1 +
 1 file changed, 1 insertion(+)

diff --git a/resources/chaosknoten/public-reverse-proxy/nginx/nginx.conf b/resources/chaosknoten/public-reverse-proxy/nginx/nginx.conf
index 01d0b5d6..e77fee26 100644
--- a/resources/chaosknoten/public-reverse-proxy/nginx/nginx.conf
+++ b/resources/chaosknoten/public-reverse-proxy/nginx/nginx.conf
@@ -3,6 +3,7 @@
 
 user  nginx;
 worker_processes  auto;
+worker_rlimit_nofile  2050; # should be worker_connections*2 at least
 
 error_log  /var/log/nginx/error.log notice;
 pid        /var/run/nginx.pid;

From 247cb031f2e97b608489d6174bf0da1f884f3769 Mon Sep 17 00:00:00 2001
From: Max <max@catcatgo.de>
Date: Fri, 21 Aug 2026 13:53:47 +0200
Subject: [PATCH 2/3] auto update patch versions

---
 renovate.json | 10 +++++++---
 1 file changed, 7 insertions(+), 3 deletions(-)

diff --git a/renovate.json b/renovate.json
index 8139008f..94317fc3 100644
--- a/renovate.json
+++ b/renovate.json
@@ -29,13 +29,17 @@
     // https://docs.renovatebot.com/presets-default/#automergestablenonmajor
     {
       "groupName": "all stable non-major dependencies",
-      "groupSlug": "all-stable-minor-patch",
+      "groupSlug": "all-stable-minor",
       "matchCurrentVersion": "!/^0/",
       "matchUpdateTypes": [
-        "minor",
-        "patch"
+        "minor"
       ]
     },
+    {
+      "matchUpdateTypes": ["patch"],
+      "matchCurrentVersion": "!/^0/",
+      "automerge": true
+    },
     {
       "matchDatasources": ["docker"],
       "matchPackageNames": ["docker.io/pretix/standalone"],

From 39d95a7b9f22191fb444532d9776e0d53df9bbb2 Mon Sep 17 00:00:00 2001
From: Max <max@catcatgo.de>
Date: Fri, 21 Aug 2026 13:54:19 +0200
Subject: [PATCH 3/3] except keycloak from grouped update PRs

keycloak is a critical service
separating keycloak updates makes it easier to respond quickly to
critical updates or delay them when there are breaking changes
---
 renovate.json | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/renovate.json b/renovate.json
index 94317fc3..d36e7fef 100644
--- a/renovate.json
+++ b/renovate.json
@@ -33,6 +33,9 @@
       "matchCurrentVersion": "!/^0/",
       "matchUpdateTypes": [
         "minor"
+      ],
+      "excludePackageNames": [
+        "git.hamburg.ccc.de/ccchh/oci-images/keycloak"
       ]
     },
     {