Update all stable non-major dependencies

With time the volume seems to just keeps growing with cache data, so
clean it up once a day.

.forgejo/workflows/lint.yaml

@@ -24,7 +24,7 @@ jobs:
       # work in our environmnet.
       # Rather manually setup python (pip) before instead.
       - name: Run ansible-lint
-        uses: https://github.com/ansible/ansible-lint@v26.3.0
+        uses: https://github.com/ansible/ansible-lint@v26.4.0
         with:
           setup_python: "false"
           requirements_file: "requirements.yml"

inventories/chaosknoten/host_vars/cloud.yaml

@@ -1,7 +1,7 @@
 # renovate: datasource=docker depName=git.hamburg.ccc.de/ccchh/oci-images/nextcloud
 nextcloud__version: 32
 # renovate: datasource=docker depName=docker.io/library/postgres
-nextcloud__postgres_version: 15.17
+nextcloud__postgres_version: 15.18
 nextcloud__fqdn: cloud.hamburg.ccc.de
 nextcloud__data_dir: /data/nextcloud
 nextcloud__extra_configuration: "{{ lookup('ansible.builtin.template', 'resources/chaosknoten/cloud/nextcloud/extra_configuration.config.php.j2') }}"

inventories/chaosknoten/host_vars/netbox.yaml

@@ -1,5 +1,5 @@
 # renovate: datasource=github-releases depName=netbox packageName=netbox-community/netbox
-netbox__version: "v4.5.5"
+netbox__version: "v4.6.0"
 netbox__config: "{{ lookup('ansible.builtin.template', 'resources/chaosknoten/netbox/netbox/configuration.py.j2') }}"
 netbox__custom_pipeline_oidc_group_and_role_mapping: true
 

resources/chaosknoten/acmedns/docker_compose/compose.yaml.j2

@@ -2,7 +2,7 @@
 services:
   oauth2-proxy:
     container_name: oauth2-proxy
-    image: quay.io/oauth2-proxy/oauth2-proxy:v7.15.1
+    image: quay.io/oauth2-proxy/oauth2-proxy:v7.15.2
     command: --config /oauth2-proxy.cfg
     hostname: oauth2-proxy
     volumes:

resources/chaosknoten/grafana/docker_compose/compose.yaml.j2

@@ -2,7 +2,7 @@
 services:
 
   prometheus:
-    image: docker.io/prom/prometheus:v3.10.0
+    image: docker.io/prom/prometheus:v3.11.3
     container_name: prometheus
     command:
       - '--config.file=/etc/prometheus/prometheus.yml'
@@ -19,7 +19,7 @@ services:
       - prom_data:/prometheus
 
   alertmanager:
-    image: docker.io/prom/alertmanager:v0.31.1
+    image: docker.io/prom/alertmanager:v0.32.1
     container_name: alertmanager
     command:
       - '--config.file=/etc/alertmanager/alertmanager.yaml'
@@ -46,7 +46,7 @@ services:
       - graf_data:/var/lib/grafana
 
   pve-exporter:
-    image: docker.io/prompve/prometheus-pve-exporter:3.8.2
+    image: docker.io/prompve/prometheus-pve-exporter:3.9.0
     container_name: pve-exporter
     ports:
       - 9221:9221
@@ -59,7 +59,7 @@ services:
       - /dev/null:/etc/prometheus/pve.yml
 
   loki:
-    image: docker.io/grafana/loki:3.7.1
+    image: docker.io/grafana/loki:3.7.2
     container_name: loki
     ports:
       - 13100:3100

resources/chaosknoten/keycloak/docker_compose/compose.yaml.j2

@@ -22,7 +22,7 @@
 
 services:
   keycloak:
-    image: git.hamburg.ccc.de/ccchh/oci-images/keycloak:26.5.7
+    image: git.hamburg.ccc.de/ccchh/oci-images/keycloak:26.6.0
     pull_policy: always
     restart: unless-stopped
     command: start --optimized

resources/chaosknoten/ntfy/docker_compose/compose.yaml.j2

@@ -1,7 +1,7 @@
 ---
 services:
   ntfy:
-    image: docker.io/binwiederhier/ntfy:v2.20.1
+    image: docker.io/binwiederhier/ntfy:v2.23.0
     container_name: ntfy
     command:
       - serve

resources/chaosknoten/pretalx/docker_compose/compose.yaml.j2

@@ -15,7 +15,7 @@ services:
       - pretalx_net
 
   redis:
-    image: docker.io/library/redis:8.6.2
+    image: docker.io/library/redis:8.6.3
     restart: unless-stopped
     volumes:
       - redis:/data
@@ -23,7 +23,7 @@ services:
       - pretalx_net
 
   static:
-    image: docker.io/library/nginx:1.29.7
+    image: docker.io/library/nginx:1.31.0
     restart: unless-stopped
     volumes:
       - public:/usr/share/nginx/html

resources/chaosknoten/tickets/docker_compose/compose.yaml.j2

@@ -13,7 +13,7 @@ services:
     restart: unless-stopped
 
   redis:
-    image: docker.io/library/redis:8.6.2
+    image: docker.io/library/redis:8.6.3
     ports:
       - "6379:6379"
     volumes:

resources/external/status/docker_compose/compose.yaml.j2

@@ -4,7 +4,7 @@
 
 services:
   database:
-    image: docker.io/library/postgres:18.3
+    image: docker.io/library/postgres:18.4
     restart: always
     volumes:
       - ./database:/var/lib/postgresql

roles/renovate/files/renovate-cleanup.service

@@ -0,0 +1,7 @@
+[Unit]
+Description=renovate cleanup (delete docker volume)
+Conflicts=renovate.service
+
+[Service]
+Type=oneshot
+ExecStart=/usr/bin/docker volume rm renovate

roles/renovate/files/renovate-cleanup.timer

@@ -0,0 +1,9 @@
+[Unit]
+Description=renovate cleanup (delete docker volume) running daily
+
+[Timer]
+# @daily with 10 minute offset
+OnCalendar=*-*-* 00:10
+
+[Install]
+WantedBy=timers.target

roles/renovate/tasks/main.yaml

@@ -16,31 +16,28 @@
     mode: "0640"
   become: true
 
-- name: ensure systemd service exists
+- name: ensure systemd services and timers exist
   ansible.builtin.copy:
-    src: renovate.service
-    dest: /etc/systemd/system/renovate.service
+    src: "{{ item }}"
+    dest: "/etc/systemd/system/{{ item }}"
     owner: root
     group: root
     mode: "0644"
   become: true
+  loop:
+    - renovate.service
+    - renovate-cleanup.service
+    - renovate.timer
+    - renovate-cleanup.timer
   notify:
     - systemd daemon reload
 
-- name: ensure systemd timer exists
-  ansible.builtin.copy:
-    src: renovate.timer
-    dest: /etc/systemd/system/renovate.timer
-    owner: root
-    group: root
-    mode: "0644"
-  become: true
-  notify:
-    - systemd daemon reload
-
-- name: ensure systemd timer is started and enabled
+- name: ensure systemd timers are started and enabled
   ansible.builtin.systemd_service:
-    name: renovate.timer
+    name: "{{ item }}"
     state: started
     enabled: true
+  loop:
+    - renovate.timer
+    - renovate-cleanup.timer
   become: true