Update docker.io/pretix/standalone Docker tag to v2025

renovate: label all PRs with the "renovate" label
renovate: use rebase stale PRs preset to rebase once base branch updated
2025-10-24 19:34:01 +02:00 · 2025-10-24 19:28:49 +02:00 · 2025-10-24 19:18:04 +02:00 · 2025-10-24 18:59:58 +02:00 · 2025-10-23 13:45:41 +00:00 · 2025-10-23 12:15:38 +00:00
16 changed files with 85 additions and 37 deletions
--- a/.forgejo/workflows/lint.yaml
+++ b/.forgejo/workflows/lint.yaml
@ -10,7 +10,7 @@ jobs:
    name: Ansible Lint
    runs-on: docker
    steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5
      - name: Install pip
        run: |
          apt update
@ -24,7 +24,7 @@ jobs:
      # work in our environmnet.
      # Rather manually setup python (pip) before instead.
      - name: Run ansible-lint
-        uses: https://github.com/ansible/ansible-lint@v24.10.0
+        uses: https://github.com/ansible/ansible-lint@d7cd7cfa2469536527aceaef9ef2ec6f2fb331cb # v25.9.2
        with:
          setup_python: "false"
          requirements_file: "requirements.yml"
--- a/renovate.json
+++ b/renovate.json
@ -3,7 +3,10 @@
  "extends": [
    "config:recommended", // Included in config:best-practices anyway, but added for clarity.
    "config:best-practices",
-    ":ignoreUnstable"
+    ":ignoreUnstable",
+    ":disableRateLimiting",
+    ":rebaseStalePrs",
+    ":label(renovate)"
  ],
  "semanticCommits": "disabled",
  "packageRules": [
@ -19,6 +22,11 @@
        "minor",
        "patch"
      ]
+    },
+    {
+      "matchDatasources": ["docker"],
+      "matchPackageNames": ["docker.io/pretix/standalone"],
+      "versioning": "regex:^(?<major>\\d+\\.\\d+)(?:\\.(?<minor>\\d+))$"
    }
  ],
  "docker-compose": {
--- a/resources/chaosknoten/ccchoir/docker_compose/compose.yaml.j2
+++ b/resources/chaosknoten/ccchoir/docker_compose/compose.yaml.j2
@ -3,7 +3,7 @@

 services:
  database:
-    image: docker.io/library/mariadb:11
+    image: docker.io/library/mariadb:11@sha256:ae6119716edac6998ae85508431b3d2e666530ddf4e94c61a10710caec9b0f71
    environment:
      - "MARIADB_DATABASE=wordpress"
      - "MARIADB_ROOT_PASSWORD={{ secret__mariadb_root_password }}"
@ -17,7 +17,7 @@ services:
    restart: unless-stopped

  app:
-    image: docker.io/library/wordpress:6-php8.1
+    image: docker.io/library/wordpress:6-php8.1@sha256:d93a391bc1ba9d2db3e53c8c8421a88d6beadb7b654235ba83ccf9ea93ecdcd5
    environment:
      - "WORDPRESS_DB_HOST=database"
      - "WORDPRESS_DB_NAME=wordpress"
--- a/resources/chaosknoten/grafana/docker_compose/compose.yaml.j2
+++ b/resources/chaosknoten/grafana/docker_compose/compose.yaml.j2
@ -2,7 +2,7 @@
 services:

  prometheus:
-    image: docker.io/prom/prometheus:v3.7.1
+    image: docker.io/prom/prometheus:v3.7.1@sha256:ff7e389acbe064a4823212a500393d40a28a8f362e4b05cbf6742a9a3ef736b2
    container_name: prometheus
    command:
      - '--config.file=/etc/prometheus/prometheus.yml'
@ -18,7 +18,7 @@ services:
      - prom_data:/prometheus

  alertmanager:
-    image: docker.io/prom/alertmanager:v0.28.1
+    image: docker.io/prom/alertmanager:v0.28.1@sha256:27c475db5fb156cab31d5c18a4251ac7ed567746a2483ff264516437a39b15ba
    container_name: alertmanager
    command:
      - '--config.file=/etc/alertmanager/alertmanager.yaml'
@ -31,7 +31,7 @@ services:
      - alertmanager_data:/alertmanager

  grafana:
-    image: docker.io/grafana/grafana:12.2.1
+    image: docker.io/grafana/grafana:12.2.1@sha256:35c41e0fd0295f5d0ee5db7e780cf33506abfaf47686196f825364889dee878b
    container_name: grafana
    ports:
      - 3000:3000
@ -45,7 +45,7 @@ services:
      - graf_data:/var/lib/grafana

  pve-exporter:
-    image: docker.io/prompve/prometheus-pve-exporter:3.5.5
+    image: docker.io/prompve/prometheus-pve-exporter:3.5.5@sha256:79a5598906697b1a5a006d09f0200528a77c6ff1568faf018539ac65824454df
    container_name: pve-exporter
    ports:
      - 9221:9221
@ -58,7 +58,7 @@ services:
      - /dev/null:/etc/prometheus/pve.yml

  loki:
-    image: docker.io/grafana/loki:3.5.7
+    image: docker.io/grafana/loki:3.5.7@sha256:0eaee7bf39cc83aaef46914fb58f287d4f4c4be6ec96b86c2ed55719a75e49c8
    container_name: loki
    ports:
      - 13100:3100
@ -69,7 +69,7 @@ services:
      - loki_data:/var/loki

  ntfy-alertmanager-ccchh-critical:
-    image: docker.io/xenrox/ntfy-alertmanager:0.5.0
+    image: docker.io/xenrox/ntfy-alertmanager:0.5.0@sha256:5fea88db3bf0257d98c007ab0c4ef064c6d67d7b7ceead7d6956dfa0a5cb333b
    container_name: ntfy-alertmanager-ccchh-critical
    volumes:
      - ./configs/ntfy-alertmanager-ccchh-critical:/etc/ntfy-alertmanager/config
@ -78,7 +78,7 @@ services:
    restart: unless-stopped

  ntfy-alertmanager-fux-critical:
-    image: docker.io/xenrox/ntfy-alertmanager:0.5.0
+    image: docker.io/xenrox/ntfy-alertmanager:0.5.0@sha256:5fea88db3bf0257d98c007ab0c4ef064c6d67d7b7ceead7d6956dfa0a5cb333b
    container_name: ntfy-alertmanager-fux-critical
    volumes:
      - ./configs/ntfy-alertmanager-fux-critical:/etc/ntfy-alertmanager/config
@ -87,7 +87,7 @@ services:
    restart: unless-stopped

  ntfy-alertmanager-ccchh:
-    image: docker.io/xenrox/ntfy-alertmanager:0.5.0
+    image: docker.io/xenrox/ntfy-alertmanager:0.5.0@sha256:5fea88db3bf0257d98c007ab0c4ef064c6d67d7b7ceead7d6956dfa0a5cb333b
    container_name: ntfy-alertmanager-ccchh
    volumes:
      - ./configs/ntfy-alertmanager-ccchh:/etc/ntfy-alertmanager/config
@ -96,7 +96,7 @@ services:
    restart: unless-stopped

  ntfy-alertmanager-fux:
-    image: docker.io/xenrox/ntfy-alertmanager:0.5.0
+    image: docker.io/xenrox/ntfy-alertmanager:0.5.0@sha256:5fea88db3bf0257d98c007ab0c4ef064c6d67d7b7ceead7d6956dfa0a5cb333b
    container_name: ntfy-alertmanager-fux
    volumes:
      - ./configs/ntfy-alertmanager-fux:/etc/ntfy-alertmanager/config
--- a/resources/chaosknoten/keycloak/docker_compose/compose.yaml.j2
+++ b/resources/chaosknoten/keycloak/docker_compose/compose.yaml.j2
@ -22,7 +22,7 @@

 services:
  keycloak:
-    image: git.hamburg.ccc.de/ccchh/oci-images/keycloak:26.4
+    image: git.hamburg.ccc.de/ccchh/oci-images/keycloak:26.4@sha256:65d65fa0e858a608fd3e7d16ecfd7a5ced2fba4ab22a8fd3b86f3742ecec0a83
    pull_policy: always
    restart: unless-stopped
    command: start --optimized
@ -46,7 +46,7 @@ services:
      - "8080:8080"

  db:
-    image: docker.io/library/postgres:15.14
+    image: docker.io/library/postgres:15.14@sha256:9541969afa16d1ac724e16d1cf3c26ddd0c5bae5dd1c230118a7f5b9c14cde1f
    restart: unless-stopped
    networks:
      - keycloak
@ -58,7 +58,7 @@ services:
      POSTGRES_DB: keycloak

  id-invite-web:
-    image: git.hamburg.ccc.de/ccchh/id-invite/id-invite:latest
+    image: git.hamburg.ccc.de/ccchh/id-invite/id-invite:latest@sha256:ba011f410bc1d2e112135857c236412f65b727f15197dbea1fffd955e0487a6a
    command: web
    restart: unless-stopped
    networks:
@ -84,7 +84,7 @@ services:
      - "BOTTLE_HOST=0.0.0.0"

  id-invite-email:
-    image: git.hamburg.ccc.de/ccchh/id-invite/id-invite:latest
+    image: git.hamburg.ccc.de/ccchh/id-invite/id-invite:latest@sha256:ba011f410bc1d2e112135857c236412f65b727f15197dbea1fffd955e0487a6a
    command: email
    restart: unless-stopped
    networks:
@ -99,7 +99,7 @@ services:
      - "SMTP_PASSWORD={{ secret__id_no_reply_smtp }}"

  id-invite-keycloak:
-    image: git.hamburg.ccc.de/ccchh/id-invite/id-invite:latest
+    image: git.hamburg.ccc.de/ccchh/id-invite/id-invite:latest@sha256:ba011f410bc1d2e112135857c236412f65b727f15197dbea1fffd955e0487a6a
    command: keycloak
    restart: unless-stopped
    networks:
--- a/resources/chaosknoten/lists/docker_compose/compose.yaml
+++ b/resources/chaosknoten/lists/docker_compose/compose.yaml
@ -1,7 +1,7 @@
 services:
  mailman-core:
    restart: unless-stopped
-    image: docker.io/maxking/mailman-core:0.5 # Use a specific version tag (tag latest is not published)
+    image: docker.io/maxking/mailman-core:0.5@sha256:cb8e412bb18d74480f996da68f46e92473b6103995e71bc5aeba139b255cc3d2 # Use a specific version tag (tag latest is not published)
    container_name: mailman-core
    hostname: mailman-core
    volumes:
@ -25,7 +25,7 @@ services:

  mailman-web:
    restart: unless-stopped
-    image: docker.io/maxking/mailman-web:0.5 # Use a specific version tag (tag latest is not published)
+    image: docker.io/maxking/mailman-web:0.5@sha256:014726db85586fb53541f66f6ce964bf07e939791cfd5ffc796cd6d243696a18 # Use a specific version tag (tag latest is not published)
    container_name: mailman-web
    hostname: mailman-web
    depends_on:
@ -56,7 +56,7 @@ services:
      - POSTGRES_DB=mailmandb
      - POSTGRES_USER=mailman
      - POSTGRES_PASSWORD=wvQjbMRnwFuxGEPz
-    image: docker.io/library/postgres:12-alpine
+    image: docker.io/library/postgres:12-alpine@sha256:7c8f4870583184ebadf7f17a6513620aac5f365a7938dc6a6911c1d5df2f481a
    volumes:
      - /opt/mailman/database:/var/lib/postgresql/data
    networks:
--- a/resources/chaosknoten/ntfy/docker_compose/compose.yaml.j2
+++ b/resources/chaosknoten/ntfy/docker_compose/compose.yaml.j2
@ -1,7 +1,7 @@
 ---
 services:
  ntfy:
-    image: docker.io/binwiederhier/ntfy:v2.14.0
+    image: docker.io/binwiederhier/ntfy:v2.14.0@sha256:5a051798d14138c3ecb12c038652558ab6a077e1aceeb867c151cbf5fa8451ef
    container_name: ntfy
    command:
      - serve
--- a/resources/chaosknoten/onlyoffice/docker_compose/compose.yaml.j2
+++ b/resources/chaosknoten/onlyoffice/docker_compose/compose.yaml.j2
@ -4,7 +4,7 @@

 services:
  onlyoffice:
-    image: docker.io/onlyoffice/documentserver:9.1.0
+    image: docker.io/onlyoffice/documentserver:9.1.0@sha256:34b92f4a67bfd939bd6b75893e8217556e3b977f81e49472f7e28737b741ba1d
    restart: unless-stopped
    volumes:
      - "./onlyoffice/DocumentServer/logs:/var/log/onlyoffice"
--- a/resources/chaosknoten/pad/docker_compose/compose.yaml.j2
+++ b/resources/chaosknoten/pad/docker_compose/compose.yaml.j2
@ -3,7 +3,7 @@

 services:
  database:
-    image: docker.io/library/postgres:15-alpine
+    image: docker.io/library/postgres:15-alpine@sha256:2e50ad404aead120409575d21758230cc295aec52dfa05ece9b4d0429bc38636
    environment:
      - "POSTGRES_USER=hedgedoc"
      - "POSTGRES_PASSWORD={{ secret__hedgedoc_db_password }}"
@ -13,7 +13,7 @@ services:
    restart: unless-stopped

  app:
-    image: quay.io/hedgedoc/hedgedoc:1.10.3
+    image: quay.io/hedgedoc/hedgedoc:1.10.3@sha256:ca58fd73ecf05c89559b384fb7a1519c18c8cbba5c21a0018674ed820b9bdb73
    environment:
      - "CMD_DB_URL=postgres://hedgedoc:{{ secret__hedgedoc_db_password }}@database:5432/hedgedoc"
      - "CMD_DOMAIN=pad.hamburg.ccc.de"
@ -46,7 +46,7 @@ services:
      - database

  hedgedoc-expire:
-    image: git.hamburg.ccc.de/ccchh/hedgedoc-expire/hedgedoc-expire:latest
+    image: git.hamburg.ccc.de/ccchh/hedgedoc-expire/hedgedoc-expire:latest@sha256:9be261712a8ee57ff89068c3926a8c5d7c96ff80aa629f98eec239786c6158b1
    # command: "emailcheck"
    command: "cron"
    environment:
--- a/resources/chaosknoten/pretalx/docker_compose/compose.yaml.j2
+++ b/resources/chaosknoten/pretalx/docker_compose/compose.yaml.j2
@ -3,7 +3,7 @@

 services:
  database:
-    image: docker.io/library/postgres:15-alpine
+    image: docker.io/library/postgres:15-alpine@sha256:2e50ad404aead120409575d21758230cc295aec52dfa05ece9b4d0429bc38636
    environment:
      - "POSTGRES_USER=pretalx"
      - "POSTGRES_PASSWORD={{ secret__pretalx_db_password }}"
@ -15,7 +15,7 @@ services:
      - pretalx_net

  redis:
-    image: docker.io/library/redis:8.2.2
+    image: docker.io/library/redis:8.2.2@sha256:4521b581dbddea6e7d81f8fe95ede93f5648aaa66a9dacd581611bf6fe7527bd
    restart: unless-stopped
    volumes:
      - redis:/data
@ -23,7 +23,7 @@ services:
      - pretalx_net

  static:
-    image: docker.io/library/nginx:1.29.2
+    image: docker.io/library/nginx:1.29.2@sha256:029d4461bd98f124e531380505ceea2072418fdf28752aa73b7b273ba3048903
    restart: unless-stopped
    volumes:
      - public:/usr/share/nginx/html
@ -33,7 +33,7 @@ services:
      - pretalx_net

  pretalx:
-    image: docker.io/pretalx/standalone:v2025.1.0
+    image: docker.io/pretalx/standalone:v2025.1.0@sha256:fb2d15f11bcae8bb15430084ed81a150cfdf7c79705450583b51e352ba486e8e
    entrypoint: gunicorn
    command:
      - "pretalx.wsgi"
@ -78,7 +78,7 @@ services:
      - pretalx_net

  celery:
-    image: docker.io/pretalx/standalone:v2025.1.0
+    image: docker.io/pretalx/standalone:v2025.1.0@sha256:fb2d15f11bcae8bb15430084ed81a150cfdf7c79705450583b51e352ba486e8e
    command:
      - taskworker
    restart: unless-stopped
--- a/resources/chaosknoten/router/nftables/current.conf
+++ b/resources/chaosknoten/router/nftables/current.conf
@ -0,0 +1,38 @@
+#!/usr/sbin/nft -f
+
+# only flush tables managed by this file
+table inet filter
+flush table inet filter
+
+define LAN_IFS = {net0.2, net0.3}
+
+table inet filter {
+	chain input {
+		type filter hook input priority filter; policy drop;
+		ip protocol icmp accept
+		ip6 nexthdr icmpv6 accept
+		iifname lo accept
+		ct state related,established accept
+
+		tcp dport 22 accept
+		iifname $LAN_IFS tcp dport 53 counter accept
+		iifname $LAN_IFS udp dport 53 counter accept
+
+		iifname net0.3 udp dport 67 counter accept
+
+		iifname $LAN_IFS log prefix "[nftables] Inbound Denied: " counter drop
+	}
+	chain forward {
+		type filter hook forward priority filter; policy drop;
+		ct state related,established counter accept
+
+		meta nfproto ipv6 iifname $LAN_IFS oifname net2 counter accept
+		meta nfproto ipv4 iifname $LAN_IFS oifname net1 counter accept
+
+		#iifname net0.2 oifname net0.3 counter accept
+		iifname $LAN_IFS log prefix "[nftables] Forward Denied: " counter drop
+	}
+	chain output {
+		type filter hook output priority filter;
+	}
+}
--- a/resources/chaosknoten/tickets/docker_compose/compose.yaml.j2
+++ b/resources/chaosknoten/tickets/docker_compose/compose.yaml.j2
@ -1,7 +1,7 @@
 ---
 services:
  database:
-    image: docker.io/library/postgres:15-alpine
+    image: docker.io/library/postgres:15-alpine@sha256:2e50ad404aead120409575d21758230cc295aec52dfa05ece9b4d0429bc38636
    environment:
      - "POSTGRES_USER=pretix"
      - "POSTGRES_PASSWORD={{ secret__pretix_db_password }}"
@ -13,7 +13,7 @@ services:
    restart: unless-stopped

  redis:
-    image: docker.io/library/redis:7.4.6
+    image: docker.io/library/redis:7.4.6@sha256:a9cc41d6d01da2aa26c219e4f99ecbeead955a7b656c1c499cce8922311b2514
    ports:
      - "6379:6379"
    volumes:
--- a/resources/z9/dooris/docker_compose/compose.yaml.j2
+++ b/resources/z9/dooris/docker_compose/compose.yaml.j2
@ -2,7 +2,7 @@

 services:
  dooris:
-    image: git.hamburg.ccc.de/ccchh/hmdooris/hmdooris:latest
+    image: git.hamburg.ccc.de/ccchh/hmdooris/hmdooris:latest@sha256:a895989b0955936cbe0641de0309bcb343a9da9c2c8d6184d906a66bf1151303
    environment:
      HMDOORIS_ALLOWED_IPS: "2a07:c481:1:c8::/64 2a01:170:118b::/56 172.31.200.0/23 172.31.202.0/27"
      HMDOORIS_CCUJACK_CERTIFICATE_PATH: false
--- a/resources/z9/waybackproxy/docker_compose/compose.yaml.j2
+++ b/resources/z9/waybackproxy/docker_compose/compose.yaml.j2
@ -1,7 +1,7 @@
 services:
  # https://github.com/richardg867/WaybackProxy
  waybackproxy:
-    image: cttynul/waybackproxy:latest
+    image: cttynul/waybackproxy:latest@sha256:e001d5b1d746522cd1ab2728092173c0d96f08086cbd3e49cdf1e298b8add22e
    environment:
      DATE: 19990101
      DATE_TOLERANCE: 730
--- a/resources/z9/yate/docker_compose/compose.yaml.j2
+++ b/resources/z9/yate/docker_compose/compose.yaml.j2
@ -2,7 +2,7 @@

 services:
  yate:
-    image: git.hamburg.ccc.de/ccchh/yate-image/yate-image:latest
+    image: git.hamburg.ccc.de/ccchh/yate-image/yate-image:latest@sha256:66f77d63dc52c9aeb09481e48b9d62f5f95439f86eab3766fce94daea7b2e26a
    # command:
    #   - sh
    #   - "-c"
--- a/roles/renovate/files/renovate.service
+++ b/roles/renovate/files/renovate.service
@ -7,4 +7,6 @@ Wants=network-online.target
 Type=oneshot
 ExecStart=/usr/bin/docker run --rm \
    -v "/etc/renovate/config.js:/usr/src/app/config.js" \
+    --mount "type=volume,src=renovate,dst=/tmp/renovate" \
+    --env "RENOVATE_BASE_DIR=/tmp/renovate" \
    renovate/renovate
Author	SHA1	Message	Date
Renovate	9da42b59ae	Update docker.io/pretix/standalone Docker tag to v2025 All checks were successful / Ansible Lint (push) Successful in 2m8s Details / Ansible Lint (pull_request) Successful in 2m7s Details	2025-10-24 19:34:01 +02:00
June	37cedb1ad0	renovate: label all PRs with the "renovate" label All checks were successful / Ansible Lint (push) Successful in 2m25s Details	2025-10-24 19:28:49 +02:00
June	658a50d19b	renovate: use rebase stale PRs preset to rebase once base branch updated All checks were successful / Ansible Lint (push) Successful in 2m23s Details Use this configuration to always have the fast-forward option. https://docs.renovatebot.com/presets-default/#rebasestaleprs	2025-10-24 19:18:04 +02:00
June	b2961c5664	renovate: disable rate-limiting All checks were successful / Ansible Lint (push) Successful in 2m18s Details	2025-10-24 18:59:58 +02:00
Renovate	a13d23c7ea	Update actions/checkout action to v5 All checks were successful / Ansible Lint (pull_request) Successful in 1m58s Details / Ansible Lint (push) Successful in 2m15s Details	2025-10-23 13:45:41 +00:00
Renovate	2f8897751b	Pin dependencies All checks were successful / Ansible Lint (pull_request) Successful in 1m59s Details / Ansible Lint (push) Successful in 2m4s Details	2025-10-23 12:15:38 +00:00
Renovate	a60946b3b8	Update https://github.com/ansible/ansible-lint action to v25 All checks were successful / Ansible Lint (pull_request) Successful in 2m5s Details / Ansible Lint (push) Successful in 2m12s Details	2025-10-22 21:50:08 +00:00
June	8f612d1d9c	renovate: add persistent volume for base (and therefore cache) dir	2025-10-22 19:42:20 +02:00
June	d0d517d97d	renovate: add custom package rule for pretix calendar versioning Add custom package rule accounting for pretix calendar versioning to not have Renovate classify month updates as minor version updates, but major version updates instead.	2025-10-22 16:42:02 +02:00
June	78a6be6f5d	renovate: disable semantic commits Some checks failed / Ansible Lint (push) Failing after 52s Details	2025-10-22 00:47:05 +02:00