Files

.renovaterc.json5

Not anchored to a line

Deliberate divergences from onedr0p/home-ops

why ·ok

This file tracks `onedr0p/home-ops`'s `.renovaterc.json5` closely — same lockFileMaintenance block, same auto-merge / grouping / labeling rule set, same verbatim section comments. Four differences are intentional, so a future "align with upstream" pass should not re-add them:

Show the rest

- **No `hostRules` for `ocharted.turbo.ac`.** That is onedr0p's private OCI registry, authenticated via `RENOVATE_SECRETS` in their Renovate workflow. Nothing here pulls from it. Copying the block would also require the `OCHARTED_USERNAME` / `OCHARTED_PASSWORD` 1Password items their workflow loads, which do not exist in this vault. - **No Rook-Ceph group and no "Hold Rook-Ceph at v1.19.x" rule.** Rook-Ceph was replaced by miroir on 2026-07-28; there is not one rook-ceph manifest left. Both rules were inert here and referenced storage that no longer exists. - **No "Auto-merge Grafana dashboards" rule.** It matches `custom.grafana-dashboards`, a datasource that only exists when `apps/grafanaDashboards.json5` is extended, and there are no `grafanadashboard.yaml` files here. Re-add it together with the preset, not on its own. - **`:timezone(Europe/Warsaw)`** rather than `America/New_York`. This governs when the `before 3am` / `before 6am on Monday` schedules fire.

The 1Password CLI rule is the one addition upstream has that this repo genuinely needs: `.mise/config.toml` pins `1password-cli`, and the dependency dashboard was reporting `Failed to look up github-tags package 1password/cli: no-result` until it was disabled.

2026-08-1001KZNAXH41FZJST6WPHSDBVAT0

1 {

2 $schema: "https://docs.renovatebot.com/renovate-schema.json",

3 extends: [

4 "github>home-operations/renovate-presets#8.1.0",

5 "github>home-operations/renovate-presets//apps/llamacpp.json5#8.1.0",

6 "github>home-operations/renovate-presets//apps/searxng.json5#8.1.0",

7 "github>home-operations/renovate-presets//apps/talosFactory.json5#8.1.0",

8 ":timezone(Europe/Warsaw)",

9 ],

10 customManagers: [

11 {

12 customType: "regex",

13 description: "Update the koment CLI version used by GitHub Pages",

14 managerFilePatterns: ["/^\\.github\\/workflows\\/koment-pages\\.yaml$/"],

15 matchStrings: ["version: (?<currentValue>v?\\d+\\.\\d+\\.\\d+)"],

16 depNameTemplate: "koment-dev/koment",

17 packageNameTemplate: "koment-dev/koment",

18 datasourceTemplate: "github-releases",

19 versioningTemplate: "semver",

20 },

21 {

22 customType: "regex",

23 description: "Update the koment tool pinned in t3-code-operator Workstations",

24 managerFilePatterns: [

25 "/^kubernetes\\/apps\\/ai\\/t3-code-operator\\/instance\\/workstation\\.yaml$/",

26 ],

27 matchStrings: [

28 'backend: github:koment-dev/koment\\s+version: "(?<currentValue>\\d+\\.\\d+\\.\\d+)"',

29 ],

30 depNameTemplate: "koment-dev/koment",

31 packageNameTemplate: "koment-dev/koment",

32 datasourceTemplate: "github-releases",

33 extractVersionTemplate: "^v(?<version>.+)$",

34 versioningTemplate: "semver",

35 },

36 ],

37 lockFileMaintenance: {

38 enabled: true,

39 schedule: ["before 3am on the first day of the month"],

40 commitMessageExtra: "({{manager}})",

41 additionalBranchPrefix: "{{manager}}-",

42 },

43 packageRules: [

44 {

45 description: "Auto-merge trusted OCI digests",

46 matchDatasources: ["docker"],

47 matchUpdateTypes: ["digest"],

48 matchPackageNames: ["/home-operations/"],

49 automerge: true,

50 automergeType: "pr",

51 ignoreTests: false,

52 },

53 {

54 description: "Auto-merge high-cadence OCI packages weekly",

55 matchDatasources: ["docker"],

56 matchUpdateTypes: ["minor", "patch"],

57 matchPackageNames: ["/kube-prometheus-stack/"],

58 automerge: true,

59 automergeType: "pr",

60 ignoreTests: false,

61 schedule: ["before 6am on Monday"],

62 },

63 {

64 description: "Auto-merge GitHub Actions",

65 matchManagers: ["github-actions"],

66 matchUpdateTypes: ["minor", "patch", "digest"],

67 automerge: true,

68 automergeType: "branch",

69 minimumReleaseAge: "3 days",

70 ignoreTests: true,

71 },

72 {

73 description: "Auto-merge trusted GitHub Actions",

74 matchManagers: ["github-actions"],

75 matchPackageNames: ["/^actions\\//", "/^renovatebot\\//"],

76 matchUpdateTypes: ["minor", "patch", "digest"],

77 automerge: true,

78 automergeType: "branch",

79 minimumReleaseAge: "1 minute",

80 ignoreTests: true,

81 },

82 {

83 description: "Auto-merge Renovate Presents",

84 matchManagers: ["renovate-config"],

85 matchUpdateTypes: ["minor", "patch"],

86 automerge: true,

87 automergeType: "branch",

88 ignoreTests: true,

89 },

90 {

91 description: "Actions Runner Controller Group",

92 groupName: "actions-runner-controller",

93 matchDatasources: ["docker"],

94 matchPackageNames: ["/gha-runner-scale-set-controller/", "/gha-runner-scale-set/"],

95 group: {

96 commitMessageTopic: "{{{groupName}}} group",

97 },

98 minimumGroupSize: 2,

99 },

100 {

101 description: "Flux Operator Group",

102 groupName: "flux-operator",

103 matchDatasources: ["docker"],

104 matchPackageNames: ["/flux-operator/", "/flux-instance/"],

105 group: {

106 commitMessageTopic: "{{{groupName}}} group",

107 },

108 minimumGroupSize: 2,

109 },

110 {

111 description: "Kubernetes Group",

112 groupName: "kubernetes",

113 matchDatasources: ["docker"],

114 matchPackageNames: [

115 "/kube-apiserver/",

116 "/kube-controller-manager/",

117 "/kube-proxy/",

118 "/kube-scheduler/",

119 "/kubelet/",

120 ],

121 group: {

122 commitMessageTopic: "{{{groupName}}} group",

123 },

124 minimumGroupSize: 5,

125 },

126 {

127 description: "Mise Tools Group",

128 matchManagers: ["mise"],

129 groupName: "mise tools",

130 groupSlug: "mise-tools",

131 },

132 {

133 description: "Koment Group",

134 groupName: "koment",

135 groupSlug: "koment",

136 matchPackageNames: ["koment-dev/koment", "ghcr.io/koment-dev/charts/koment"],

137 group: {

138 commitMessageTopic: "{{{groupName}}} group",

139 },

140 minimumGroupSize: 5,

141 },

142 {

143 description: "Talos Group",

144 groupName: "talos",

145 matchPackageNames: ["siderolabs/talos"],

146 group: {

147 commitMessageTopic: "{{{groupName}}} group",

148 },

149 minimumGroupSize: 2,

150 },

151 {

152 description: "1Password CLI is not resolvable on GitHub, bump manually",

153 matchManagers: ["mise"],

154 matchDepNames: ["1password-cli"],

155 enabled: false,

156 },

157 {

158 matchUpdateTypes: ["major"],

159 addLabels: ["type/major"],

160 },

161 {

162 matchUpdateTypes: ["minor"],

163 addLabels: ["type/minor"],

164 },

165 {

166 matchUpdateTypes: ["patch"],

167 addLabels: ["type/patch"],

168 },

169 {

170 matchUpdateTypes: ["digest"],

171 addLabels: ["type/digest"],

172 },

173 {

174 description: "Unattended freeze: high-blast-radius updates need dashboard approval",

175 matchPackageNames: [

176 "/kube-apiserver/",

177 "/kube-controller-manager/",

178 "/kube-proxy/",

179 "/kube-scheduler/",

180 "/kubelet/",

181 "siderolabs/talos",

182 "/flux-operator/",

183 "/flux-instance/",

184 "/charts/miroir/",

185 "/charts/kopiur/",

186 "/cilium/",

187 "koment-dev/koment",

188 "ghcr.io/koment-dev/charts/koment",

189 "docker.io/library/alpine",

190 ],

191 automerge: false,

192 dependencyDashboardApproval: true,

193 },

194 ],

195 }

Pinning renovate-presets below 6.0.0 is broken by construction

gotcha ·ok L4

This tag must stay at 6.0.0 or newer. Every tag up to and including 5.0.0 is permanently broken, and the pin here is what protects against it.

Show the rest

Up to 5.0.0 the presets repo's `default.json` was a fan-out that extended nested paths — `github>home-operations/renovate-presets//config/baseConfig.json5` and sixteen siblings. Those nested refs carry no `#tag`, so Renovate resolves them against the presets repo's DEFAULT BRANCH, not against the tag you pinned. 6.0.0 deleted `config/`, `managers/`, `overrides/`, `policies/` and `versioning/`, folding them into a single flat `default.json`. That deletion retroactively broke every older tag: pinning `#5.0.0` still fetches a `default.json` that points at directories which no longer exist on main.

The failure is silent from the repo's side and total. Renovate opens an "Action Required: Fix Renovate Configuration" issue reading `Cannot find preset's package (github>home-operations/renovate-presets//config/baseConfig.json5)` and stops opening PRs entirely — the scheduled workflow keeps reporting green, because a config-resolution failure is not a job failure. It happened here on 2026-08-07: commit 43a6876f bumped 4.0.0 to 5.0.0 and PRs stopped 40 minutes later, with the hourly Renovate run still succeeding for three days.

7.0.0's `default.json` extends only first-party Renovate presets (`config:recommended`, `docker:enableMajor`, ...), so it has no cross-repo nested refs and cannot rot the same way.

2026-08-1001KZNAWNR50MCXCT5W7DNGJZHR

apps/* presets are opt-in from 6.0.0; each line has a live consumer

why ·ok L5

Up to 5.0.0 these shipped inside the base preset (as `managers/talosFactory.json5`, `versioning/searxng.json5`, `versioning/llamacpp.json5`) and needed no mention here. 6.0.0 moved them to `apps/` and dropped them from `default.json`, so from that release on they are opt-in. Bumping the base tag without adding these lines does not error — the custom datasource and the versioning regexes just quietly disappear.

Each line is here because something in this repo breaks without it:

Show the rest

- `talosFactory` defines the `custom.talos-factory` datasource. Two places depend on it: `talos/cluster.yaml.j2` (the `factory.talos.dev/metal-installer` image, matched by file pattern) and `kubernetes/apps/system-upgrade/tuppr/upgrades/talosupgrade.yaml` (matched by its `# renovate: datasource=custom.talos-factory` annotation). Without the preset the annotation names a datasource that does not exist. - `searxng` supplies the `regex:^(?<major>\d+)\.(?<minor>\d+)\.(?<patch>\d+)-[a-f0-9]+$` versioning for `ghcr.io/searxng/searxng`, pinned in `kubernetes/apps/selfhosted/searxng/app/helmrelease.yaml`. The tag shape is calver plus a per-release commit sha; Renovate's default compatibility logic treats the sha as a compatibility stream and blocks every update. - `llamacpp` supplies `regex:^server-(?<compatibility>[a-z]+)-b(?<patch>\d+)$` for `ghcr.io/ggml-org/llama.cpp`, used by both llmkube model manifests (`bge-embedding-m3.yaml`, `bge-reranker-v2-m3.yaml`) on the `server-vulkan-b*` stream. Capturing the variant as `compatibility` is what keeps Renovate from proposing a cuda or intel build over the vulkan one.

`apps/cnpg.json5`, `apps/grafanaDashboards.json5` and `apps/phanpy.json5` are deliberately absent: no CloudNativePG cluster, no `grafanadashboard.yaml`, no phanpy here. Add the matching line at the same tag if any of those arrive.

2026-08-1001KZNAX425HPK1HSHVXFCJS13R

Talos group sits after the mise catch-all so it wins its own group

why ·ok L143

Order matters here. Renovate applies packageRules top to bottom with later matches overriding earlier ones, so this rule has to come AFTER the "Mise Tools Group" catch-all — that rule matches `matchManagers: ["mise"]` and would otherwise sweep the Talos pin into the generic `mise-tools` group.

The group unites the two places this cluster pins a Talos version, so they can never drift apart:

Show the rest

- `talos/cluster.yaml.j2` — the `factory.talos.dev/metal-installer` image, picked up by the `apps/talosFactory.json5` custom manager's file pattern. - `kubernetes/apps/system-upgrade/tuppr/upgrades/talosupgrade.yaml` — the tuppr `spec.talos.version`, picked up from its `# renovate:` annotation.

Known wrinkle: `minimumGroupSize: 2` is currently not satisfied — the dependency dashboard lists the talos update under "Group Size Not Met", so the PR has to be created by ticking its checkbox there rather than appearing on its own. This matches onedr0p's configuration; lowering it to 1 would diverge.

2026-08-1001KZNBWS553T73PPRYH0EN9B2B

Koment upgrades require all five dependency updates

invariant ·ok L133

A koment release creates five Renovate updates. Native managers extract the GitHub Action SHA, the repository mise tool, and the OCI chart. Regex managers extract the GitHub Pages CLI input and the koment tool pinned in the t3-code-operator Workstation.

`minimumGroupSize: 5` postpones branch creation until all five updates are available. This prevents a partial release from changing only one runtime. If a member is added or removed, change this number with it: with six members the group still opened at five, and with four it would never open.

Show the rest

Keep this rule after the Mise Tools Group. Renovate applies later matching rules last, so this position moves the repository koment tool out of the generic mise group.

2026-08-2601M0YJBH7P1PV8MJYG91D8PCRX

Freeze exists because auto-merge rolled the control plane mid-incident

why ·ok L173

Added 2026-09-01, hours into a multi-week period with no hardware access. That afternoon the base preset auto-merged the Kubernetes 1.36→1.37 group and a breaking flux-operator group while the cluster was still convalescing from a DRBD wedge; tuppr picked up the 1.37 target and sat in HealthChecking, primed to roll every node the moment the cluster looked green, with nobody around to catch a wedge mid-upgrade (upgrade churn is exactly the replica-transfer load that triggers LINBIT/drbd#137). The 1.37 bump was reverted the same evening and this rule keeps it, and anything like it, behind a manual dashboard checkbox.

Show the rest

The list is blast-radius-based, not cadence-based: control plane and talos roll nodes; miroir and kopiur are the storage and backup planes; flux and cilium can take down reconciliation or all networking; koment gates every commit via CI, so a broken koment release would lock the repo remotely; alpine is the miroir-medic base image, and a bump rolls the self-healing DaemonSet itself (observed 2026-09-01 17:57, mid-incident).

This must stay the LAST packageRule — later rules win, and several earlier rules turn automerge on for overlapping matches. Deliberately no schedule/expiry field: drop the whole rule after the unattended period rather than letting it silently expire. Routine app bumps (media, ai, selfhosted) stay auto-merged; freezing those would just pile up PRs for no safety gain.

2026-09-0101M1F0G7VDT5RXT3NFHBK4G539