feat: switch to github, add sha (#5096)

Reviewed-on: #5096

clusters/cl01tl/helm/harbor/values.yaml

@@ -40,21 +40,21 @@ harbor:
     enabled: true
   portal:
     image:
-      repository: goharbor/harbor-portal
-      tag: v2.15.0
+      repository: ghcr.io/goharbor/harbor-portal
+      tag: v2.15.0@sha256:541d5fa95bf77240d46a438f86245cdfd6afa6dd7fdd0cf4dd4c905af6a980b1
     replicas: 2
   core:
     image:
-      repository: goharbor/harbor-core
-      tag: v2.15.0
+      repository: ghcr.io/goharbor/harbor-core
+      tag: v2.15.0@sha256:32a13f6693a278261e9c9cb7eb606c5e2aa021308ae44fdc73225755048500a8
     replicas: 2
     existingSecret: harbor-secret
     secretName: harbor-secret
     existingXsrfSecret: harbor-secret
   jobservice:
     image:
-      repository: goharbor/harbor-jobservice
-      tag: v2.15.0
+      repository: ghcr.io/goharbor/harbor-jobservice
+      tag: v2.15.0@sha256:a22c7cccba4673b26ffb96f5c37971d85d879dd837bc82448e01c0170b68cf28
     replicas: 2
     jobLoggers:
       - stdout
@@ -63,11 +63,11 @@ harbor:
     registry:
       image:
         repository: goharbor/registry-photon
-        tag: v2.15.0
+        tag: v2.15.0@sha256:beb49fd16cf0906c04a2bf51a22f7210289e7cc2ae43a733e2a0364380aceae6
     controller:
       image:
-        repository: goharbor/harbor-registryctl
-        tag: v2.15.0
+        repository: ghcr.io/goharbor/harbor-registryctl
+        tag: v2.15.0@sha256:463172f71d3a1e8d4f9e3b4e687a447f41fbc3126316d8c150dba04a903bbc47
     existingSecret: harbor-secret
     relativeurls: true
     credentials:
@@ -93,8 +93,8 @@ harbor:
       addr: harbor-valkey.harbor:6379
   exporter:
     image:
-      repository: goharbor/harbor-exporter
-      tag: v2.15.0
+      repository: ghcr.io/goharbor/harbor-exporter
+      tag: v2.15.0@sha256:ad065e4e1a0ee900a0bb1a03d57028ed4b51dc04933f5c1cb5c4aee301a72ddb
     replicas: 2
 postgres-18-cluster:
   mode: recovery

clusters/cl01tl/helm/kube-prometheus-stack/Chart.lock

@@ -1,12 +1,12 @@
 dependencies:
 - name: kube-prometheus-stack
   repository: oci://ghcr.io/prometheus-community/charts
-  version: 82.13.6
+  version: 82.14.0
 - name: app-template
   repository: https://bjw-s-labs.github.io/helm-charts/
   version: 4.6.2
 - name: valkey
   repository: oci://harbor.alexlebens.net/helm-charts
   version: 0.4.0
-digest: sha256:6c29e37c4a0b08244b3ab0c60b2e07a2574f382f18183d98017d2d0dbcab7f21
-generated: "2026-03-24T17:20:56.086048387Z"
+digest: sha256:767eea1e633cefea72a9428ca888bfb47e82febdfd647d7d5f199523eace0154
+generated: "2026-03-24T20:52:31.377221183Z"

clusters/cl01tl/helm/kube-prometheus-stack/Chart.yaml

@@ -20,7 +20,7 @@ maintainers:
   - name: alexlebens
 dependencies:
   - name: kube-prometheus-stack
-    version: 82.13.6
+    version: 82.14.0
     repository: oci://ghcr.io/prometheus-community/charts
   - name: app-template
     alias: ntfy-alertmanager

clusters/cl01tl/helm/searxng/values.yaml

@@ -9,7 +9,7 @@ searxng:
         main:
           image:
             repository: searxng/searxng
-            tag: latest@sha256:e36b79f4d0541c1acb189081e7a2e01b6f4603ed581a8de5d79a821ffa99bde6
+            tag: latest@sha256:c4850cf4ad1954a4d93e0ad5aa8ce2c5b6ba067c889355ce970d820ac6080722
             pullPolicy: IfNotPresent
           env:
             - name: SEARXNG_BASE_URL
@@ -39,7 +39,7 @@ searxng:
         main:
           image:
             repository: searxng/searxng
-            tag: latest@sha256:e36b79f4d0541c1acb189081e7a2e01b6f4603ed581a8de5d79a821ffa99bde6
+            tag: latest@sha256:c4850cf4ad1954a4d93e0ad5aa8ce2c5b6ba067c889355ce970d820ac6080722
             pullPolicy: IfNotPresent
           env:
             - name: SEARXNG_BASE_URL

clusters/cl01tl/helm/yubal/Chart.yaml

@@ -22,4 +22,4 @@ dependencies:
     version: 0.8.0
     repository: oci://harbor.alexlebens.net/helm-charts
 # renovate: datasource=github-releases depName=guillevc/yubal
-appVersion: v4.0.0
+appVersion: v0.7.2

clusters/cl01tl/helm/yubal/values.yaml

@@ -14,7 +14,7 @@ yubal:
         main:
           image:
             repository: ghcr.io/guillevc/yubal
-            tag: 4.0.0
+            tag: 0.7.2@sha256:906b7c90b738e77ad140178f6a5145f98c12af36e8321d427148c092836c37be
             pullPolicy: IfNotPresent
           env:
             - name: YUBAL_TZ
@@ -29,72 +29,6 @@ yubal:
             requests:
               cpu: 10m
               memory: 128Mi
-        # gluetun:
-        #   image:
-        #     repository: ghcr.io/qdm12/gluetun
-        #     tag: v3.41.0@sha256:6b54856716d0de56e5bb00a77029b0adea57284cf5a466f23aad5979257d3045
-        #     pullPolicy: IfNotPresent
-        #   lifecycle:
-        #     postStart:
-        #       exec:
-        #         command: ["/bin/sh", "-c", "(ip rule del table 51820; ip -6 rule del table 51820) || true"]
-        #   env:
-        #     - name: VPN_SERVICE_PROVIDER
-        #       value: airvpn
-        #     - name: VPN_TYPE
-        #       value: wireguard
-        #     - name: WIREGUARD_PRIVATE_KEY
-        #       valueFrom:
-        #         secretKeyRef:
-        #           name: yubal-wireguard-conf
-        #           key: private-key
-        #     - name: WIREGUARD_PRESHARED_KEY
-        #       valueFrom:
-        #         secretKeyRef:
-        #           name: yubal-wireguard-conf
-        #           key: preshared-key
-        #     - name: WIREGUARD_ADDRESSES
-        #       valueFrom:
-        #         secretKeyRef:
-        #           name: yubal-wireguard-conf
-        #           key: addresses
-        #     - name: FIREWALL_OUTBOUND_SUBNETS
-        #       value: 10.0.0.0/8
-        #     - name: FIREWALL_INPUT_PORTS
-        #       value: 8000
-        #     - name: DNS_UPSTREAM_RESOLVER_TYPE
-        #       value: dot
-        #     - name: HTTPPROXY
-        #       value: "off"
-        #     - name: SHADOWSOCKS
-        #       value: "off"
-        #   securityContext:
-        #     privileged: True
-        #     capabilities:
-        #       add:
-        #         - NET_ADMIN
-        #         - SYS_MODULE
-        #   probes:
-        #     liveness:
-        #       enabled: true
-        #       custom: true
-        #       spec:
-        #         exec:
-        #           command:
-        #             - /gluetun-entrypoint
-        #             - healthcheck
-        #         failureThreshold: 5
-        #         initialDelaySeconds: 30
-        #         periodSeconds: 30
-        #         successThreshold: 1
-        #         timeoutSeconds: 15
-        #   resources:
-        #     limits:
-        #       devic.es/tun: "1"
-        #     requests:
-        #       devic.es/tun: "1"
-        #       cpu: 10m
-        #       memory: 128Mi
   service:
     main:
       controller: main

hosts/ps10rp/komodo-periphery/compose.yaml

@@ -22,6 +22,7 @@ services:
     komodo-periphery:
         image: ghcr.io/moghtech/komodo-periphery:2.0.0@sha256:cc9aff8b621d49bbcca394e1538d9d9ea28c48bcfd2d6c8a6f9d5d3eef7f8341
         container_name: komodo-periphery
+        init: true
         env_file:
             - .komodo-env
         environment:
@@ -30,9 +31,8 @@ services:
         volumes:
             - /var/run/docker.sock:/var/run/docker.sock
             - /proc:/proc
-            - /mnt/data/komodo/repos:/etc/komodo/repos
-            - /mnt/data/komodo/stacks:/etc/komodo/stacks
-            - keys:/etc/komodo/keys
+            - /mnt/data/komodo:/etc/komodo
+            - keys:/config/keys
 
 volumes:
     tailscale:

renovate.json

@@ -139,6 +139,21 @@
       "automerge": true,
       "minimumReleaseAge": "1 days"
     },
+    {
+      "description": "Automerge helm chart lock files",
+      "matchManagers": [
+        "helm"
+      ],
+      "lockFileMaintenance": {
+        "enabled": true
+      },
+      "addLabels": [
+        "chart",
+        "automerge"
+      ],
+      "automerge": true,
+      "automergeType": "branch"
+    },
     {
       "description": "Automerge chart patches",
       "matchUpdateTypes": [
@@ -155,19 +170,22 @@
       "minimumReleaseAge": "1 days"
     },
     {
-      "description": "Automerge helm chart lock files",
-      "matchManagers": [
-        "helm"
+      "description": "Automerge digest updates, specific packages",
+      "matchUpdateTypes": [
+        "digest"
+      ],
+      "matchDatasources": [
+        "docker"
+      ],
+      "matchPackageNames": [
+        "searxng/searxng"
       ],
-      "lockFileMaintenance": {
-        "enabled": true
-      },
       "addLabels": [
-        "chart",
+        "image",
         "automerge"
       ],
-      "automerge": true,
-      "automergeType": "branch"
+      "enabled": true,
+      "automerge": true
     },
     {
       "description": "Automerge image patches",
@@ -196,7 +214,7 @@
       ],
       "matchPackageNames": [
         "ghcr.io/renovatebot/renovate",
-        "kube-prometheus-stack"
+        "ghcr.io/prometheus-community/charts/kube-prometheus-stack"
       ],
       "addLabels": [
         "image",
@@ -204,24 +222,6 @@
       ],
       "automerge": true
     },
-    {
-      "description": "Automerge digest updates, specific packages",
-      "matchUpdateTypes": [
-        "digest"
-      ],
-      "matchDatasources": [
-        "docker"
-      ],
-      "matchPackageNames": [
-        "searxng/searxng"
-      ],
-      "addLabels": [
-        "image",
-        "automerge"
-      ],
-      "enabled": true,
-      "automerge": true
-    },
     {
       "description": "Group Dawarich dependencies",
       "groupName": "dawarich",