Update ghcr.io/kiwix/kiwix-serve:3.8.2 Docker digest to 0b65413

Reviewed-on: #235

.archived/adguardhome/.env

@@ -1,6 +0,0 @@
-# Paths
-APPDATA_PATH=/home/username/appdata
-
-# Ports
-DNS_PORT=53
-ADMIN_PORT=

.archived/bytestash/.env

@@ -1,14 +0,0 @@
-# Environment Variables
-JWT_SECRET=
-TOKEN_EXPIRY=
-ALLOW_NEW_ACCOUNTS=
-DEBUG=
-DISABLE_ACCOUNTS=
-DISABLE_INTERNAL_ACCOUNTS=
-OIDC_ENABLED=
-
-# Paths
-APPDATA_PATH=/home/username/appdata
-
-# Ports
-PORT=

.archived/caddy-cloudflare-ddns/docker-compose.yml

@@ -1,25 +0,0 @@
-services:
-  caddy:
-    image: docker.io/ryuupendragon/caddy-cloudflare-ddns:2.10.0
-    container_name: caddy
-    cap_add:
-      - NET_ADMIN
-    environment:
-      - CLOUDFLARE_API_TOKEN=${CLOUDFLARE_API_TOKEN}
-    volumes:
-      - ${APPDATA_PATH}/caddy/caddy-file:/etc/caddy
-      - ${APPDATA_PATH}/caddy/caddy-config:/config
-      - ${APPDATA_PATH}/caddy/caddy-data:/data
-      - ${APPDATA_PATH}/caddy/caddy-logs:/logs
-      - ${APPDATA_PATH}/caddy/caddy-srv:/srv
-    ports:
-      - ${HTTP_PORT}:80
-      - ${HTTPS_PORT}:443
-      - ${HTTPS_PORT}:443/udp
-    networks:
-      - frontend
-    restart: unless-stopped
-
-networks:
-  frontend:
-    external: true

.archived/caddy-cloudflare/compose.yaml

@@ -1,6 +1,6 @@
 services:
   caddy:
-    image: ghcr.io/ryuupendragon/caddy-cloudflare:2.10.2@sha256:f9627635ed090248f89fcbc8171649099ade368f82750150dbf12ea9b6bec140
+    image: ghcr.io/ryuupendragon/caddy-cloudflare:2.11.2@sha256:ec153a5ca3522335d21bf144be0aad748b1542bf32198d65444a3ffa67180551
     container_name: caddy
     restart: unless-stopped
     cap_add:

.archived/forgejo/docker-compose.yml

@@ -1,44 +0,0 @@
-services:
-  forgejo_db:
-    image: docker.io/library/mariadb:11.7.2
-    container_name: forgejo_db
-    command: --transaction-isolation=READ-COMMITTED --binlog-format=ROW --innodb-file-per-table=1 --skip-innodb-read-only-compressed
-    environment:
-      - MYSQL_ROOT_PASSWORD=${MYSQL_ROOT_PASSWORD}
-      - MYSQL_USER=${MYSQL_USER}
-      - MYSQL_PASSWORD=${MYSQL_PASSWORD}
-      - MYSQL_DATABASE=${MYSQL_DATABASE}
-    volumes:
-      - ${APPDATA_PATH}/forgejo/db:/var/lib/mysql
-    ports:
-      - ${DB_PORT}:3306
-    restart: unless-stopped
-    healthcheck:
-      test: ["CMD", "healthcheck.sh", "--connect", "--innodb_initialized"]
-      start_period: 10s
-      interval: 10s
-      timeout: 5s
-      retries: 3
-
-  forgejo_server:
-    image: codeberg.org/forgejo/forgejo:11.0.1-rootless
-    container_name: forgejo_server
-    depends_on:
-      forgejo_db:
-        condition: service_healthy
-    user: ${PUID}:${PGID}
-    environment:
-      - FORGEJO__database__DB_TYPE=mysql
-      - FORGEJO__database__HOST=forgejo_db
-      - FORGEJO__database__NAME=${MYSQL_DATABASE}
-      - FORGEJO__database__USER=${MYSQL_USER}
-      - FORGEJO__database__PASSWD=${MYSQL_PASSWORD}
-    volumes:
-      - ${APPDATA_PATH}/forgejo/config:/etc/gitea
-      - ${APPDATA_PATH}/forgejo/data:/var/lib/gitea
-      - /etc/timezone:/etc/timezone:ro
-      - /etc/localtime:/etc/localtime:ro
-    ports:
-      - ${SERVER_PORT}:3000
-      - ${SSH_PORT}:22
-    restart: unless-stopped

.archived/handbrake/compose.yaml

@@ -0,0 +1,34 @@
+services:
+  handbrake:
+    container_name: handbrake
+    image: ghcr.io/jlesage/handbrake:v26.02.2
+    restart: unless-stopped
+    deploy:
+      resources:
+        limits:
+          cpus: '${CPU_LIMIT}'
+    environment:
+      - USER_ID=${USER_ID}
+      - GROUP_ID=${GROUP_ID}
+      - UMASK=${UMASK}
+      - TZ=${TZ}
+      - DISPLAY_WIDTH=${DISPLAY_WIDTH}
+      - DISPLAY_HEIGHT=${DISPLAY_HEIGHT}
+      - DARK_MODE=${DARK_MODE}
+      - WEB_AUDIO=${WEB_AUDIO}
+      - HANDBRAKE_GUI=${HANDBRAKE_GUI}
+      - AUTOMATED_CONVERSION=${AUTOMATED_CONVERSION}
+    volumes:
+      - ${APPDATA_PATH}/handbrake/config:/config
+      - ${DATA_PATH}:/storage:ro
+      - ${APPDATA_PATH}/handbrake/watch:/watch
+      - ${APPDATA_PATH}/handbrake/output:/output
+      - ${APPDATA_PATH}/handbrake/trash:/trash
+    ports:
+      - ${PORT}:5800
+    networks:
+      - frontend
+
+networks:
+  frontend:
+    external: true

.archived/jellystat/compose.yaml

@@ -0,0 +1,56 @@
+services:
+  jellystat_db:
+    container_name: jellystat_db
+    image: docker.io/library/postgres:18.2@sha256:9b5bd946f3a507db72c55959700e517463e8d5dbb6f7eb30d920d5bcf6951431
+    restart: unless-stopped
+    shm_size: '1gb'
+    environment:
+      - POSTGRES_USER=${POSTGRES_USER}
+      - POSTGRES_PASSWORD=${POSTGRES_PASSWORD}
+      - POSTGRES_DB=${POSTGRES_DB}
+      - PGDATA=/var/lib/postgresql/18/docker
+    volumes:
+      - ${APPDATA_PATH}/jellystat/db:/var/lib/postgresql
+    networks:
+      - backend
+    healthcheck:
+      test: ["CMD-SHELL", "pg_isready -d ${POSTGRES_DB} -U ${POSTGRES_USER}"]
+      interval: 10s
+      timeout: 5s
+      retries: 3
+      start_period: 10s
+
+  jellystat:
+    container_name: jellystat
+    image: ghcr.io/cyfershepard/jellystat:1.1.8@sha256:c8c451704ba7985340142cd047e2364cabaf41b613669b6c5340688ed217f82a
+    restart: unless-stopped
+    depends_on:
+      jellystat-db:
+        condition: service_healthy
+    environment:
+      - POSTGRES_USER=${POSTGRES_USER}
+      - POSTGRES_PASSWORD=${POSTGRES_PASSWORD}
+      - POSTGRES_DB=${POSTGRES_DB}
+      - POSTGRES_IP=jellystat_db
+      - POSTGRES_PORT=5432
+      - JWT_SECRET=${JWT_SECRET}
+      - TZ=${TZ}
+    volumes:
+      - ${APPDATA_PATH}/jellystat/backup-data:/app/backend/backup-data
+    ports:
+      - ${PORT}:3000
+    networks:
+      - frontend
+      - backend
+    healthcheck:
+      test: wget --no-verbose --tries=1 --spider http://localhost:3000/auth/isConfigured || exit 1
+      interval: 60s
+      timeout: 30s
+      retries: 5
+      start_period: 30s
+
+networks:
+  frontend:
+    external: true
+  backend:
+    external: true

.archived/open-webui/compose.yaml

@@ -0,0 +1,19 @@
+services:
+  open-webui:
+    container_name: open-webui
+    image: ghcr.io/open-webui/open-webui:v0.8.8-ollama@sha256:781938633d6d445daa489fcdc0c1988c4c875e6358175f484fdd8a89aa152503
+    restart: unless-stopped
+    environment:
+      - OLLAMA_BASE_URL=${OLLAMA_BASE_URL}
+      - WEBUI_SECRET_KEY=${WEBUI_SECRET_KEY}
+      - WEBUI_AUTH=true
+    volumes:
+      - ${APPDATA_PATH}/open-webui/data:/app/backend/data
+    ports:
+      - ${PORT}:8080
+    networks:
+      - frontend
+
+networks:
+  frontend:
+    external: true

.archived/syncthing/compose.yaml

@@ -0,0 +1,27 @@
+services:
+  syncthing:
+    container_name: syncthing
+    image: ghcr.io/syncthing/syncthing:2.0.14
+    restart: unless-stopped
+    hostname: ${HOSTNAME}
+    environment:
+      - PUID=${PUID}
+      - PGID=${PGID}
+    volumes:
+      - ${APPDATA_PATH}/syncthing/data:/var/syncthing
+    ports:
+      - 8384:8384          # Web UI
+      - 22000:22000/tcp    # TCP file transfers
+      - 22000:22000/udp    # QUIC file transfers
+      - 21027:21027/udp    # Local discovery broadcasts
+    healthcheck:
+      test: curl -fkLsS -m 2 127.0.0.1:8384/rest/noauth/health | grep -o --color=never OK || exit 1
+      interval: 1m
+      timeout: 10s
+      retries: 3
+    networks:
+      - frontend
+
+networks:
+  frontend:
+    external: true

.archived/tinyauth/compose.yaml

@@ -0,0 +1,26 @@
+services:
+  tinyauth:
+    container_name: tinyauth
+    image: ghcr.io/steveiliop56/tinyauth:v5.0.1
+    restart: unless-stopped
+    environment:
+      - TINYAUTH_APPURL=${TINYAUTH_APPURL}
+      - TINYAUTH_ANALYTICS_ENABLED=${TINYAUTH_ANALYTICS_ENABLED}
+      - TINYAUTH_OAUTH_PROVIDERS_POCKETID_NAME=${TINYAUTH_OAUTH_PROVIDERS_POCKETID_NAME}
+      - TINYAUTH_OAUTH_PROVIDERS_POCKETID_CLIENTID=${TINYAUTH_OAUTH_PROVIDERS_POCKETID_CLIENTID}
+      - TINYAUTH_OAUTH_PROVIDERS_POCKETID_CLIENTSECRET=${TINYAUTH_OAUTH_PROVIDERS_POCKETID_CLIENTSECRET}
+      - TINYAUTH_OAUTH_PROVIDERS_POCKETID_AUTHURL=${TINYAUTH_OAUTH_PROVIDERS_POCKETID_AUTHURL}
+      - TINYAUTH_OAUTH_PROVIDERS_POCKETID_TOKENURL=${TINYAUTH_OAUTH_PROVIDERS_POCKETID_TOKENURL}
+      - TINYAUTH_OAUTH_PROVIDERS_POCKETID_USERINFOURL=${TINYAUTH_OAUTH_PROVIDERS_POCKETID_USERINFOURL}
+      - TINYAUTH_OAUTH_PROVIDERS_POCKETID_SCOPES=${TINYAUTH_OAUTH_PROVIDERS_POCKETID_SCOPES}
+      - TINYAUTH_OAUTH_PROVIDERS_POCKETID_REDIRECTURL=${TINYAUTH_OAUTH_PROVIDERS_POCKETID_REDIRECTURL}
+    volumes:
+      - ${APPDATA_PATH}/tinyauth/data:/data
+    ports:
+      - ${PORT}:3000
+    networks:
+      - frontend
+
+networks:
+  frontend:
+    external: true

.archived/tinyauth/docker-compose.yml

@@ -1,21 +0,0 @@
-services:
-  tinyauth:
-    container_name: tinyauth
-    image: ghcr.io/steveiliop56/tinyauth:v3.6.2
-    restart: unless-stopped
-    environment:
-      - SECRET=${SECRET}
-      - APP_URL=${APP_URL}
-      - GENERIC_NAME=${GENERIC_NAME}
-      - GENERIC_CLIENT_ID=${GENERIC_CLIENT_ID}
-      - GENERIC_CLIENT_SECRET=${GENERIC_CLIENT_SECRET}
-      - GENERIC_AUTH_URL=${GENERIC_AUTH_URL}
-      - GENERIC_TOKEN_URL=${GENERIC_TOKEN_URL}
-      - GENERIC_USER_URL=${GENERIC_USER_URL}
-      - GENERIC_SCOPES=${GENERIC_SCOPES}
-    networks:
-      - frontend
-
-networks:
-  frontend:
-    external: true

.templates/valkey-without-pswd.yaml

@@ -9,7 +9,7 @@ services:
     ports:
       - ${VALKEY_PORT}:6379
     healthcheck:
-      test: ["CMD-SHELL", valkey-cli ping | grep PONG"]
+      test: ["CMD-SHELL", "valkey-cli ping | grep PONG"]
       interval: 10s
       timeout: 5s
       retries: 3

adminer/compose.yaml

@@ -1,7 +1,7 @@
 services:
   adminer:
     container_name: adminer
-    image: docker.io/library/adminer:5.4.1@sha256:a3167350c4eb9ae4473b8ea0f49c8e5ae74c87b240ee2f6086521dba2a6bf243
+    image: docker.io/library/adminer:5.4.2@sha256:16a72c6140f64d00a3a9edf8d3d3b18a7b0a29ca31b0453378d9eb71f01f9e34
     restart: unless-stopped
     ports:
       - ${PORT}:8080

backrest/compose.yaml

@@ -1,7 +1,7 @@
 services:
   backrest:
     container_name: backrest
-    image: docker.io/garethgeorge/backrest:v1.11.2@sha256:6ecf25925dafcb6b37ab871d23c1d424a6f5008191a631c0b520641ec22a3f84
+    image: docker.io/garethgeorge/backrest:v1.12.1@sha256:f4d34bd6fa985d13bdb6c01c5d8727e07708899afa9567d800808357d77b9fb0
     restart: unless-stopped
     hostname: ${HOSTNAME}
     environment:

caddy-cloudflare-ddns-crowdsec/compose.yaml

@@ -1,7 +1,7 @@
 services:
   crowdsec:
     container_name: crowdsec
-    image: ghcr.io/crowdsecurity/crowdsec:v1.7.6@sha256:63b595fef92de1778573b375897a45dd226637ee9a3d3db9f57ac7355c369493
+    image: ghcr.io/crowdsecurity/crowdsec:v1.7.7@sha256:6ca53ad26196ca59ddd4fa692a586b73d8fcde085046163b9ca2f04887dca563
     restart: unless-stopped
     environment:
       - BOUNCER_KEY_CADDY=${CROWDSEC_API_KEY}
@@ -23,7 +23,7 @@ services:
 
   caddy:
     container_name: caddy
-    image: ghcr.io/ryuupendragon/caddy-cloudflare-ddns-crowdsec:2.10.2@sha256:7fda252e869c7e9b7bb55d78a8c60d0184cda4ffad78217460fac5fd5956accc
+    image: ghcr.io/ryuupendragon/caddy-cloudflare-ddns-crowdsec:2.11.2@sha256:ba26a5f05c825d61f5ca6f43de368a3e01013c10b592bfe5fcd187d9328b6289
     restart: unless-stopped
     depends_on:
       crowdsec:

dockhand/compose.yaml

@@ -0,0 +1,44 @@
+services:
+  dockhand_db:
+    container_name: dockhand_db
+    image: docker.io/library/postgres:18.3@sha256:a9abf4275f9e99bff8e6aed712b3b7dfec9cac1341bba01c1ffdfce9ff9fc34a
+    restart: unless-stopped
+    environment:
+      - POSTGRES_USER=${POSTGRES_USER}
+      - POSTGRES_PASSWORD=${POSTGRES_PASSWORD}
+      - POSTGRES_DB=${POSTGRES_DB}
+      - PGDATA=/var/lib/postgresql/18/docker
+    volumes:
+      - ./db:/var/lib/postgresql
+    networks:
+      - backend
+    healthcheck:
+      test: ["CMD-SHELL", "pg_isready -d ${POSTGRES_DB} -U ${POSTGRES_USER}"]
+      interval: 10s
+      timeout: 5s
+      retries: 3
+      start_period: 10s
+
+  dockhand:
+    container_name: dockhand
+    image: fnsys/dockhand:v1.0.22@sha256:3f38c995dfdb1f51f07ffb796162b445744456c2b8a1929c33a8b0593250892e
+    restart: unless-stopped
+    depends_on:
+      dockhand_db:
+        condition: service_healthy
+    environment:
+      - DATABASE_URL=postgres://${POSTGRES_USER}:${POSTGRES_PASSWORD}@dockhand_db:5432/${POSTGRES_DB}
+    volumes:
+      - ./data:/app/data
+      - /var/run/docker.sock:/var/run/docker.sock
+    ports:
+      - 3000:3000
+    networks:
+      - frontend
+      - backend
+
+networks:
+  frontend:
+    external: true
+  backend:
+    external: true

forgejo/compose.yaml

@@ -1,7 +1,7 @@
 services:
   forgejo:
     container_name: forgejo
-    image: codeberg.org/forgejo/forgejo:14.0.2-rootless@sha256:5552c9e25f353760420b8ac7a7f0f0a788ff571bbfd8e2c1e93503d3e2e1b87a
+    image: codeberg.org/forgejo/forgejo:14.0.3-rootless@sha256:3bde16a366e57f37c09599b77ceb83ed05b1934f8224072f8140bc66cf243608
     restart: unless-stopped
     user: ${PUID}:${PGID}
     volumes:

gitea-runner/compose.yaml

@@ -1,7 +1,7 @@
 services:
   gitea_runner:
     container_name: gitea_runner
-    image: docker.io/gitea/act_runner:0.2.13@sha256:8477d5b61b655caad4449888bae39f1f34bebd27db56cb15a62dccb3dcf3a944
+    image: docker.io/gitea/act_runner:0.3.1@sha256:c2a169c5e99864c25e32527cef3d82203225e09558773022bf3dc164a2e6d762
     restart: unless-stopped
     environment:
       CONFIG_FILE: /config.yml
@@ -12,3 +12,5 @@ services:
       - ./config.yml:/config.yml
       - ./data:/data
       - /var/run/docker.sock:/var/run/docker.sock
+    ports:
+      - ${PORT}:${PORT}

gitea-runner/config.yml

@@ -32,31 +32,40 @@ runner:
   fetch_timeout: 5s
   # The interval for fetching the job from the Gitea instance.
   fetch_interval: 2s
+  # The github_mirror of a runner is used to specify the mirror address of the github that pulls the action repository.
+  # It works when something like `uses: actions/checkout@v4` is used and DEFAULT_ACTIONS_URL is set to github,
+  # and github_mirror is not empty. In this case,
+  # it replaces https://github.com with the value here, which is useful for some special network environments.
+  github_mirror: ''
   # The labels of a runner are used to determine which jobs the runner can run, and how to run them.
   # Like: "macos-arm64:host" or "ubuntu-latest:docker://docker.gitea.com/runner-images:ubuntu-latest"
   # Find more images provided by Gitea at https://gitea.com/docker.gitea.com/runner-images .
   # If it's empty when registering, it will ask for inputting labels.
   # If it's empty when execute `daemon`, will use labels in `.runner` file.
   labels:
-    - "ubuntu-latest:docker://docker.gitea.com/runner-images:ubuntu-latest"
-    - "ubuntu-arm64:docker://docker.gitea.com/runner-images:ubuntu-latest"
-    - "ubuntu-22.04:docker://docker.gitea.com/runner-images:ubuntu-22.04"
-    - "ubuntu-cat:docker://ghcr.io/catthehacker/ubuntu:act-latest"
-    - "bookworm:docker://node:20-bookworm"
-    - "bookworm-slim:docker://node:24-bookworm-slim"
-    - "bullseye:docker://node:20-bullseye"
-    - "bullseye-slim:docker://node:20-bullseye-slim"
+    - "ubuntu-latest:docker://ghcr.io/catthehacker/ubuntu:act-24.04"
+    - "ubuntu-latest-full:docker://ghcr.io/catthehacker/ubuntu:full-24.04"
+    - "ubuntu-arm64:docker://ghcr.io/catthehacker/ubuntu:act-24.04"
+    - "ubuntu-arm64-full:docker://ghcr.io/catthehacker/ubuntu:full-24.04"
+    - "ubuntu-22.04:docker://ghcr.io/catthehacker/ubuntu:act-22.04"
+    - "ubuntu-22.04-full:docker://ghcr.io/catthehacker/ubuntu:full-22.04"
+    - "trixie:docker://node:25-trixie"
+    - "trixie-slim:docker://node:25-trixie-slim"
+    - "bookworm:docker://node:25-bookworm"
+    - "bookworm-slim:docker://node:25-bookworm-slim"
+    - "bullseye:docker://node:25-bullseye"
+    - "bullseye-slim:docker://node:25-bullseye-slim"
 
 cache:
   # Enable cache server to use actions/cache.
-  enabled: false
+  enabled: true
   # The directory to store the cache data.
   # If it's empty, the cache data will be stored in $HOME/.cache/actcache.
   dir: ""
   # The host of the cache server.
   # It's not for the address to listen, but the address to connect from job containers.
   # So 0.0.0.0 is a bad choice, leave it empty to detect automatically.
-  host: ""
+  host: "IP"
   # The port of the cache server.
   # 0 means to use a random available port.
   port: 0
@@ -99,6 +108,10 @@ container:
   force_pull: true
   # Rebuild docker image(s) even if already present
   force_rebuild: false
+  # Always require a reachable docker daemon, even if not required by act_runner
+  require_docker: false
+  # Timeout to wait for the docker daemon to be reachable, if docker is required by require_docker or act_runner
+  docker_timeout: 0s
 
 host:
   # The parent directory of a job's working directory.

gitea-runner/docker-compose-multi.yml

@@ -1,42 +0,0 @@
-services:
-  gitea_runner1:
-    container_name: gitea_runner1
-    image: docker.io/gitea/act_runner:0.2.13@sha256:8477d5b61b655caad4449888bae39f1f34bebd27db56cb15a62dccb3dcf3a944
-    restart: unless-stopped
-    environment:
-      CONFIG_FILE: /config.yml
-      GITEA_INSTANCE_URL: "${INSTANCE_URL}"
-      GITEA_RUNNER_REGISTRATION_TOKEN: "${REGISTRATION_TOKEN}"
-      GITEA_RUNNER_NAME: "${RUNNER_NAME1}"
-    volumes:
-      - ./config.yml:/config.yml
-      - ./data1:/data
-      - /var/run/docker.sock:/var/run/docker.sock
-
-  gitea_runner2:
-    container_name: gitea_runner2
-    image: docker.io/gitea/act_runner:0.2.13@sha256:8477d5b61b655caad4449888bae39f1f34bebd27db56cb15a62dccb3dcf3a944
-    restart: unless-stopped
-    environment:
-      CONFIG_FILE: /config.yml
-      GITEA_INSTANCE_URL: "${INSTANCE_URL}"
-      GITEA_RUNNER_REGISTRATION_TOKEN: "${REGISTRATION_TOKEN}"
-      GITEA_RUNNER_NAME: "${RUNNER_NAME2}"
-    volumes:
-      - ./config.yml:/config.yml
-      - ./data2:/data
-      - /var/run/docker.sock:/var/run/docker.sock
-
-  gitea_runner3:
-    container_name: gitea_runner3
-    image: docker.io/gitea/act_runner:0.2.13@sha256:8477d5b61b655caad4449888bae39f1f34bebd27db56cb15a62dccb3dcf3a944
-    restart: unless-stopped
-    environment:
-      CONFIG_FILE: /config.yml
-      GITEA_INSTANCE_URL: "${INSTANCE_URL}"
-      GITEA_RUNNER_REGISTRATION_TOKEN: "${REGISTRATION_TOKEN}"
-      GITEA_RUNNER_NAME: "${RUNNER_NAME3}"
-    volumes:
-      - ./config.yml:/config.yml
-      - ./data3:/data
-      - /var/run/docker.sock:/var/run/docker.sock

gotify/compose.yaml

@@ -1,7 +1,7 @@
 services:
   gotify:
     container_name: gotify
-    image: ghcr.io/gotify/server:2.8.0@sha256:4702c392ca723d5016fc938c8b22572c3509efca812bdc5221d25158ba0201e3
+    image: ghcr.io/gotify/server:2.9.1@sha256:a3af47067ce6aad76aadf5ba32d6ddfecd1ae576a961359f039fd1831e8b7652
     restart: unless-stopped
     environment:
       - TZ=${TZ}

hawser/compose.yaml

@@ -0,0 +1,19 @@
+services:
+  hawser:
+    container_name: hawser
+    image: ghcr.io/finsys/hawser:0.2.39@sha256:03c9f31205f7b5ee7aef55bf3058d050fe4ac8a745029c19107eaa0c34ef3422
+    restart: unless-stopped
+    environment:
+      - TOKEN=${TOKEN}
+      - LOG_LEVEL=${LOG_LEVEL}
+    volumes:
+      - ./stacks:/data/stacks
+      - /var/run/docker.sock:/var/run/docker.sock
+    ports:
+      - 2376:2376
+    networks:
+      - frontend
+
+networks:
+  frontend:
+    external: true

healthchecks/compose.yaml

@@ -1,7 +1,7 @@
 services:
   healthchecks:
     container_name: healthchecks
-    image: ghcr.io/linuxserver/healthchecks:4.0.20260202@sha256:16c65ccd983365780c949292434744c2f80bc154b9e6d082e5aa6f2aecf250d0
+    image: ghcr.io/linuxserver/healthchecks:4.1.20260323@sha256:9284fb75cc62aafebb01eceef41f1630cc5c97c25ea2e310083e9799f36836f3
     restart: unless-stopped
     environment:
       - PUID=${PUID}

home-assistant/compose.yaml

@@ -1,7 +1,7 @@
 services:
   home-assistant:
     container_name: home-assistant
-    image: ghcr.io/home-assistant/home-assistant:2026.1.3@sha256:c36741490472518338323db8ee67775d7df70d2fa1f68eff9b9e63679fe64a18
+    image: ghcr.io/home-assistant/home-assistant:2026.4.0@sha256:7fbf6a5e006e889d7799476ad7646bd18e9dc73e8a4ccd9326b41798de6bb3bf
     restart: unless-stopped
     volumes:
       - ${APPDATA_PATH}/home-assistant/config:/config

homepage/compose-docker.yaml

@@ -1,7 +1,7 @@
 services:
   homepage_socket_proxy:
     container_name: homepage_socket_proxy
-    image: ghcr.io/11notes/socket-proxy:2.1.6@sha256:2f4e605a5441b31389a95ef942af45927e8df4df4e974cfa271a388799d4f87b
+    image: ghcr.io/11notes/socket-proxy:2.1.7@sha256:6806f9b3cfe64325ae2dc967381412e415d868c9542753962fd2e73f4f9686f1
     restart: unless-stopped
     read_only: true
     user: ${SOCKET_UID}:${SOCKET_GID}
@@ -15,7 +15,7 @@ services:
 
   homepage:
     container_name: homepage
-    image: ghcr.io/gethomepage/homepage:v1.9.0@sha256:7fa7b07a26bd8d90a44bb975c6455b10d8dee467ce674b040750ffb4a0f486d6
+    image: ghcr.io/gethomepage/homepage:v1.12.3@sha256:cc84f2f5eb3c7734353701ccbaa24ed02dacb0d119114e50e4251e2005f3990a
     restart: unless-stopped
     depends_on:
       homepage_socket_proxy:

homepage/compose.yaml

@@ -1,7 +1,7 @@
 services:
   homepage:
     container_name: homepage
-    image: ghcr.io/gethomepage/homepage:v1.9.0@sha256:7fa7b07a26bd8d90a44bb975c6455b10d8dee467ce674b040750ffb4a0f486d6
+    image: ghcr.io/gethomepage/homepage:v1.12.3@sha256:cc84f2f5eb3c7734353701ccbaa24ed02dacb0d119114e50e4251e2005f3990a
     restart: unless-stopped
     environment:
       - PUID=${PUID}

kiwix/compose.yaml

@@ -1,12 +1,12 @@
 services:
   kiwix:
     container_name: kiwix
-    image: ghcr.io/kiwix/kiwix-serve:3.8.1@sha256:a105ef4c6791741224f0f6883fc391c4fe8bd25307be286e631d0a52e8777ef7
+    image: ghcr.io/kiwix/kiwix-serve:3.8.2@sha256:0b6541355b250c6b45d2d7725e88f22f1d6a0f45ad9480d9c0bd4bc58436a12f
     restart: unless-stopped
     command:
       - '*.zim'
     volumes:
-      - ${APPDATA_PATH}/kiwix/data:/data
+      - ${DATA_PATH}:/data
     ports:
       - ${PORT}:8080
     networks:

lldap/compose.yaml

@@ -1,7 +1,7 @@
 services:
   lldap_db:
     container_name: lldap_db
-    image: docker.io/library/postgres:18.1@sha256:f42fe58fa146f29072559fcb855cc2e93e2c9ab08c1cbe7c5db4973d665e3d86
+    image: docker.io/library/postgres:18.3@sha256:a9abf4275f9e99bff8e6aed712b3b7dfec9cac1341bba01c1ffdfce9ff9fc34a
     restart: unless-stopped
     environment:
       - POSTGRES_USER=${POSTGRES_USER}

pi-hole/compose.yaml

@@ -0,0 +1,66 @@
+services:
+  unbound_valkey:
+    container_name: unbound_valkey
+    image: ghcr.io/valkey-io/valkey:9.0.3@sha256:3b55fbaa0cd93cf0d9d961f405e4dfcc70efe325e2d84da207a0a8e6d8fde4f9
+    restart: unless-stopped
+    hostname: unbound_valkey
+    volumes:
+      - ./valkey-data:/data
+    networks:
+      - backend
+    healthcheck:
+      test: ["CMD-SHELL", "valkey-cli ping | grep PONG"]
+      interval: 10s
+      timeout: 5s
+      retries: 3
+      start_period: 10s
+
+  unbound:
+    container_name: unbound
+    image: klutchell/unbound:1.24.2@sha256:cb9a0f06c803c764395e2ff50bd8a244470601290c78fb2cdcf1bd200a027cd6
+    restart: unless-stopped
+    depends_on:
+      unbound_valkey:
+        condition: service_healthy
+    volumes:
+      - ./unbound.conf:/etc/unbound/unbound.conf
+      - ./unbound-custom-conf:/etc/unbound/custom.conf.d
+    ports:
+      - 5354:53
+      - 5354:53/udp
+    networks:
+      - backend
+    healthcheck:
+      test: ['CMD', 'drill-hc', '@127.0.0.1', 'dnssec.works']
+      interval: 10s
+      timeout: 5s
+      retries: 3
+      start_period: 10s
+
+  pihole:
+    container_name: pihole
+    image: ghcr.io/pi-hole/pihole:2026.02.0@sha256:ee348529cea9601df86ad94d62a39cad26117e1eac9e82d8876aa0ec7fe1ba27
+    restart: unless-stopped
+    cap_add:
+      - SYS_NICE
+    environment:
+      - TZ=${TZ}
+      - FTLCONF_dns_upstreams=unbound
+      - FTLCONF_dns_listeningMode=all
+      - FTLCONF_webserver_api_password=${FTLCONF_webserver_api_password}
+    volumes:
+      - ./pihole:/etc/pihole
+    ports:
+      - 5355:53/tcp
+      - 5355:53/udp
+      - 8055:80/tcp
+      - 4435:443/tcp
+    networks:
+      - frontend
+      - backend
+
+networks:
+  frontend:
+    external: true
+  backend:
+    external: true

pocket-id/compose.yaml

@@ -1,7 +1,7 @@
 services:
   pocket-id-db:
     container_name: pocket-id-db
-    image: docker.io/library/postgres:18.1@sha256:f42fe58fa146f29072559fcb855cc2e93e2c9ab08c1cbe7c5db4973d665e3d86
+    image: docker.io/library/postgres:18.3@sha256:a9abf4275f9e99bff8e6aed712b3b7dfec9cac1341bba01c1ffdfce9ff9fc34a
     restart: unless-stopped
     environment:
       - POSTGRES_USER=${POSTGRES_USER}
@@ -21,7 +21,7 @@ services:
 
   pocket-id:
     container_name: pocket-id
-    image: ghcr.io/pocket-id/pocket-id:v2.2.0-distroless@sha256:ad2d21a7b31d6b4f1d999caec794a5b5edeb97fc40801947158d62befd4203e3
+    image: ghcr.io/pocket-id/pocket-id:v2.5.0-distroless@sha256:deadc3c4dd6655a7d7f959200db1c74e394942dc061e6f3732b709983a08aab7
     restart: unless-stopped
     depends_on:
       pocket-id-db:

portainer-agent/compose.yaml

@@ -1,7 +1,7 @@
 services:
   portainer-agent:
     container_name: portainer-agent
-    image: docker.io/portainer/agent:alpine@sha256:ed5316f84203feaf1f60e4e01ab43537bf898b2dcc86a9293bf806f6854dd42c
+    image: docker.io/portainer/agent:alpine@sha256:d8c70d6c1174248796827182abb1ea8f9ea4869b32967af694cf472c3ec2c2a1
     restart: unless-stopped
     volumes:
       - /var/run/docker.sock:/var/run/docker.sock

portainer/compose.yaml

@@ -1,7 +1,7 @@
 services:
   portainer:
     container_name: portainer
-    image: docker.io/portainer/portainer-ee:alpine@sha256:695b36e17bd46fdfd29cc3dc1e113af05234edb222af75fbeccc5335fc859d3d
+    image: docker.io/portainer/portainer-ee:alpine@sha256:892d1e5458f17f87735390b8049e1dc535c3fdba120f2a66e4411e099cff1550
     restart: unless-stopped
     volumes:
       - ./data:/data

renovate.json

@@ -6,6 +6,7 @@
   "labels": ["renovate"],
   "configMigration": true,
   "prHourlyLimit": 0,
+  "prConcurrentLimit": 0,
   "ignorePaths": [".archived/", "**/node_modules/**", "**/vendor/**"],
   "docker-compose": {
     "hostRules": [

selfhst-icons/compose.yaml

@@ -0,0 +1,25 @@
+services:
+  selfhst-icons:
+    container_name: selfhst-icons
+    image: ghcr.io/selfhst/icons:4.0.2@sha256:ea70ba79e0e5126bb3ac191c595cdb74e5ae3d90dc95caf3cbda99e8d4b6c8ba
+    restart: unless-stopped
+    environment:
+      - ICON_SOURCE=remote
+      - REMOTE_URL=${REMOTE_URL}
+      - PRIMARY_COLOR=${PRIMARY_COLOR}
+      - CACHE_TTL=${CACHE_TTL}
+      - CACHE_SIZE=${CACHE_SIZE}
+    ports:
+      - ${PORT}:4050
+    networks:
+      - frontend
+    healthcheck:
+      test: ["CMD", "/server", "-healthcheck"]
+      interval: 30s
+      timeout: 5s
+      retries: 3
+      start_period: 5s
+
+networks:
+  frontend:
+    external: true

uptime-kuma/compose.yaml

@@ -1,7 +1,7 @@
 services:
   uptime-kuma:
     container_name: uptime-kuma
-    image: ghcr.io/louislam/uptime-kuma:2.0.2@sha256:4c364ef96aaddac7ec4c85f5e5f31c3394d35f631381ccbbf93f18fd26ac7cba
+    image: ghcr.io/louislam/uptime-kuma:2.2.1@sha256:7337368a77873f159435de9ef09567f68c31285ed5f951dec36256c4b267ee44
     restart: unless-stopped
     volumes:
       - ${APPDATA_PATH}/uptime-kuma/config:/app/data