Update ghcr.io/fosrl/pangolin Docker tag to v1.18.1

Reviewed-on: #248

.archived/caddy-cloudflare/compose.yaml

@@ -1,6 +1,6 @@
 services:
   caddy:
-    image: ghcr.io/ryuupendragon/caddy-cloudflare:2.11.2@sha256:57fab8be6175f452b2ba98d1fbb54c76818560ae7067a0b80fb6cf037884e660
+    image: ghcr.io/ryuupendragon/caddy-cloudflare:2.11.2@sha256:ec153a5ca3522335d21bf144be0aad748b1542bf32198d65444a3ffa67180551
     container_name: caddy
     restart: unless-stopped
     cap_add:

.archived/pi-hole/compose.yaml

@@ -0,0 +1,66 @@
+services:
+  unbound_valkey:
+    container_name: unbound_valkey
+    image: ghcr.io/valkey-io/valkey:9.0.3@sha256:3b55fbaa0cd93cf0d9d961f405e4dfcc70efe325e2d84da207a0a8e6d8fde4f9
+    restart: unless-stopped
+    hostname: unbound_valkey
+    volumes:
+      - ./valkey-data:/data
+    networks:
+      - backend
+    healthcheck:
+      test: ["CMD-SHELL", "valkey-cli ping | grep PONG"]
+      interval: 10s
+      timeout: 5s
+      retries: 3
+      start_period: 10s
+
+  unbound:
+    container_name: unbound
+    image: klutchell/unbound:1.24.2@sha256:cb9a0f06c803c764395e2ff50bd8a244470601290c78fb2cdcf1bd200a027cd6
+    restart: unless-stopped
+    depends_on:
+      unbound_valkey:
+        condition: service_healthy
+    volumes:
+      - ./unbound.conf:/etc/unbound/unbound.conf
+      - ./unbound-custom-conf:/etc/unbound/custom.conf.d
+    ports:
+      - 5354:53
+      - 5354:53/udp
+    networks:
+      - backend
+    healthcheck:
+      test: ['CMD', 'drill-hc', '@127.0.0.1', 'dnssec.works']
+      interval: 10s
+      timeout: 5s
+      retries: 3
+      start_period: 10s
+
+  pihole:
+    container_name: pihole
+    image: ghcr.io/pi-hole/pihole:2026.02.0@sha256:ee348529cea9601df86ad94d62a39cad26117e1eac9e82d8876aa0ec7fe1ba27
+    restart: unless-stopped
+    cap_add:
+      - SYS_NICE
+    environment:
+      - TZ=${TZ}
+      - FTLCONF_dns_upstreams=unbound
+      - FTLCONF_dns_listeningMode=all
+      - FTLCONF_webserver_api_password=${FTLCONF_webserver_api_password}
+    volumes:
+      - ./pihole:/etc/pihole
+    ports:
+      - 5355:53/tcp
+      - 5355:53/udp
+      - 8055:80/tcp
+      - 4435:443/tcp
+    networks:
+      - frontend
+      - backend
+
+networks:
+  frontend:
+    external: true
+  backend:
+    external: true

.templates/valkey-without-pswd.yaml

@@ -9,7 +9,7 @@ services:
     ports:
       - ${VALKEY_PORT}:6379
     healthcheck:
-      test: ["CMD-SHELL", valkey-cli ping | grep PONG"]
+      test: ["CMD-SHELL", "valkey-cli ping | grep PONG"]
       interval: 10s
       timeout: 5s
       retries: 3

adminer/compose.yaml

@@ -1,7 +1,7 @@
 services:
   adminer:
     container_name: adminer
-    image: docker.io/library/adminer:5.4.2@sha256:16a72c6140f64d00a3a9edf8d3d3b18a7b0a29ca31b0453378d9eb71f01f9e34
+    image: docker.io/library/adminer:5.4.2@sha256:41898b976011fd87f2d3037366ad97f7d89fddfebc8aa8b3a7d77d0c465aa37b
     restart: unless-stopped
     ports:
       - ${PORT}:8080

caddy-cloudflare-ddns-crowdsec/compose.yaml

@@ -1,7 +1,7 @@
 services:
   crowdsec:
     container_name: crowdsec
-    image: ghcr.io/crowdsecurity/crowdsec:v1.7.6@sha256:63b595fef92de1778573b375897a45dd226637ee9a3d3db9f57ac7355c369493
+    image: ghcr.io/crowdsecurity/crowdsec:v1.7.7@sha256:6ca53ad26196ca59ddd4fa692a586b73d8fcde085046163b9ca2f04887dca563
     restart: unless-stopped
     environment:
       - BOUNCER_KEY_CADDY=${CROWDSEC_API_KEY}
@@ -23,7 +23,7 @@ services:
 
   caddy:
     container_name: caddy
-    image: ghcr.io/ryuupendragon/caddy-cloudflare-ddns-crowdsec:2.11.2@sha256:0e83c732a9905f2443680d9d95b2d83b4c7f23dc089d735cffae60dc14bf37cf
+    image: ghcr.io/ryuupendragon/caddy-cloudflare-ddns-crowdsec:2.11.2@sha256:ba26a5f05c825d61f5ca6f43de368a3e01013c10b592bfe5fcd187d9328b6289
     restart: unless-stopped
     depends_on:
       crowdsec:

dockhand/compose.yaml

@@ -1,7 +1,7 @@
 services:
   dockhand_db:
     container_name: dockhand_db
-    image: docker.io/library/postgres:18.2@sha256:9b5bd946f3a507db72c55959700e517463e8d5dbb6f7eb30d920d5bcf6951431
+    image: docker.io/library/postgres:18.3@sha256:78481659c47e862334611ccdaf7c369c986b3046da9857112f3b309114a65fb4
     restart: unless-stopped
     environment:
       - POSTGRES_USER=${POSTGRES_USER}
@@ -21,7 +21,7 @@ services:
 
   dockhand:
     container_name: dockhand
-    image: fnsys/dockhand:v1.0.18@sha256:81ee6728840ea99978d811d9dfa61e5445467e01502320fa7733bcf7e567d105
+    image: fnsys/dockhand:v1.0.27@sha256:8c2f62e215d257e3b17fd0d458d4fcd134f67c4ee495831b818004677ad57e3b
     restart: unless-stopped
     depends_on:
       dockhand_db:

forgejo/compose.yaml

@@ -1,7 +1,7 @@
 services:
   forgejo:
     container_name: forgejo
-    image: codeberg.org/forgejo/forgejo:14.0.3-rootless@sha256:3bde16a366e57f37c09599b77ceb83ed05b1934f8224072f8140bc66cf243608
+    image: codeberg.org/forgejo/forgejo:15.0.1-rootless@sha256:4f4d168b4e792d0f73e5f4da0548f3b54b9c9d03fb85f277c97eb985cb9a290a
     restart: unless-stopped
     user: ${PUID}:${PGID}
     volumes:

gitea-runner/compose.yaml

@@ -1,7 +1,7 @@
 services:
   gitea_runner:
     container_name: gitea_runner
-    image: docker.io/gitea/act_runner:0.3.0@sha256:8368754bb612a1deb07ed604e3b955338aefc01576d4d0d92e8dd82f29250fcd
+    image: docker.io/gitea/act_runner:0.6.0@sha256:b2df7d04d17334ff8e741c32b0df099d5df046d96599cb330d4ed7c097cb087f
     restart: unless-stopped
     environment:
       CONFIG_FILE: /config.yml

gotify/compose.yaml

@@ -1,7 +1,7 @@
 services:
   gotify:
     container_name: gotify
-    image: ghcr.io/gotify/server:2.9.0@sha256:4df8c1bb23646b8d8b308e881866474bfae4a9a5b3980e5047f87eb84017e8a0
+    image: ghcr.io/gotify/server:2.9.1@sha256:a3af47067ce6aad76aadf5ba32d6ddfecd1ae576a961359f039fd1831e8b7652
     restart: unless-stopped
     environment:
       - TZ=${TZ}

hawser/compose.yaml

@@ -1,7 +1,7 @@
 services:
   hawser:
     container_name: hawser
-    image: ghcr.io/finsys/hawser:0.2.29@sha256:b6f8eabb5e839a1950fae5302db5a96e98dbe63e928e8178c3ca682aed008e26
+    image: ghcr.io/finsys/hawser:0.2.41@sha256:53bb1e23fb302f337d70fe111affee5f30f476c56aeb33c6c8c1d510fdc4133c
     restart: unless-stopped
     environment:
       - TOKEN=${TOKEN}

healthchecks/compose.yaml

@@ -1,7 +1,7 @@
 services:
   healthchecks:
     container_name: healthchecks
-    image: ghcr.io/linuxserver/healthchecks:4.1.20260320@sha256:cd9dc54f1f1e9f209e1ac5d984203524d08307b53010b0c3e3b8206fe999e4d7
+    image: ghcr.io/linuxserver/healthchecks:4.2.20260428@sha256:2973440afcdcf5884b334782a70b7a7c292595810ad3a162f0289d2e878f2c80
     restart: unless-stopped
     environment:
       - PUID=${PUID}

home-assistant/compose.yaml

@@ -1,7 +1,7 @@
 services:
   home-assistant:
     container_name: home-assistant
-    image: ghcr.io/home-assistant/home-assistant:2026.3.2@sha256:572a5d030f652e9ef6c6d4f6631169af83eb3b739c9b4b3965669f5e9d9f3858
+    image: ghcr.io/home-assistant/home-assistant:2026.4.4@sha256:c1e5f0147f4cb51ccb05bb30b62a1269cc1bd48a6274792d3b38a77ab274dfd2
     restart: unless-stopped
     volumes:
       - ${APPDATA_PATH}/home-assistant/config:/config

homepage/compose-docker.yaml

@@ -15,7 +15,7 @@ services:
 
   homepage:
     container_name: homepage
-    image: ghcr.io/gethomepage/homepage:v1.11.0@sha256:b129cb0f674bd6d204e215bde2c2fc3f11d6ad0e82f6d20007cf80f74e1acbb1
+    image: ghcr.io/gethomepage/homepage:v1.12.3@sha256:cc84f2f5eb3c7734353701ccbaa24ed02dacb0d119114e50e4251e2005f3990a
     restart: unless-stopped
     depends_on:
       homepage_socket_proxy:

homepage/compose.yaml

@@ -1,7 +1,7 @@
 services:
   homepage:
     container_name: homepage
-    image: ghcr.io/gethomepage/homepage:v1.11.0@sha256:b129cb0f674bd6d204e215bde2c2fc3f11d6ad0e82f6d20007cf80f74e1acbb1
+    image: ghcr.io/gethomepage/homepage:v1.12.3@sha256:cc84f2f5eb3c7734353701ccbaa24ed02dacb0d119114e50e4251e2005f3990a
     restart: unless-stopped
     environment:
       - PUID=${PUID}

kiwix/compose.yaml

@@ -1,7 +1,7 @@
 services:
   kiwix:
     container_name: kiwix
-    image: ghcr.io/kiwix/kiwix-serve:3.8.1@sha256:9bffd4f940645d4d518f137e87b7865d3d0ef30f6c13fbe4a3b9e747be3cd1ad
+    image: ghcr.io/kiwix/kiwix-serve:3.8.2@sha256:0b6541355b250c6b45d2d7725e88f22f1d6a0f45ad9480d9c0bd4bc58436a12f
     restart: unless-stopped
     command:
       - '*.zim'

lldap/compose.yaml

@@ -1,7 +1,7 @@
 services:
   lldap_db:
     container_name: lldap_db
-    image: docker.io/library/postgres:18.2@sha256:9b5bd946f3a507db72c55959700e517463e8d5dbb6f7eb30d920d5bcf6951431
+    image: docker.io/library/postgres:18.3@sha256:78481659c47e862334611ccdaf7c369c986b3046da9857112f3b309114a65fb4
     restart: unless-stopped
     environment:
       - POSTGRES_USER=${POSTGRES_USER}

newt/compose.yaml

@@ -0,0 +1,10 @@
+services:
+  newt:
+    container_name: newt
+    image: fosrl/newt:1.12.2
+    restart: unless-stopped
+    environment:
+      - PANGOLIN_ENDPOINT=${PANGOLIN_ENDPOINT}
+      - NEWT_ID=${NEWT_ID}
+      - NEWT_SECRET=${NEWT_SECRET}
+    network_mode: host

pangolin/compose-local.yaml

@@ -0,0 +1,45 @@
+name: pangolin
+services:
+  pangolin:
+    container_name: pangolin
+    image: ghcr.io/fosrl/pangolin:1.18.1
+    restart: unless-stopped
+    deploy:
+      resources:
+        limits:
+          memory: 1g
+        reservations:
+          memory: 256m
+    volumes:
+      - ./config:/app/config
+    healthcheck:
+      test: ["CMD", "curl", "-f", "http://localhost:3001/api/v1/"]
+      interval: "10s"
+      timeout: "10s"
+      retries: 15
+
+  traefik:
+    container_name: traefik
+    image: ghcr.io/traefik/traefik:v3.6.14
+    restart: unless-stopped
+    depends_on:
+      pangolin:
+        condition: service_healthy
+    command:
+      - --configFile=/etc/traefik/traefik_config.yml
+    environment:
+      - CLOUDFLARE_DNS_API_TOKEN=${CLOUDFLARE_DNS_API_TOKEN}
+    volumes:
+      - ./config/traefik:/etc/traefik:ro # Volume to store the Traefik configuration
+      - ./config/letsencrypt:/letsencrypt # Volume to store the Let's Encrypt certificates
+      - ./config/traefik/logs:/var/log/traefik # Volume to store Traefik logs
+    ports:
+      - 443:443
+      - 80:80
+      - 22:22
+      - 2222:2222
+
+networks:
+  default:
+    driver: bridge
+    name: pangolin

pangolin/compose.yaml

@@ -0,0 +1,66 @@
+name: pangolin
+services:
+  pangolin:
+    container_name: pangolin
+    image: ghcr.io/fosrl/pangolin:1.18.1
+    restart: unless-stopped
+    volumes:
+      - ./config:/app/config
+    healthcheck:
+      test: ["CMD", "curl", "-f", "http://localhost:3001/api/v1/"]
+      interval: "10s"
+      timeout: "10s"
+      retries: 15
+
+  gerbil:
+    container_name: gerbil
+    image: ghcr.io/fosrl/gerbil:1.3.1
+    restart: unless-stopped
+    depends_on:
+      pangolin:
+        condition: service_healthy
+    command:
+      - --reachableAt=http://gerbil:3004
+      - --generateAndSaveKeyTo=/var/config/key
+      - --remoteConfig=http://pangolin:3001/api/v1/
+    cap_add:
+      - NET_ADMIN
+      - SYS_MODULE
+    volumes:
+      - ./config/:/var/config
+    ports:
+      - 51820:51820/udp
+      - 21820:21820/udp
+      - 443:443
+      - 80:80
+
+  traefik:
+    container_name: traefik
+    image: ghcr.io/traefik/traefik:v3.6.14
+    restart: unless-stopped
+    depends_on:
+      pangolin:
+        condition: service_healthy
+    command:
+      - --configFile=/etc/traefik/traefik_config.yml
+    environment:
+      - CLOUDFLARE_DNS_API_TOKEN=${CLOUDFLARE_DNS_API_TOKEN}
+    volumes:
+      - ./config/traefik:/etc/traefik:ro # Volume to store the Traefik configuration
+      - ./config/letsencrypt:/letsencrypt # Volume to store the Let's Encrypt certificates
+      - ./config/traefik/logs:/var/log/traefik # Volume to store Traefik logs
+    network_mode: service:gerbil # Ports appear on the gerbil service
+
+  webfinger:              # For Tailscale
+    container_name: webfinger
+    image: nginx:1.30.0-alpine
+    volumes:
+      - ./webfinger/webfinger.json:/usr/share/nginx/html/.well-known/webfinger:ro
+      - ./webfinger/nginx.conf:/etc/nginx/conf.d/default.conf:ro
+    restart: unless-stopped
+
+networks:
+  default:
+    driver: bridge
+    name: pangolin
+    enable_ipv6: true # activate if your system supports IPv6

pocket-id/compose.yaml

@@ -1,7 +1,7 @@
 services:
   pocket-id-db:
     container_name: pocket-id-db
-    image: docker.io/library/postgres:18.2@sha256:9b5bd946f3a507db72c55959700e517463e8d5dbb6f7eb30d920d5bcf6951431
+    image: docker.io/library/postgres:18.3@sha256:78481659c47e862334611ccdaf7c369c986b3046da9857112f3b309114a65fb4
     restart: unless-stopped
     environment:
       - POSTGRES_USER=${POSTGRES_USER}
@@ -21,7 +21,7 @@ services:
 
   pocket-id:
     container_name: pocket-id
-    image: ghcr.io/pocket-id/pocket-id:v2.4.0-distroless@sha256:e3e0fa59d06f6651448766e279077929694a644865759264f941a700f67d13eb
+    image: ghcr.io/pocket-id/pocket-id:v2.6.2-distroless@sha256:a9adc636b5d30098307b8a1292c5887a59690cd5429aac5e87b588852f9c346d
     restart: unless-stopped
     depends_on:
       pocket-id-db:

portainer-agent/compose.yaml

@@ -1,7 +1,7 @@
 services:
   portainer-agent:
     container_name: portainer-agent
-    image: docker.io/portainer/agent:alpine@sha256:6cabee7b641c927474bc06a77b49cbdc2754acf05e8f5cc8248e4ca84fccb7b8
+    image: docker.io/portainer/agent:alpine@sha256:d8c70d6c1174248796827182abb1ea8f9ea4869b32967af694cf472c3ec2c2a1
     restart: unless-stopped
     volumes:
       - /var/run/docker.sock:/var/run/docker.sock

portainer/compose.yaml

@@ -1,7 +1,7 @@
 services:
   portainer:
     container_name: portainer
-    image: docker.io/portainer/portainer-ee:alpine@sha256:eb3ad2004dfc15b6aa7b71b27017e756d8b7c016b7e7f2989a13eec96e734ac1
+    image: docker.io/portainer/portainer-ee:alpine@sha256:892d1e5458f17f87735390b8049e1dc535c3fdba120f2a66e4411e099cff1550
     restart: unless-stopped
     volumes:
       - ./data:/data