chore(k8s/gitea): update gitea/gitea:1.26.1-rootless docker digest to 4c42564

README.md

@@ -26,6 +26,7 @@ homelab-v2/
     │   └── configs/        # ClusterIssuer, MetalLB config
     ├── app/
     │   ├── archmirror/
+    │   ├── blog/
     │   ├── external/       # External service vars (e.g. Home Assistant)
     │   ├── firefly/
     │   ├── gitea/
@@ -58,6 +59,7 @@ homelab-v2/
 | **Homepage** | Dashboard aggregator |
 | **Podsync** | Podcast downloader |
 | **Archmirror** | Local Arch Linux package repository mirror |
+| **Blog** | Personal static blog served via git-sync + nginx (gh-pages branch) |
 
 ## Infrastructure Stack
 

kubernetes/app/blog/deployment.yaml

@@ -29,7 +29,10 @@ spec:
           imagePullPolicy: IfNotPresent
           env:
             - name: GITSYNC_REPO
-              value: "https://${GITEA_HOST}/oleksandr/blog.git"
+              valueFrom:
+                secretKeyRef:
+                  name: blog-git-credentials
+                  key: GITSYNC_REPO
             - name: GITSYNC_ROOT
               value: "/git"
             - name: GITSYNC_REF
@@ -64,7 +67,7 @@ spec:
               memory: 128Mi
       containers:
         - name: nginx
-          image: nginxinc/nginx-unprivileged:1.28.3-alpine3.23
+          image: nginxinc/nginx-unprivileged:1.30.0-alpine3.23
           imagePullPolicy: IfNotPresent
           ports:
             - containerPort: 8080
@@ -102,7 +105,10 @@ spec:
           imagePullPolicy: IfNotPresent
           env:
             - name: GITSYNC_REPO
-              value: "https://${GITEA_HOST}/oleksandr/blog.git"
+              valueFrom:
+                secretKeyRef:
+                  name: blog-git-credentials
+                  key: GITSYNC_REPO
             - name: GITSYNC_ROOT
               value: "/git"
             - name: GITSYNC_REF

kubernetes/app/blog/secret.sops.yaml

@@ -6,6 +6,7 @@ metadata:
 stringData:
     GITSYNC_USERNAME: ENC[AES256_GCM,data:6cZnsgZ53xsU,iv:j2qvZr+odimHPnlMKz9xTe8q+zXvyRDF9spH8TkcmBw=,tag:ik6DJ4cMfcNc5UHY5vRy3A==,type:str]
     GITSYNC_PASSWORD: ENC[AES256_GCM,data:mjQJuOuH2YQ1i1JVO+lFZ7WYLmy4RjCi2xZRErU5hRNi2SdgRo0fwg==,iv:9pl3nVmlnynJ4jMke1Hy4ACBuMyM+65vmGR2kS705I0=,tag:K1dQ9YwVN0sZjieAOU3KWw==,type:str]
+    GITSYNC_REPO: ENC[AES256_GCM,data:ETjdkCP/PSa6HSD9M6JdvWbci/lRwegzzyuPb/IQmX58sxwqT2gUjooVKtcylzsE,iv:kOpvSQYznyxfmLjrehdRuEtwevoceDo0h/vbXTuu/i8=,tag:x+DEmoZUxRN6OksDJ9mQIQ==,type:str]
 sops:
     age:
         - enc: |
@@ -18,6 +19,6 @@ sops:
             -----END AGE ENCRYPTED FILE-----
           recipient: age1zffnskvuezntkk703a0pyxsd5m8vx2hm33dr47wdfy8mn4fdw4sqgw0jgc
     encrypted_regex: ^(data|stringData|email)$
-    lastmodified: "2026-05-11T19:21:18Z"
+    lastmodified: "2026-05-11T19:25:53Z"
-    mac: ENC[AES256_GCM,data:/G7ttapGuQ942iVOeUGqIlCUm+yCFmmxbD4AWRJW/TCJkXI/krkGrDGPX8eQ2BLO9yWga93Ni+fm5tTwGd9mhg9+JkiMMrIoQHb8hm+HqZwFoW3KtxrcLPg0Gi973ecbXkrKszLWqBlBJPU8iuHg+6uicDsrE9TDKOUswc0HdQw=,iv:MISyqpFmGkVqldK1deix2auDXt6PPFXY+Z0A4q4iJwU=,tag:tn0XgaX9+/I89MRUqqcxDw==,type:str]
+    mac: ENC[AES256_GCM,data:jK/48Q7INbbcjZWASbS7ob1RrfDNm27jGnm1taL7hEMDC0k7n3igqlqSHmy7ZxCeUUe3Y+s7Jv9Ss1xITEPoUEYFphGrYeDUBVNtVfhBavTEaTPAuEv7WRA8xGpjXH0t9ernwwMyMQJRatazgX2jcc3rfzHMshs7cf5oeov15Zk=,iv:lg0ad1nDFDHBPv8Xvsn63V7SDPMo1p47gvSNFGJGw1I=,tag:fXatyOSOD/rCjEcpvDQpAw==,type:str]
     version: 3.13.0

kubernetes/app/gitea/renovate.json

@@ -0,0 +1,33 @@
+{
+  "customManagers": [
+    {
+      "customType": "regex",
+      "description": "Track gitea rootless image; chart appends -rootless to tag automatically",
+      "fileMatch": ["kubernetes/app/gitea/release\\.yaml$"],
+      "matchStrings": [
+        "(?<indentation>\\s+)# renovate: currentValue=(?<currentValue>[^\\s]+) currentDigest=(?<currentDigest>sha256:[a-f0-9]+)\\n\\s+tag: [^\\s]+\\n\\s+digest: [^\\s]+"
+      ],
+      "depNameTemplate": "gitea/gitea",
+      "datasourceTemplate": "docker",
+      "autoReplaceStringTemplate": "{{indentation}}# renovate: currentValue={{newValue}} currentDigest={{#if newDigest}}{{{newDigest}}}{{else}}{{{currentDigest}}}{{/if}}\n{{indentation}}tag: {{newMajor}}.{{newMinor}}.{{newPatch}}\n{{indentation}}digest: {{#if newDigest}}{{{newDigest}}}{{else}}{{{currentDigest}}}{{/if}}"
+    }
+  ],
+  "packageRules": [
+    {
+      "matchFileNames": ["kubernetes/app/gitea/**"],
+      "semanticCommitScope": "k8s/gitea"
+    },
+    {
+      "matchFileNames": ["kubernetes/app/gitea/**"],
+      "matchPackageNames": ["gitea/gitea"],
+      "matchUpdateTypes": ["patch", "minor"],
+      "automerge": true
+    },
+    {
+      "description": "Ignore infrastructure images",
+      "matchFileNames": ["kubernetes/app/gitea/**"],
+      "matchPackageNames": ["creativeprojects/resticprofile", "postgres"],
+      "enabled": false
+    }
+  ]
+}

renovate.json

@@ -5,7 +5,8 @@
     ":semanticCommits",
     "local>oleksandr/homelab//kubernetes/app/jellyfin/renovate.json",
     "local>oleksandr/homelab//kubernetes/app/media/renovate.json",
-    "local>oleksandr/homelab//kubernetes/app/immich/renovate.json"
+    "local>oleksandr/homelab//kubernetes/app/immich/renovate.json",
+    "local>oleksandr/homelab//kubernetes/app/gitea/renovate.json"
   ],
   "enabledManagers": ["kubernetes", "custom.regex"],
   "automergeType": "branch",