Update N8N_IMAGE (docker.n8n.io/n8nio/n8n) to v3

grist/docker-compose.yml

@@ -1,6 +1,6 @@
 services:
   grist:
-    image: ${GRIST_IMAGE:?set in versions.env}
+    image: gristlabs/grist:1.7.21
     restart: unless-stopped
     ports:
       - "8484:8484"

nametag/docker-compose.yml

@@ -3,7 +3,7 @@
 
 services:
   db:
-    image: ${NAMETAG_POSTGRES_IMAGE:?set in versions.env}
+    image: postgres:16.15-alpine
     container_name: nametag-db
     restart: always
     environment:
@@ -23,7 +23,7 @@ services:
       - nametag-network
 
   redis: # Optional. Comment out to disable Redis. See README.md for more details.
-    image: ${NAMETAG_REDIS_IMAGE:?set in versions.env}
+    image: redis:7.4.11-alpine
     container_name: nametag-redis
     restart: always
     command: redis-server --requirepass ${REDIS_PASSWORD:?Redis password required}
@@ -40,7 +40,7 @@ services:
       - nametag-network
 
   app:
-    image: ${NAMETAG_IMAGE:?set in versions.env}
+    image: ghcr.io/mattogodoy/nametag:0.66.0
     container_name: nametag-app
     restart: unless-stopped
     labels:
@@ -77,7 +77,7 @@ services:
 
   # Database backup service
   backup:
-    image: ${NAMETAG_BACKUP_IMAGE:?set in versions.env}
+    image: prodrigestivill/postgres-backup-local:16-alpine
     container_name: nametag-backup
     restart: always
     environment:
@@ -99,7 +99,7 @@ services:
 
   # Cron service for scheduled jobs
   cron:
-    image: ${NAMETAG_CRON_IMAGE:?set in versions.env}
+    image: alpine:3.24.3
     container_name: nametag-cron
     restart: always
     environment:

renovate.json

@@ -4,28 +4,33 @@
   "customManagers": [
     {
       "customType": "regex",
-      "description": "Image tags in versions.env",
+      "description": "Image tags in versions.env. The variable name is the display name, so PRs say which app they are for; the image is what gets looked up.",
       "managerFilePatterns": ["/^versions\\.env$/"],
       "matchStrings": [
-        "(?:^|\\n)[A-Z0-9_]+_IMAGE=(?<depName>[^:\\s]+):(?<currentValue>[^\\s@]+)"
+        "(?:^|\\n)(?<depName>[A-Z0-9_]+_IMAGE)=(?<packageName>[^:\\s]+):(?<currentValue>[^\\s@]+)"
       ],
       "datasourceTemplate": "docker"
     }
   ],
   "packageRules": [
+    {
+      "description": "Name both the variable and the image in versions.env PR titles",
+      "matchManagers": ["custom.regex"],
+      "commitMessageTopic": "{{{depName}}} ({{{packageName}}})"
+    },
     {
       "description": "Database majors need a dump/restore, so never propose them",
-      "matchDepNames": ["postgres", "prodrigestivill/postgres-backup-local"],
+      "matchPackageNames": ["postgres", "prodrigestivill/postgres-backup-local"],
       "matchUpdateTypes": ["major"],
       "enabled": false
     },
     {
       "description": "Stay on the 10.6 LTS line; 10.11 is effectively a major upgrade",
-      "matchDepNames": ["mariadb"],
+      "matchPackageNames": ["mariadb"],
       "allowedVersions": "/^10\\.6\\./"
     },
     {
-      "matchDepNames": ["amir20/dozzle"],
+      "matchPackageNames": ["amir20/dozzle"],
       "prBodyNotes": [
         "Also bump the Dozzle agents on the TrueNAS hosts to the same tag. The hub and agents share the TLS pair baked into the image."
       ]

supernote/docker-compose.yml

@@ -1,6 +1,6 @@
 services:
   mariadb:
-    image: ${SUPERNOTE_MARIADB_IMAGE:?set in versions.env}
+    image: mariadb:10.6.28
     container_name: mariadb
     environment:
       MYSQL_ROOT_PASSWORD: ${MYSQL_ROOT_PASSWORD}
@@ -24,7 +24,7 @@ services:
     restart: unless-stopped
 
   redis:
-    image: ${SUPERNOTE_REDIS_IMAGE:?set in versions.env}
+    image: redis:7.4.11
     container_name: redis
     environment:
       TZ: ${TZ:-UTC}
@@ -40,7 +40,7 @@ services:
       retries: 3
 
   notelib:
-    image: ${SUPERNOTE_NOTELIB_IMAGE:?set in versions.env}
+    image: docker.io/supernote/notelib:6.9.3
     container_name: notelib
     environment:
       TZ: ${TZ:-UTC}
@@ -49,7 +49,7 @@ services:
     restart: unless-stopped
 
   supernote-service:
-    image: ${SUPERNOTE_SERVICE_IMAGE:?set in versions.env}
+    image: docker.io/supernote/supernote-service:26.10.09
     container_name: supernote-service
     depends_on:
       mariadb:

versions.env

@@ -1,33 +1,3 @@
-# Central image versions for AtlasHorizon/compose.
-# Each compose file reads its images from here via ${VAR:?}; Ansible
-# downloads this next to docker-compose.yml and passes it as a second
-# --env-file. One variable per service+component, so e.g. each Postgres
-# can be upgraded independently (major bumps need a dump/restore).
-
-# --- grist ---
-GRIST_IMAGE=gristlabs/grist:1.7.21
-
-# --- domain-watchdog ---
-# App and worker must stay on the same version.
-DOMAIN_WATCHDOG_IMAGE=maelgangloff/domain-watchdog:v1.4.6
-# Major must match POSTGRES_VERSION in domain-watchdog's .env (used in DATABASE_URL).
-DOMAIN_WATCHDOG_POSTGRES_IMAGE=postgres:16.15-alpine
-DOMAIN_WATCHDOG_VALKEY_IMAGE=valkey/valkey:9.1.2
-
-# --- nametag ---
-NAMETAG_IMAGE=ghcr.io/mattogodoy/nametag:0.66.0
-NAMETAG_POSTGRES_IMAGE=postgres:16.15-alpine
-NAMETAG_REDIS_IMAGE=redis:7.4.11-alpine
-# Keep the major in line with NAMETAG_POSTGRES_IMAGE.
-NAMETAG_BACKUP_IMAGE=prodrigestivill/postgres-backup-local:16-alpine
-NAMETAG_CRON_IMAGE=alpine:3.24.3
-
-# --- supernote ---
-SUPERNOTE_MARIADB_IMAGE=mariadb:10.6.28
-SUPERNOTE_REDIS_IMAGE=redis:7.4.11
-SUPERNOTE_NOTELIB_IMAGE=docker.io/supernote/notelib:6.9.3
-SUPERNOTE_SERVICE_IMAGE=docker.io/supernote/supernote-service:26.10.09
-
 # --- monitor (Flatcar) ---
 # The hub and agents share the TLS pair baked into the image, so this must
 # match the agent tag on ai, oswald_runner, oswl_connector and the TrueNAS hosts.
@@ -44,10 +14,24 @@ OPENCODE_IMAGE=ghcr.io/anomalyco/opencode:1.19.4
 
 # --- oswald_runner (Flatcar) ---
 GITEA_RUNNER_IMAGE=docker.io/gitea/runner:3.5.0
-N8N_IMAGE=docker.n8n.io/n8nio/n8n:2.40.5
+N8N_IMAGE=docker.n8n.io/n8nio/n8n:3.1.0
 CISA_KEV_RSS_IMAGE=ghcr.io/xsaveopt/cisa-kev-rss:0.0.5
+DOMAIN_WATCHDOG_IMAGE=maelgangloff/domain-watchdog:v1.4.6
+# Major must match POSTGRES_VERSION in domain-watchdog's .env (used in DATABASE_URL).
+DOMAIN_WATCHDOG_POSTGRES_IMAGE=postgres:16.15-alpine
+DOMAIN_WATCHDOG_VALKEY_IMAGE=valkey/valkey:9.1.2
 # Domain Watchdog here shares DOMAIN_WATCHDOG_IMAGE and
 # DOMAIN_WATCHDOG_VALKEY_IMAGE with the compose deployment.
 
 # --- oswl_connector (Flatcar) ---
 TAILSCALE_IMAGE=docker.io/tailscale/tailscale:v1.104.2
+
+# --- utility (Flatcar) ---
+# cturra/ntp only publishes "latest", so it is pinned by digest (2025-11-30 build).
+NTP_IMAGE=cturra/ntp@sha256:7224d4e7c7833aabbcb7dd70c46c8a8dcccda365314c6db047b9b10403ace3bc
+APT_CACHER_NG_IMAGE=mbentley/apt-cacher-ng:trixie-20261026
+REGISTRY_CACHE_IMAGE=registry:3.1.2
+
+# --- phpipam (Flatcar) ---
+PHPIPAM_WWW_IMAGE=phpipam/phpipam-www:v1.8.3
+PHPIPAM_CRON_IMAGE=phpipam/phpipam-cron:v1.8.3