Update mariadb Docker tag to v10.6.28

.gitea/workflows/renovate.yml

@@ -9,7 +9,7 @@ jobs:
   renovate:
     runs-on: ubuntu-latest
     container:
-      image: ghcr.io/renovatebot/renovate:44.181.7
+      image: ghcr.io/renovatebot/renovate:44.181.6
     steps:
       - name: Run Renovate
         run: renovate

grist/docker-compose.yml

@@ -1,6 +1,6 @@
 services:
   grist:
-    image: gristlabs/grist:1.7.21
+    image: ${GRIST_IMAGE:?set in versions.env}
     restart: unless-stopped
     ports:
       - "8484:8484"

nametag/docker-compose.yml

@@ -3,7 +3,7 @@
 
 services:
   db:
-    image: postgres:16.15-alpine
+    image: ${NAMETAG_POSTGRES_IMAGE:?set in versions.env}
     container_name: nametag-db
     restart: always
     environment:
@@ -23,7 +23,7 @@ services:
       - nametag-network
 
   redis: # Optional. Comment out to disable Redis. See README.md for more details.
-    image: redis:7.4.11-alpine
+    image: ${NAMETAG_REDIS_IMAGE:?set in versions.env}
     container_name: nametag-redis
     restart: always
     command: redis-server --requirepass ${REDIS_PASSWORD:?Redis password required}
@@ -40,7 +40,7 @@ services:
       - nametag-network
 
   app:
-    image: ghcr.io/mattogodoy/nametag:0.66.0
+    image: ${NAMETAG_IMAGE:?set in versions.env}
     container_name: nametag-app
     restart: unless-stopped
     labels:
@@ -77,7 +77,7 @@ services:
 
   # Database backup service
   backup:
-    image: prodrigestivill/postgres-backup-local:16-alpine
+    image: ${NAMETAG_BACKUP_IMAGE:?set in versions.env}
     container_name: nametag-backup
     restart: always
     environment:
@@ -99,7 +99,7 @@ services:
 
   # Cron service for scheduled jobs
   cron:
-    image: alpine:3.24.3
+    image: ${NAMETAG_CRON_IMAGE:?set in versions.env}
     container_name: nametag-cron
     restart: always
     environment:

renovate.json

@@ -4,33 +4,28 @@
   "customManagers": [
     {
       "customType": "regex",
-      "description": "Image tags in versions.env. The variable name is the display name, so PRs say which app they are for; the image is what gets looked up.",
+      "description": "Image tags in versions.env",
       "managerFilePatterns": ["/^versions\\.env$/"],
       "matchStrings": [
-        "(?:^|\\n)(?<depName>[A-Z0-9_]+_IMAGE)=(?<packageName>[^:\\s]+):(?<currentValue>[^\\s@]+)"
+        "(?:^|\\n)[A-Z0-9_]+_IMAGE=(?<depName>[^:\\s]+):(?<currentValue>[^\\s@]+)"
       ],
       "datasourceTemplate": "docker"
     }
   ],
   "packageRules": [
-    {
-      "description": "Name both the variable and the image in versions.env PR titles",
-      "matchManagers": ["custom.regex"],
-      "commitMessageTopic": "{{{depName}}} ({{{packageName}}})"
-    },
     {
       "description": "Database majors need a dump/restore, so never propose them",
-      "matchPackageNames": ["postgres", "prodrigestivill/postgres-backup-local"],
+      "matchDepNames": ["postgres", "prodrigestivill/postgres-backup-local"],
       "matchUpdateTypes": ["major"],
       "enabled": false
     },
     {
       "description": "Stay on the 10.6 LTS line; 10.11 is effectively a major upgrade",
-      "matchPackageNames": ["mariadb"],
+      "matchDepNames": ["mariadb"],
       "allowedVersions": "/^10\\.6\\./"
     },
     {
-      "matchPackageNames": ["amir20/dozzle"],
+      "matchDepNames": ["amir20/dozzle"],
       "prBodyNotes": [
         "Also bump the Dozzle agents on the TrueNAS hosts to the same tag. The hub and agents share the TLS pair baked into the image."
       ]

supernote/docker-compose.yml

@@ -1,6 +1,6 @@
 services:
   mariadb:
-    image: mariadb:10.6.28
+    image: ${SUPERNOTE_MARIADB_IMAGE:?set in versions.env}
     container_name: mariadb
     environment:
       MYSQL_ROOT_PASSWORD: ${MYSQL_ROOT_PASSWORD}
@@ -24,7 +24,7 @@ services:
     restart: unless-stopped
 
   redis:
-    image: redis:7.4.11
+    image: ${SUPERNOTE_REDIS_IMAGE:?set in versions.env}
     container_name: redis
     environment:
       TZ: ${TZ:-UTC}
@@ -40,7 +40,7 @@ services:
       retries: 3
 
   notelib:
-    image: docker.io/supernote/notelib:6.9.3
+    image: ${SUPERNOTE_NOTELIB_IMAGE:?set in versions.env}
     container_name: notelib
     environment:
       TZ: ${TZ:-UTC}
@@ -49,7 +49,7 @@ services:
     restart: unless-stopped
 
   supernote-service:
-    image: docker.io/supernote/supernote-service:26.10.09
+    image: ${SUPERNOTE_SERVICE_IMAGE:?set in versions.env}
     container_name: supernote-service
     depends_on:
       mariadb:

versions.env

@@ -1,3 +1,33 @@
+# Central image versions for AtlasHorizon/compose.
+# Each compose file reads its images from here via ${VAR:?}; Ansible
+# downloads this next to docker-compose.yml and passes it as a second
+# --env-file. One variable per service+component, so e.g. each Postgres
+# can be upgraded independently (major bumps need a dump/restore).
+
+# --- grist ---
+GRIST_IMAGE=gristlabs/grist:1.7.21
+
+# --- domain-watchdog ---
+# App and worker must stay on the same version.
+DOMAIN_WATCHDOG_IMAGE=maelgangloff/domain-watchdog:v1.4.6
+# Major must match POSTGRES_VERSION in domain-watchdog's .env (used in DATABASE_URL).
+DOMAIN_WATCHDOG_POSTGRES_IMAGE=postgres:16.15-alpine
+DOMAIN_WATCHDOG_VALKEY_IMAGE=valkey/valkey:9.1.2
+
+# --- nametag ---
+NAMETAG_IMAGE=ghcr.io/mattogodoy/nametag:0.66.0
+NAMETAG_POSTGRES_IMAGE=postgres:16.15-alpine
+NAMETAG_REDIS_IMAGE=redis:7.4.11-alpine
+# Keep the major in line with NAMETAG_POSTGRES_IMAGE.
+NAMETAG_BACKUP_IMAGE=prodrigestivill/postgres-backup-local:16-alpine
+NAMETAG_CRON_IMAGE=alpine:3.24.3
+
+# --- supernote ---
+SUPERNOTE_MARIADB_IMAGE=mariadb:10.6.28
+SUPERNOTE_REDIS_IMAGE=redis:7.4.7
+SUPERNOTE_NOTELIB_IMAGE=docker.io/supernote/notelib:6.9.3
+SUPERNOTE_SERVICE_IMAGE=docker.io/supernote/supernote-service:26.06.04
+
 # --- monitor (Flatcar) ---
 # The hub and agents share the TLS pair baked into the image, so this must
 # match the agent tag on ai, oswald_runner, oswl_connector and the TrueNAS hosts.
@@ -7,31 +37,17 @@ ALERTA_IMAGE=alerta/alerta-web:9.1.0
 # --- ai (Flatcar) ---
 GITEA_MCP_IMAGE=docker.gitea.com/gitea-mcp-server:1.11.0
 LITELLM_IMAGE=docker.litellm.ai/berriai/litellm:v1.106.4
-QDRANT_IMAGE=qdrant/qdrant:v1.20.0
+QDRANT_IMAGE=qdrant/qdrant:v1.19.1
-OPEN_TERMINAL_IMAGE=ghcr.io/open-webui/open-terminal:0.14.5
+OPEN_TERMINAL_IMAGE=ghcr.io/open-webui/open-terminal:0.14.0
-OPEN_WEBUI_IMAGE=ghcr.io/open-webui/open-webui:v0.12.4
+OPEN_WEBUI_IMAGE=ghcr.io/open-webui/open-webui:v0.11.4
-OPENCODE_IMAGE=ghcr.io/anomalyco/opencode:1.19.5
+OPENCODE_IMAGE=ghcr.io/anomalyco/opencode:1.18.32
 
 # --- oswald_runner (Flatcar) ---
 GITEA_RUNNER_IMAGE=docker.io/gitea/runner:3.5.0
 N8N_IMAGE=docker.n8n.io/n8nio/n8n:2.40.5
 CISA_KEV_RSS_IMAGE=ghcr.io/xsaveopt/cisa-kev-rss:0.0.5
-DOMAIN_WATCHDOG_IMAGE=maelgangloff/domain-watchdog:v1.4.6
-# Major must match POSTGRES_VERSION in domain-watchdog's .env (used in DATABASE_URL).
-DOMAIN_WATCHDOG_POSTGRES_IMAGE=postgres:16.15-alpine
-DOMAIN_WATCHDOG_VALKEY_IMAGE=valkey/valkey:9.1.2
 # Domain Watchdog here shares DOMAIN_WATCHDOG_IMAGE and
 # DOMAIN_WATCHDOG_VALKEY_IMAGE with the compose deployment.
 
 # --- oswl_connector (Flatcar) ---
 TAILSCALE_IMAGE=docker.io/tailscale/tailscale:v1.104.2
-
-# --- utility (Flatcar) ---
-# cturra/ntp only publishes "latest", so it is pinned by digest (2025-11-30 build).
-NTP_IMAGE=cturra/ntp@sha256:7224d4e7c7833aabbcb7dd70c46c8a8dcccda365314c6db047b9b10403ace3bc
-APT_CACHER_NG_IMAGE=mbentley/apt-cacher-ng:trixie-20261026
-REGISTRY_CACHE_IMAGE=registry:3.1.2
-
-# --- phpipam (Flatcar) ---
-PHPIPAM_WWW_IMAGE=phpipam/phpipam-www:v1.8.3
-PHPIPAM_CRON_IMAGE=phpipam/phpipam-cron:v1.8.3