Merge pull request 'feat(images): pin pihole, jackett and plex to the digests already running; Renovate follows them' (#94) from feat/pin-pihole-jackett-plex into main

Reviewed-on: #94

apps/wave-0/jackett.yaml

@@ -78,7 +78,7 @@ spec:
     spec:
       containers:
       - name: jackett
-        image: lscr.io/linuxserver/jackett:latest
+        image: lscr.io/linuxserver/jackett:v0.24.2865-ls7
         ports:
         - containerPort: 9117
         volumeMounts:

apps/wave-0/pihole.yaml

@@ -62,7 +62,7 @@ spec:
     spec:
       containers:
       - name: pihole
-        image: pihole/pihole
+        image: pihole/pihole:2026.10.0
         ports:
         - containerPort: 80
         env:

apps/wave-0/plex.yaml

@@ -120,7 +120,7 @@ spec:
     spec:
       containers:
       - name: plex
-        image: plexinc/pms-docker:latest
+        image: plexinc/pms-docker:1.43.4.10903-e5521bd8c
         ports:
         - containerPort: 32400
         env:

catalog/jackett.yaml

@@ -16,7 +16,7 @@
 name: jackett
 kind: container
 source:
-  image: lscr.io/linuxserver/jackett:latest
+  image: lscr.io/linuxserver/jackett:v0.24.2865-ls7
 exposure: internal              # LAN-only web UI at jackett.${BASE_DOMAIN} (docs/13 row 4; R-DNS/R-NET)
 egress: vpn                     # indexer scraping via node PIA tunnel + kill-switch (docs/03; ADR-0015; R-NET-05/06)
 storage:
@@ -70,7 +70,8 @@ auth:
     - ^/api/
 update:
   channel: stable               # R-UPD-01
-  range: ">=0.22.0"             # stay on the Jackett 0.22.x stable line
+  range: ">=0.22.0"             # floor only, no ceiling (0.24.x runs as of 2026-10-30; Jackett has no
+                                # major line to hold back from, so renovate.json5 mirrors no cap)
   cadence: "0 4 * * *"
   autoRollbackOnFailedHealth: true   # R-UPD-03
 observability:

catalog/pihole.yaml

@@ -5,7 +5,7 @@
 name: pihole
 kind: container
 source:
-  image: pihole/pihole
+  image: pihole/pihole:2026.10.0
 exposure: internal            # LAN-only admin UI (docs/13 row 6; R-DNS/R-NET)
 egress: internet              # normal WAN egress (docs/03; R-NET-05)
 storage:

catalog/plex.yaml

@@ -12,7 +12,7 @@
 name: plex
 kind: container
 source:
-  image: plexinc/pms-docker:latest
+  image: plexinc/pms-docker:1.43.4.10903-e5521bd8c
 # plexinc/pms-docker env. Rendered VERBATIM onto the app container by render.py (schema env list).
 env:
   # PLEX_UID/PLEX_GID: the image boots as root (s6 PID1), chowns /config to this uid/gid, then drops

decisions/2026-10-30-pin-pihole-jackett-plex.md

@@ -0,0 +1,96 @@
+---
+date: 2026-10-30
+branch: feat/pin-pihole-jackett-plex
+title: Pin pihole, jackett and plex to the digests already running, and make Renovate able to follow them
+---
+
+## What changed
+
+- **`catalog/{pihole,jackett,plex}.yaml` `source.image`** pinned to the tag whose digest was
+  already running, so the *image* does not change:
+  - `pihole/pihole` (no tag) -> `pihole/pihole:2026.10.0`
+  - `lscr.io/linuxserver/jackett:latest` -> `lscr.io/linuxserver/jackett:v0.24.2865-ls7`
+  - `plexinc/pms-docker:latest` -> `plexinc/pms-docker:1.43.4.10903-e5521bd8c`
+- **`apps/wave-0/{pihole,jackett,plex}.yaml`** re-rendered (`render.py --all catalog -o apps
+  --wave-layout --no-image-automation`, in the toolbox). The diff is exactly the three app-container
+  `image:` lines; nothing else moved.
+- **`catalog/jackett.yaml`** `update.range` comment: "stay on the Jackett 0.22.x stable line" was
+  false (0.24 runs, and `>=0.22.0` has no ceiling). Range unchanged; comment corrected.
+- **`renovate.json5`**, four packageRules plus a comment block:
+  - jackett `versioning: regex:^v(major).(minor).(patch)-ls(build)$` (Renovate's linuxserver example).
+  - jackett **`overridePackageName: ghcr.io/linuxserver/jackett`**: not in the brief, and needed.
+    Renovate's docker datasource reads at most `dockerMaxPages` (20, a global-only option) tag
+    pages from any host except a short list that includes ghcr.io (1000 pages). lscr.io is not on
+    that list. Jackett has **32,093** tags, oldest first, ~1000 per page; the running tag is #31,980.
+    Before this rule the dry run extracted jackett at `v0.24.2865-ls7` and **proposed nothing**,
+    with no warning. The override changes only the lookup; the manifests keep `lscr.io/...`.
+    Every jackett rule matches on `depName`, because the override rewrites `packageName`.
+  - jackett `schedule: after 3am and before 6am on sunday`, i.e. weekly. Measured: 13 ls builds in
+    12 days (ls7 built 2026-10-17, ls20 built 2026-10-29). Each is a `patch` and auto-merges, so on
+    the daily window it would mean a PR, a gate run and a jackett restart (Recreate) every day.
+    Weekly picks the newest tag, so it skips nothing. `catalog/jackett.yaml update.cadence` still
+    says daily. That field fed the retired Flux image-automation, and the rule's description
+    says the rule is now the cadence that takes effect.
+  - plex `versioning: regex:^(major).(minor).(patch).(build)-[0-9a-f]+$`.
+  - pihole: **no rule**, as the operator decided. CalVer parses under default docker versioning.
+    Patches and minors auto-merge, and a year rollover is a major (dashboard approval). This is
+    written in a comment.
+  - Corrected the "WHAT RENOVATE STILL CANNOT FIX" comment. It listed these three as floating;
+    they publish immutable version tags.
+  - No `allowedVersions` mirror was added. None of the three catalog ranges has a ceiling
+    (`>=2024.0.0`, `>=0.22.0`, `>=1.40.0`), so #86's mirror has nothing to encode for them.
+- **Runbooks:** `image-policy-stalled.md` no longer says jackett and pms-docker are
+  `latest`-only. In `plex-quicksync.md`, "the floating-image caveat" became "the image-version
+  caveat", because the deployment no longer runs `:latest` with an implicit `Always`, and the symptom
+  is now "after a pms-docker bump". `plex-claim.md`'s two "running `:latest`" mentions are
+  now in the past tense.
+
+## What I verified
+
+- **Live digests** (read-only `kubectl --context k3s-prod`, pod `.status.containerStatuses[].imageID`):
+  pihole-0 and pihole-1 `sha256:d34134716fc3…`, jackett `sha256:4fcf3cc22dd3…`, plex
+  `sha256:e0ab27395614…`.
+- **Each chosen tag resolves to the same digest** (anonymous registry HEAD, OCI index + manifest-list
+  Accept): `pihole/pihole:2026.10.0` = `sha256:d34134716fc3…`; `ghcr.io/linuxserver/jackett:v0.24.2865-ls7`
+  = `sha256:4fcf3cc22dd3…`; `plexinc/pms-docker:1.43.4.10903-e5521bd8c` = `sha256:e0ab27395614…`.
+  (For contrast, `pms-docker:latest` is now `sha256:6d778d41…` and `jackett:latest` `sha256:ee6ae915…`.
+  The pods would have drifted on their next restart.)
+- `renovate-config-validator` (ghcr.io/renovatebot/renovate:44.167.0) reports "Config validated
+  successfully". The only warning is the existing `docker` block migration.
+- **Renovate dry run** (`RENOVATE_PLATFORM=local`, `--dry-run=full`, 44.167.0, anonymous, includePaths
+  limited to the six files). It extracted all three from both `catalog/` (custom regex) and
+  `apps/wave-0/` (kubernetes) under the same depName, so each lands in one branch:
+  - plex `1.43.4.10903-e5521bd8c` -> `1.43.5.11079-b3b13e506` (patch, `renovate/plexinc-pms-docker-1.x`)
+  - jackett `v0.24.2865-ls7` -> `v0.24.2961-ls20` (patch, `renovate/lscr.io-linuxserver-jackett-0.x`).
+    This needs the ghcr override; without it there was no proposal.
+  - pihole `2026.10.0` -> none. That is correct, because 2026.10.0 is the newest numbered tag on Docker Hub.
+- **Automerge, schedule and dashboard flags** come from Renovate's own `applyPackageRules`
+  (datasource-merge, then update-type-merge, the same order as `flatten.js`), run on the resolved
+  config. The local platform does not run the branch worker:
+  - plex patch: automerge **true**, daily window.
+  - jackett patch: automerge **true**, schedule **sunday** window.
+  - pihole (synthetic updates) `2026.10.1` patch and `2026.11.0` minor: automerge **true**. `2027.01.0`
+    major: automerge **false**, `dependencyDashboardApproval` **true**, +needs-review/breaking.
+- **Versioning filters** (Renovate's versioning module): the jackett regex rejects `latest`, bare
+  `0.24.2961`, `amd64-…` and `development-…`. The plex regex rejects `latest`, `public`, `beta`,
+  `plexpass` and `…-amd64`/`…-arm64`. Docker versioning ranks `2026.09.0 < 2026.10.0`.
+- Touched paths (`catalog/`, `apps/`, `renovate.json5`, `runbooks/`, `decisions/`) are not in
+  `infra/gitea/approval-policy.json` `sensitive_paths`.
+
+## What I did NOT verify
+
+- **That the merge is restart-free. It is not.** The pod-template `image` string changes, so Flux
+  rolls all three: plex and jackett are `Recreate`, so each has a brief outage, and pihole is a
+  2-replica StatefulSet that rolls one pod at a time. The digest is identical, so the image's
+  behaviour should not change, but the kubelet resolves the new tag name and may pull it. The
+  rollout itself was not observed.
+- The implicit `imagePullPolicy` moves from `Always` (`:latest` or no tag) to `IfNotPresent`. This is
+  intended, and was not observed live.
+- A real (non-dry) Renovate run against Gitea, and whether the Sunday window actually opens a jackett
+  PR. The schedule was only evaluated, not exercised.
+- Other `lscr.io/linuxserver/*` images (radarr, sonarr, qbittorrent) may hit the same 20-page
+  truncation once their tag counts grow. Not measured here, and not changed.
+- Plex not self-updating on a version tag was checked only against the running pod (read-only
+  `kubectl exec cat`). `/etc/cont-init.d/50-plex-update` does `exit 0` when `version` from
+  `/version.txt` equals the installed `plexmediaserver` package. Both are
+  `1.43.4.10903-e5521bd8c`. I did not boot a pod on a *new* tag to watch that short-circuit.

renovate.json5

@@ -325,6 +325,37 @@
     { "matchPackageNames": ["lscr.io/linuxserver/radarr"], "allowedVersions": "<6.0.0" },
     { "matchPackageNames": ["lscr.io/linuxserver/sonarr"], "allowedVersions": "<5.0.0" },
     { "matchPackageNames": ["semaphoreui/semaphore"], "allowedVersions": "<3.0.0" },
+    // ADDED 2026-10-30 — pihole, jackett and plex, PINNED to the digests that were already running
+    // (catalog/{pihole,jackett,plex}.yaml; each tag was resolved against the registry and matched the
+    // pods' imageID, so the pin changed nothing at runtime). None of the three catalog `update.range`
+    // values has a ceiling (pihole >=2024.0.0, jackett >=0.22.0, plex >=1.40.0), so the
+    // allowedVersions mirror above needs no entry for them.
+    //
+    // pihole/pihole needs NO rule: its CalVer tags (YYYY.MM.N, e.g. 2026.10.0) parse under the
+    // default `docker` versioning. Patches and minors (2026.10.0 -> 2026.10.1 / 2026.11.0) therefore
+    // AUTO-MERGE on a green gate under rule 1 — the operator's explicit choice, not an oversight; do
+    // not add a hold here. A YEAR ROLLOVER (2026.x -> 2027.x) is a MAJOR, so it waits for a tick on
+    // the Dependency Dashboard (rule below) and is never auto-merged.
+    {
+      "description": "ADDED 2026-10-30. LinuxServer tags: `vX.Y.Z-lsN` is the IMMUTABLE build tag (bare `X.Y.Z` and `latest` are re-pushed for every ls rebuild). Docker versioning would treat `-ls7` as a compatibility suffix and only ever compare tags with the SAME suffix, so it would never move. This is Renovate's own regex-versioning example for linuxserver images: the ls build number becomes the `build` component, so an ls rebuild of the same Jackett is an update too. The `^v` and `$` anchors exclude `latest`, `development`, the bare mutable `X.Y.Z` tags and the arch-prefixed (`amd64-v...`) tags.",
+      "matchDepNames": ["lscr.io/linuxserver/jackett"],
+      "versioning": "regex:^v(?<major>\\d+)\\.(?<minor>\\d+)\\.(?<patch>\\d+)-ls(?<build>\\d+)$"
+    },
+    {
+      "description": "ADDED 2026-10-30. LOOK JACKETT UP ON ghcr.io, NOT lscr.io. lscr.io is LinuxServer's redirector in front of ghcr.io/linuxserver (same manifests: v0.24.2865-ls7 is sha256:4fcf3cc2... on both). Renovate's docker datasource fetches up to 1000 pages of tags from ghcr.io but only `dockerMaxPages` (default 20, a GLOBAL-only option) from any other host (lib/modules/datasource/docker/index.js getTags). Jackett has 32,093 tags at ~1000 per page (measured 2026-10-30), oldest first; the running tag is #31,980, so a lookup via lscr.io never sees it or anything newer and silently proposes NOTHING (measured in a dry run before this rule). overridePackageName changes only the lookup; the file keeps `lscr.io/...`, so the deployed image string does not change. Matched by depName because packageName is what this rule rewrites.",
+      "matchDepNames": ["lscr.io/linuxserver/jackett"],
+      "overridePackageName": "ghcr.io/linuxserver/jackett"
+    },
+    {
+      "description": "ADDED 2026-10-30. Jackett publishes ~daily (13 ls builds in 12 days, measured 2026-10-30) and every one is a `patch` under the regex above, i.e. auto-mergeable. Left on the global daily window that is a PR, a gate run and a jackett pod restart EVERY DAY for an indexer proxy whose individual builds nobody needs promptly. WEEKLY instead: Renovate proposes only the newest tag when the window opens, so nothing is skipped, it is just batched. The window is still inside the global 03:00-06:00 local one that .gitea/workflows/renovate.yaml's 08:15 UTC cron lands in. NOTE: catalog/jackett.yaml `update.cadence` still says daily (`0 4 * * *`); that field drove Flux image-automation, which is retired, and this rule is the effective cadence now.",
+      "matchDepNames": ["lscr.io/linuxserver/jackett"],
+      "schedule": ["after 3am and before 6am on sunday"]
+    },
+    {
+      "description": "ADDED 2026-10-30. Plex tags are `<major>.<minor>.<patch>.<build>-<commit hex>` (e.g. 1.43.4.10903-e5521bd8c). Docker versioning reads `-e5521bd8c` as a compatibility suffix that differs on EVERY release, so it would never find a successor. The trailing `$` excludes the per-arch variants and the floating `latest`/`public`/`beta`/`plexpass` tags. A version tag does NOT self-update inside the container: cont-init 50-plex-update exits early when /version.txt matches the installed package, so what is pinned is what runs.",
+      "matchPackageNames": ["plexinc/pms-docker"],
+      "versioning": "regex:^(?<major>\\d+)\\.(?<minor>\\d+)\\.(?<patch>\\d+)\\.(?<build>\\d+)-[0-9a-f]+$"
+    },
     {
       "description": "ADDED 2026-10-30. A CNPG Postgres MAJOR is a migration (new cluster + import), not an image bump; the dry run proposed 16.4 -> 18.6. Minors stay (and are blast-radius, above).",
       "matchPackageNames": ["ghcr.io/cloudnative-pg/postgresql"],
@@ -379,6 +410,10 @@
   // ARE maintained (the first dry run proposed 35-apache and 29-dind; the suffix is kept).
   // CORRECTED 2026-10-30: quay.io/keycloak/keycloak was never a running reference — the operator
   // picks the server image — and the Keycloak version is now tracked via the operator URLs.
+  // CORRECTED 2026-10-30 (feat/pin-pihole-jackett-plex): pms-docker, jackett and pihole are now
+  // PINNED (1.43.4.10903-e5521bd8c, v0.24.2865-ls7, 2026.10.0 — the digests that were running) and
+  // maintained via the versioning rules above. None of the three publishes "only latest": all three
+  // publish immutable version tags, they were simply never referenced.
   // Separately, the HelmRelease minor-locking ranges (9 of 12, e.g. `>=88.0.0 <89.0.0` on
   // kube-prometheus-stack): THIS FILE USED TO SAY they cap Renovate at patches. They do not —
   // Renovate WIDENS the range (runs 353/354). The `range-widen` rule above keeps that a reviewed

runbooks/image-policy-stalled.md

@@ -112,10 +112,12 @@ A private repository with no `secretRef`, or an expired token. The message names
 ### 4. The policy's range matches nothing
 `ImagePolicy` semver ranges come from each ServiceDefinition's `update.range` (for example
 `">=2024.0.0"` for pihole, `">=24.0.0"` for keycloak). A range that no published tag satisfies — or a
-repository that publishes only `latest` (this platform has `lscr.io/linuxserver/jackett:latest` and
+repository that publishes only `latest` — leaves the policy with nothing to select. Remediation: fix
-`plexinc/pms-docker:latest`) — leaves the policy with nothing to select. Remediation: fix the range in
+the range in `catalog/<service>.yaml` and re-render; a `latest`-only image cannot participate in
-`catalog/<service>.yaml` and re-render; a `latest`-only image cannot participate in automation at all
+automation at all and should not carry a policy. (CORRECTED 2026-10-30: this page used to name
-and should not carry a policy.
+`lscr.io/linuxserver/jackett` and `plexinc/pms-docker` as `latest`-only. Neither is — both publish
+immutable version tags (`v0.24.2865-ls7`, `1.43.4.10903-e5521bd8c`) — they were merely *deployed* as
+`:latest`. Both are now pinned to those tags and maintained by Renovate, not by an ImagePolicy.)
 
 ### 5. Egress is blocked for that namespace
 Default-deny everywhere (R-NET-01) means outbound registry access is an explicit allow. Cross-read

runbooks/plex-claim.md

@@ -21,7 +21,8 @@ which is why this page exists: the loop is scripted and the reconcile is **force
 waited for. Measured end to end on 2026-09-29: **~2m45s**.
 
 **An expired or wrong token does not break anything.** Verified against the image's own first-run
-script (and the copy inside `plexinc/pms-docker:latest`): a failed exchange gets a 403 with an empty
+script (and the copy inside the image then running as `plexinc/pms-docker:latest`; pinned to a version
+tag since 2026-10-30): a failed exchange gets a 403 with an empty
 body, `curl`'s status is never checked, the token `sed` yields empty, the `if` does not fire, there is
 no `else` and no `exit 1`, and the script (no `set -e`) exits 0. The pod comes up **unclaimed and
 serving**. So a burnt token costs you one more attempt, not an outage — and the repo deliberately
@@ -186,4 +187,5 @@ When the claim does not take, in order of how often it is the answer here:
 Source of truth: `runbooks/plex-claim.md`. Index: `/runbooks/`
 Upstream behaviour cited here is from `plexinc/pms-docker` branch `master`,
 `root/etc/cont-init.d/40-plex-first-run` (s6-overlay v2), cross-checked against the same file inside
-the running `plexinc/pms-docker:latest` image.
+the image that was running at the time as `plexinc/pms-docker:latest` (the deployment has been pinned
+to a version tag, `catalog/plex.yaml` `source.image`, since 2026-10-30).

runbooks/plex-quicksync.md

@@ -371,8 +371,8 @@ verify".)
    2026-10-01, so this means a node changed — a rebuild, a BIOS reset, or a driver regression.
    **Fix the node.**
 
-4. **The image changed under you.** See "The floating-image caveat". A `:latest` pull can remove the
+4. **The image changed under you.** See "The image-version caveat". A pms-docker version bump (a
-   mechanism this feature leans on with no commit in this repo.
+   Renovate PR, possibly auto-merged) can remove the mechanism this feature leans on.
 
 5. **The session was never transcoding.** Direct Play / Direct Stream never reaches the transcoder,
    so no `hardware transcoding:` line is written for it at all. An *absent* line is this, not a
@@ -446,17 +446,21 @@ revert you):
 Re-adding the field later is the same edit in reverse. Nothing about the Plex-side toggle or the
 `/config` PVC is affected either way — do **not** delete the PVC as part of this.
 
-## The floating-image caveat
+## The image-version caveat
 
 Everything this page states about the image's behaviour — the `cont-init.d` hook that adds the app
 user to the device's group, the absence of `PLEX_PREFERENCE*`, the six `setPref` keys, the
 `HardwareAcceleratedCodecs` string — was read from digest **`sha256:e0ab27395614…`**
 (`plexmediaserver 1.43.4.10903`).
 
-The deployment runs **`plexinc/pms-docker:latest` with `imagePullPolicy: Always`**. A silent pull can
+**Since 2026-10-30 that digest is pinned:** `catalog/plex.yaml` names
-therefore change the behaviour this feature depends on **with no commit in this repo**, while the
+`plexinc/pms-docker:1.43.4.10903-e5521bd8c`, which resolved to exactly `sha256:e0ab27395614…` on
-manifest still looks identical. Symptom to watch for: hardware transcoding that worked and quietly
+Docker Hub. Before that the deployment ran the floating `:latest` (implicitly `imagePullPolicy:
-stopped, with no git change to point at.
+Always`), and a silent pull could change this behaviour with no commit in the repo. That is no longer
+the failure mode: the image now changes only through a **Renovate PR** bumping that tag (patch/minor
+ones auto-merge on a green gate, and the gate does not exercise QuickSync). So the symptom to watch
+for is hardware transcoding that quietly stopped **after a `chore(deps)` pms-docker bump** — check
+`git log -- catalog/plex.yaml` first.
 
 ```
 infra/devcontainer/dev.sh run bash -c \