feat(renovate): add Gitea update automation

Run Renovate in Kubernetes to create reviewed image update PRs.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

renovate/k8s/configmap.yaml

@@ -0,0 +1,45 @@
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: renovate-config
+  namespace: renovate
+data:
+  config.js: |
+    module.exports = {
+      platform: 'gitea',
+      endpoint: process.env.RENOVATE_ENDPOINT,
+      enabledManagers: ['docker-compose', 'kubernetes'],
+      kubernetes: {
+        managerFilePatterns: ['/k8s/.+\\.ya?ml$/'],
+      },
+      repositories: (process.env.RENOVATE_REPOSITORIES || '')
+        .split(',')
+        .map((repository) => repository.trim())
+        .filter(Boolean),
+      onboarding: false,
+      requireConfig: 'optional',
+      autodiscover: false,
+      dependencyDashboard: true,
+      prCreation: 'immediate',
+      labels: ['dependencies', 'automated'],
+      extends: ['config:recommended', ':dependencyDashboard'],
+      packageRules: [
+        {
+          description: 'Do not update private homelab images',
+          matchDatasources: ['docker'],
+          matchPackageNames: ['/gcr\\.forust\\.xyz\\/forust\\/.+/'],
+          enabled: false,
+        },
+        {
+          description: 'Keep major upgrades manual',
+          matchUpdateTypes: ['major'],
+          dependencyDashboardApproval: true,
+          automerge: false,
+        },
+        {
+          description: 'Group patch updates',
+          matchUpdateTypes: ['patch'],
+          groupName: 'container patch updates',
+        },
+      ],
+    };

renovate/k8s/cronjob.yaml

@@ -0,0 +1,58 @@
+apiVersion: batch/v1
+kind: CronJob
+metadata:
+  name: renovate
+  namespace: renovate
+spec:
+  schedule: "17 */6 * * *"
+  concurrencyPolicy: Forbid
+  successfulJobsHistoryLimit: 2
+  failedJobsHistoryLimit: 3
+  jobTemplate:
+    spec:
+      backoffLimit: 1
+      template:
+        spec:
+          restartPolicy: Never
+          containers:
+            - name: renovate
+              image: renovate/renovate:44.83.2
+              env:
+                - name: RENOVATE_PLATFORM
+                  value: gitea
+                - name: RENOVATE_ENDPOINT
+                  valueFrom:
+                    secretKeyRef:
+                      name: renovate-secrets
+                      key: RENOVATE_ENDPOINT
+                - name: RENOVATE_TOKEN
+                  valueFrom:
+                    secretKeyRef:
+                      name: renovate-secrets
+                      key: RENOVATE_TOKEN
+                - name: RENOVATE_REPOSITORIES
+                  valueFrom:
+                    secretKeyRef:
+                      name: renovate-secrets
+                      key: RENOVATE_REPOSITORIES
+                - name: RENOVATE_CONFIG_FILE
+                  value: /opt/renovate/config.js
+                - name: RENOVATE_BASE_DIR
+                  value: /tmp/renovate
+                - name: RENOVATE_GITHUB_COM_TOKEN
+                  valueFrom:
+                    secretKeyRef:
+                      name: renovate-secrets
+                      key: RENOVATE_GITHUB_COM_TOKEN
+                      optional: true
+                - name: LOG_LEVEL
+                  value: info
+              volumeMounts:
+                - name: config
+                  mountPath: /opt/renovate/config.js
+                  subPath: config.js
+                  readOnly: true
+          volumes:
+            - name: config
+              configMap:
+                name: renovate-config

renovate/k8s/namespace.yaml

@@ -0,0 +1,6 @@
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: renovate
+  labels:
+    app.kubernetes.io/part-of: renovate

renovate/k8s/secrets.yaml.example

@@ -0,0 +1,11 @@
+apiVersion: v1
+kind: Secret
+metadata:
+  name: renovate-secrets
+  namespace: renovate
+type: Opaque
+stringData:
+  RENOVATE_TOKEN: ""
+  RENOVATE_ENDPOINT: "https://gitea.forust.xyz/api/v1"
+  RENOVATE_REPOSITORIES: "forust/homelab"
+  RENOVATE_GITHUB_COM_TOKEN: ""