chore(renovate,crowdsec): group minor/patch updates and whitelist VPS

Renovate: group all minor updates and all patch updates into reviewable PRs. Crowdsec: whitelist static VPS IP. Remove stale cloudflared/k8s/active marker.

crowdsec/k8s/crowdsec-values.yaml

@@ -87,6 +87,13 @@ config:
             - "169.254.0.0/16"
             - "fc00::/7"
             - "fe80::/10"
+      vps-whitelist.yaml: |
+        name: forust/vps-whitelist
+        description: "Whitelist static VPS"
+        whitelist:
+          reason: "VPS"
+          ip:
+            - "193.181.211.79"
 
   postoverflows:
     s01-whitelist:

renovate/k8s/configmap.yaml

@@ -165,6 +165,13 @@ data:
           "matchUpdateTypes": ["digest", "patch"],
           "automerge": true
         },
+        {
+          "description": "Group all minor updates into one reviewable PR - placed before the specific groups below so playwright/node/renovate keep their own lockstep groups (later groupName wins)",
+          "matchUpdateTypes": ["minor"],
+          "groupName": "all minor updates",
+          "groupSlug": "all-minor",
+          "automerge": false
+        },
         {
           "description": "Keep private homelab images unchanged",
           "matchDatasources": ["docker"],
@@ -207,10 +214,10 @@ data:
           "automerge": false
         },
         {
-          "description": "Group container patch updates",
+          "description": "Group patch updates from all sources - automerge still applies via the digest/patch rule above (helm/playwright stay manual via their own rules)",
-          "matchDatasources": ["docker"],
           "matchUpdateTypes": ["patch"],
-          "groupName": "container patch updates"
+          "groupName": "all patch updates",
+          "groupSlug": "all-patch"
         }
       ]
     }

renovate/renovate.json

@@ -154,6 +154,13 @@
       "matchUpdateTypes": ["digest", "patch"],
       "automerge": true
     },
+    {
+      "description": "Group all minor updates into one reviewable PR - placed before the specific groups below so playwright/node/renovate keep their own lockstep groups (later groupName wins)",
+      "matchUpdateTypes": ["minor"],
+      "groupName": "all minor updates",
+      "groupSlug": "all-minor",
+      "automerge": false
+    },
     {
       "description": "Keep private homelab images unchanged",
       "matchDatasources": ["docker"],
@@ -196,10 +203,10 @@
       "automerge": false
     },
     {
-      "description": "Group container patch updates",
+      "description": "Group patch updates from all sources - automerge still applies via the digest/patch rule above (helm/playwright stay manual via their own rules)",
-      "matchDatasources": ["docker"],
       "matchUpdateTypes": ["patch"],
-      "groupName": "container patch updates"
+      "groupName": "all patch updates",
+      "groupSlug": "all-patch"
     }
   ]
 }