Update renovate/renovate Docker tag to v32.183.0

Reviewed-on: #73

README.md

@@ -6,26 +6,9 @@ A robot who upgrades our configurations.
 
 See [config.js](./config.js.tmpl) for the configured repositories.
 
-<!-- metadata -->
-* **Category**: Development
-* **Status**: ?
-* **Image**: [`renovate/renovate`](https://hub.docker.com/r/renovate/renovate), ❶💚, upstream
-* **Healthcheck**: No
-* **Backups**: ?
-* **Email**: ?
-* **Tests**: ❷💛
-* **SSO**: ?
-<!-- endmetadata -->
+## Deploy
 
-## Basic usage
-
-1. Set up Docker Swarm and [`abra`][abra]
-2. Deploy [`coop-cloud/traefik`][cc-traefik]
-3. `abra app new renovate-bot --secrets` (optionally with `--pass` if you'd like
-   to save secrets in `pass`)
-4. `abra app YOURAPPDOMAIN config` - be sure to change `$DOMAIN` to something that resolves to
-   your Docker swarm box
-5. `abra app YOURAPPDOMAIN deploy`
-
-[`abra`]: https://git.autonomic.zone/autonomic-cooperative/abra
-[`coop-cloud/traefik`]: https://git.autonomic.zone/coop-cloud/traefik
+```
+$ docker stack rm renovate_bot
+$ docker stack deploy -c compose.yml renovate_bot
+```

compose.yml

@@ -1,33 +1,47 @@
+---
 version: "3.8"
 services:
   app:
-    image: "renovate/renovate:24.98.9-slim"
+    image: "renovate/renovate:32.183.0-slim"
     environment:
       LOG_LEVEL: info
+      GITHUB_COM_TOKEN_FILE: /run/secrets/github_token
     configs:
       - source: config_js
         target: /usr/src/app/config.js
+      - source: entrypoint
+        target: /docker-entrypoint.sh
+        mode: 0555
+    entrypoint: /docker-entrypoint.sh
+    command: renovate
     secrets:
       - api_token
+      - github_token
     healthcheck:
       disable: true
-    volumes:
-      - "/var/run/docker.sock:/var/run/docker.sock"
     deploy:
       mode: replicated
       replicas: 0
       labels:
         - "swarm.cronjob.enable=true"
-        - "swarm.cronjob.schedule=0 9 * * 1-5"
+        # Note(decentral1se): every minute, testing
+        # - "swarm.cronjob.schedule=* * * * *"
+        - "swarm.cronjob.schedule=0 9 * * 1-5" # office hours
         - coop-cloud.${STACK_NAME}.app.version=24.98.9-slim-d3db1c25
       restart_policy:
         condition: none
 configs:
   config_js:
-    name: config_js_v1
+    name: renovate_config_js_v3
     file: config.js.tmpl
     template_driver: golang
+  entrypoint:
+    name: renovate_entrypoint_v1
+    file: entrypoint.sh
 secrets:
   api_token:
-    name: api_token_v1
+    name: renovate_api_token_v1
+    external: true
+  github_token:
+    name: renovate_github_token_v1
     external: true

config.js.tmpl

@@ -7,34 +7,32 @@ module.exports = {
   "docker-compose": {
     fileMatch: "(^|/)compose[^/]*\.ya?ml$",
   },
+  "suppressNotifications": ["artifactErrors"],
+  "requiredStatusChecks": null,
+  "packageRules": [
+    {
+      "matchUpdateTypes": ["minor", "patch"],
+      "matchCurrentVersion": "!/^0/",
+      "automerge": true
+    }
+  ],
   repositories: [
     "autonomic-cooperative/autonomic.zone",
     "autonomic-cooperative/backup-bot",
     "autonomic-cooperative/docs.autonomic.zone",
     "autonomic-cooperative/infrastructure",
     "autonomic-cooperative/renovate-bot",
-
-    "coop-cloud/alerta",
-    "coop-cloud/codimd",
-    "coop-cloud/distribution",
-    "coop-cloud/drone",
-    "coop-cloud/drone-docker-runner",
-    "coop-cloud/gitea",
-    "coop-cloud/invoiceninja",
-    "coop-cloud/keycloak",
-    "coop-cloud/kimai",
-    "coop-cloud/matrix-synapse",
-    "coop-cloud/mediawiki",
-    "coop-cloud/nextcloud",
-    "coop-cloud/portainer",
-    "coop-cloud/renovate",
-    "coop-cloud/strapi",
-    "coop-cloud/swarm-cronjob",
-    "coop-cloud/swarmpit",
-    "coop-cloud/traefik",
-    "coop-cloud/traefik-forward-auth",
-    "coop-cloud/wordpress",
-    "coop-cloud/statping",
+    "autonomic-cooperative/wordpress-docker-composer",
+    "autonomic-cooperative/wordpress-nginx-docker",
+    "autonomic-cooperative/autonomic.add-users",
+    "autonomic-cooperative/autonomic.new-hetzner",
+    "autonomic-cooperative/autonomic.sshd",
+    "autonomic-cooperative/autonomic.netdata",
+    "autonomic-cooperative/autonomic.swarm-single-node",
+    "autonomic-cooperative/autonomic.packages",
+    "autonomic-cooperative/autonomic.motd",
+    "autonomic-cooperative/autonomic.auto-apt-upgrades",
+    "autonomic-cooperative/autonomic.apt-upgrades",
 
     "decentral1se/xbotlib"
   ]

entrypoint.sh

@@ -0,0 +1,29 @@
+#!/bin/bash
+
+set -e
+
+file_env() {
+   local var="$1"
+   local fileVar="${var}_FILE"
+   local def="${2:-}"
+
+   if [ "${!var:-}" ] && [ "${!fileVar:-}" ]; then
+      echo >&2 "error: both $var and $fileVar are set (but are exclusive)"
+      exit 1
+   fi
+
+   local val="$def"
+
+   if [ "${!var:-}" ]; then
+      val="${!var}"
+   elif [ "${!fileVar:-}" ]; then
+      val="$(< "${!fileVar}")"
+   fi
+
+   export "$var"="$val"
+   unset "$fileVar"
+}
+
+file_env "GITHUB_COM_TOKEN"
+
+exec "$@"