Renovate

Automated dependency updater for Docker image tags. Scans all docker-compose.yml files in the homelab-docker repo and opens PRs in Forgejo when newer image tags are available. Since 2026-07-06: runs on a weekly schedule (before 6am Monday, America/New_York), patch updates are grouped and auto-merged directly to main, and minor/major updates still come as PRs for manual review.

How It Runs

Renovate is a one-shot container (restart: "no"). It does not run as a daemon. A cron job on Nexus launches it at the top of every hour:

0 * * * * cd /home/matt/repos/homelab-docker/renovate && docker compose run --rm renovate

Cron entry runs as the matt user. To view or edit:

ssh matt@192.168.1.226 'crontab -l'
ssh matt@192.168.1.226 'crontab -e'

Configuration Files

File	Location	Purpose
config.js	/mnt/server/containers/renovate/config.js on Nexus	Real config — Forgejo endpoint, API token, PR rules. Not in git.
renovate.json	Repo root of homelab-docker	Schedule, patch-update grouping/automerge rules. In git.
docker-compose.yml	renovate/docker-compose.yml in homelab-docker repo	Container definition used by cron
Log	/mnt/server/containers/renovate/renovate.log on Nexus	Output from every run

Split config. config.js on Nexus holds the connection settings (Forgejo endpoint, API token — server-side only, never commit it). renovate.json in the repo root holds the update policy: weekly schedule, timezone, and the patch-group automerge rule (automergeType: "branch" + ignoreTests: true — the repo has no CI, so without ignoreTests Renovate refuses branch automerge and falls back to a PR merged via Forgejo's merge API, which is flaky; see gotcha below).

Docker Compose

services:
  renovate:
    image: renovate/renovate:43.186.1
    container_name: renovate
    restart: "no"
    environment:
      - RENOVATE_GITHUB_COM_TOKEN=no-github
    volumes:
      - /mnt/server/containers/renovate/config.js:/usr/src/app/config.js:ro
      - /mnt/server/containers/renovate/data:/tmp/renovate

RENOVATE_GITHUB_COM_TOKEN=no-github suppresses the GitHub token requirement. This homelab uses Forgejo and does not need GitHub release notes.

PR Behavior

Setting	Value
Schedule	Weekly — before 6am Monday, America/New_York (cron still fires hourly; Renovate gates itself)
Patch updates	Grouped as "patch updates", auto-merged via direct branch push to main (no PR)
Minor/major updates	Regular PRs, human review required
prConcurrentLimit	5 — max 5 open PRs at once
Major version bumps	Auto-labeled needs-manual-review

Treat these PRs with extra caution before merging:

• Bookstack, Tandoor, Home Assistant — stateful data; take a manual snapshot before merging
• Postgres / MariaDB major versions — may require manual migration steps
• Any PR labeled needs-manual-review

What Renovate Tracks

• All pinned image tags in docker-compose.yml files under the homelab-docker repo
• Docker Hub images and GHCR images
• Its own image tag (renovate/renovate)

What Renovate Does Not Track

Service	Reason
dispatcharr	ghcr.io/dispatcharr/dispatcharr only publishes latest — no semver tags. Renovate cannot open PRs for it. Check the GHCR page or GitHub releases manually.

Komodo Relationship

Renovate is intentionally not managed by Komodo. If it were included in the Komodo deploy procedure, every push to main would trigger a Renovate scan — which is redundant and would race with the cron schedule. Renovate is cron-only.

Gotcha: "autoclosed" PRs = possible silent deploy gap

Seen 2026-07-24 (PR #200, tracked in issue #204): Forgejo's merge API can half-complete — the merge commit lands on main, but the PR stays merged: false and the push webhook never fires, so Komodo never deploys. Renovate then autocloses the PR on its next run (title gets a "- autoclosed" suffix). Same signature as PR #189 / issue #195, likely the same bug as the intermittent 405 "please try again later" on manual merges (Forgejo 15.0.2).

After any autoclosed Renovate PR: compare running container image tags (docker ps) against the compose files on main; if stale, run the Komodo "Deploy Stacks" procedure manually. Mitigations: ignoreTests: true keeps patch automerge off the flaky merge-API path, and the "Deploy Stacks" procedure runs daily at 7:30am as a reconciliation net.

Troubleshooting

Check the log:

ssh matt@192.168.1.226 'tail -f /mnt/server/containers/renovate/renovate.log'

Manually trigger a run:

ssh matt@192.168.1.226 'cd /home/matt/repos/homelab-docker/renovate && docker compose run --rm renovate'

No PRs after a run: Renovate may have found everything up to date. Check the log for "no updates found". Also verify:

• Image tags in compose files are pinned to explicit versions (not :latest)
• renovate-bot has Write collaborator access on the homelab-docker repo in Forgejo
• The homelab-docker repo has the renovate topic set in Forgejo

Auth fails to Forgejo: Verify the token in /mnt/server/containers/renovate/config.js matches the renovate-bot user's active token in Forgejo (Settings → Applications).