Merge pull request 'Update docker.io/bitnamilegacy/postgresql Docker tag to v17.6.0' (#29) from renovate/docker.io-bitnamilegacy-postgresql-17.x into main

Debug-level dry-run revealed why the previous packageRule approach
(`datasource: github-releases` + `packageName: Termix-SSH/Termix` +
`versioning: regex:^release-...`) silently did nothing:

  DEBUG: Dependency ghcr.io/lukegus/termix has unsupported/unversioned
         value release-1.11.0 (versioning=docker)
  DEBUG: Skipping ghcr.io/lukegus/termix because no currentDigest or
         pinDigests

The kubernetes manager extracts the image with the default versioning
(=docker), runs an EARLY currentValue pre-check, fails on `release-1.11.0`,
falls back to digest-based updates, and gives up -- all BEFORE the
packageRule's `versioning` override has a chance to apply. Same failure
class as the earlier `extractVersion` attempt.

Renovate's documented fix for this exact case is an inline manifest
comment that applies overrides at extraction time:

  # renovate: datasource=github-releases depName=Termix-SSH/Termix \
  #          versioning=loose extractVersion=^release-(?<version>.+)$
  image: ghcr.io/lukegus/termix:release-1.11.0

With extractVersion stripping the `release-` prefix at extraction, the
loose semver parser handles the resulting `1.11.0` / `2.3.2` fine.
github-releases datasource gives Renovate real upstream timestamps so
the 3-day stability gate works normally. Removing the now-superseded
packageRule keeps the config clean (6 rules instead of 7).

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

admin-system/renovate.yaml

@@ -90,13 +90,6 @@ data:
           ],
           "automerge": false
         },
-        {
-          "description": "termix: use github-releases as datasource (ghcr.io OCI manifest for this image lacks the release timestamp Renovate needs for the stability gate; GitHub Releases at Termix-SSH/Termix expose proper timestamps so the 3-day gate works as intended). regex versioning parses the release-X.Y.Z prefix. Renovate still writes the new tag to the same ghcr.io/lukegus/termix image (the registry hosts every release).",
-          "matchPackageNames": ["ghcr.io/lukegus/termix"],
-          "datasource": "github-releases",
-          "packageName": "Termix-SSH/Termix",
-          "versioning": "regex:^release-(?<major>\\d+)\\.(?<minor>\\d+)\\.(?<patch>\\d+)$"
-        },
         {
           "description": "wanderer: db + web update together in one PR",
           "matchPackageNames": ["flomp/wanderer-db", "flomp/wanderer-web"],

code-system/code.yaml

@@ -50,7 +50,7 @@ spec:
         fsGroup: 1000
       containers:
         - name: code-server
-          image: codercom/code-server:4.121.0
+          image: codercom/code-server:4.122.1
           args:
             - --bind-addr=0.0.0.0:8080
             - --auth=none

nextcloud-system/nextcloud.yaml

@@ -552,7 +552,7 @@ spec:
             failureThreshold: 3
       initContainers:
         - name: postgresql-isready
-          image: docker.io/bitnamilegacy/postgresql:17.5.0-debian-12-r3
+          image: docker.io/bitnamilegacy/postgresql:17.6.0-debian-12-r3
           resources: {}
           securityContext: {}
           env:
@@ -637,7 +637,7 @@ spec:
       hostIPC: false
       containers:
         - name: postgresql
-          image: docker.io/bitnamilegacy/postgresql:17.5.0-debian-12-r3
+          image: docker.io/bitnamilegacy/postgresql:17.6.0-debian-12-r3
           imagePullPolicy: "IfNotPresent"
           securityContext:
             allowPrivilegeEscalation: false

termix-system/termix.yaml

@@ -41,6 +41,7 @@ spec:
     spec:
       containers:
         - name: termix
+          # renovate: datasource=github-releases depName=Termix-SSH/Termix versioning=loose extractVersion=^release-(?<version>.+)$
           image: ghcr.io/lukegus/termix:release-1.11.0
           imagePullPolicy: IfNotPresent
           ports: