chore(deps): pin dependencies

Welcome to [Renovate](https://github.com/renovatebot/renovate)! This is an onboarding PR to help you understand and configure settings before regular Pull Requests begin.

🚦 To activate Renovate, merge this Pull Request. To disable Renovate, simply close this Pull Request unmerged.

---
### Detected Package Files

 * `compose.git-pull.yml` (docker-compose)
 * `compose.sftp.yml` (docker-compose)
 * `compose.sso.yml` (docker-compose)
 * `compose.yml` (docker-compose)
 * `.drone.yml` (droneci)

### Configuration Summary

Based on the default config's presets, Renovate will:

  - Start dependency updates only once this onboarding PR is merged
  - Enable Renovate Dependency Dashboard creation.
  - Use semantic commit type `fix` for dependencies and `chore` for all others if semantic commits are in use.
  - Ignore `node_modules`, `bower_components`, `vendor` and various test/tests (except for nuget) directories.
  - Group known monorepo packages together.
  - Use curated list of recommended non-monorepo package groupings.
  - Show only the Age and Confidence Merge Confidence badges for pull requests.
  - Apply crowd-sourced package replacement rules.
  - Apply crowd-sourced workarounds for known problems with packages.

🔡 Do you want to change how Renovate upgrades your dependencies? Add your custom config to `renovate.json` in this branch. Renovate will update the Pull Request description the next time it runs.

---

### What to Expect

With your current configuration, Renovate will create 1 Pull Request:

<details>
<summary>chore(deps): update nginx docker tag to v1.31.5</summary>

  - Schedule: ["at any time"]
  - Branch name: `renovate/nginx-1.x`
  - Merge into: `main`
  - Upgrade nginx to `1.31.5`

</details>

---

❓ Got questions? Check out Renovate's [Docs](https://docs.renovatebot.com/), particularly the Getting Started section.
If you need any further assistance then you can also [request help here](https://github.com/renovatebot/renovate/discussions).

---

This PR has been generated by [Renovate Bot](https://github.com/renovatebot/renovate).

<!--renovate-config-hash:e80b4e42a3043bc12fa0640db4bac392d2bf770acf841360d7c8ceeeac2ec1a9-->

Reviewed-on: #7
Co-authored-by: Renovate Bot <renovate@coopcloud.tech>

.drone.yml

@@ -3,7 +3,7 @@ kind: pipeline
 name: deploy to swarm-test.autonomic.zone
 steps:
   - name: deployment
-    image: git.coopcloud.tech/coop-cloud/stack-ssh-deploy:latest
+    image: git.coopcloud.tech/coop-cloud/stack-ssh-deploy:latest@sha256:fc1fa69bea5528db7ba184297735ac1bbd278720910e4cb1f502de9aee14e228
     settings:
       host: swarm-test.autonomic.zone
       stack: custom_html
@@ -26,7 +26,7 @@ kind: pipeline
 name: generate recipe catalogue
 steps:
   - name: release a new version
-    image: plugins/downstream
+    image: plugins/downstream@sha256:03ff02d8a5637ea5197fa08929a91dfeeb5e30b1da62b82b6c2a895b170338ca
     settings:
       server: https://build.coopcloud.tech
       token:

compose.git-pull.yml

@@ -3,7 +3,7 @@ services:
   git:
     environment:
       - GIT_REPO_URL
-    image: alpine/git:v2.49.1
+    image: alpine/git:v2.54.0@sha256:0b5f57d22181e8b8fbe8ac5ca8754faa0d577f101b9857418f1acc43955ad464
     entrypoint: /docker-entrypoint.sh
     volumes:
       - content:/git

compose.sftp.yml

@@ -1,7 +1,7 @@
 version: "3.8"
 services:
   ssh:
-    image: lscr.io/linuxserver/openssh-server:latest
+    image: lscr.io/linuxserver/openssh-server:latest@sha256:39ba37d50fdd6be1bf70644c871e5dcb9234ee79ac56424ea03ca08cadf1e7b0
     networks:
       - proxy
     environment:
@@ -22,7 +22,7 @@ services:
   # that content can be transferred through the unprivileged sshd process
   # using `scp` etc.
   sshstart:
-    image: lscr.io/linuxserver/openssh-server:latest
+    image: lscr.io/linuxserver/openssh-server:latest@sha256:39ba37d50fdd6be1bf70644c871e5dcb9234ee79ac56424ea03ca08cadf1e7b0
     user: root
     depends_on:
       - ssh

compose.yml

@@ -3,7 +3,7 @@ version: "3.8"
 
 services:
   app:
-    image: nginx:1.29.0
+    image: nginx:1.31.5@sha256:05b8cb60c354a44ab824ea6e7dc69b46d50762cdbe728a347a5b656e6fb3d7c4
     networks:
       - proxy
     deploy:
@@ -15,11 +15,11 @@ services:
         - "traefik.http.routers.${STACK_NAME}.rule=Host(`${DOMAIN}`${EXTRA_DOMAINS})"
         - "traefik.http.routers.${STACK_NAME}.entrypoints=web-secure"
         - "traefik.http.routers.${STACK_NAME}.tls.certresolver=${LETS_ENCRYPT_ENV}"
-        # Redirect from EXTRA_DOMAINS to DOMAIN
+        # Force HTTPS (redirect http -> https) on DOMAIN and any EXTRA_DOMAINS
         - "traefik.http.routers.${STACK_NAME}.middlewares=${STACK_NAME}-redirect"
-        - "traefik.http.middlewares.${STACK_NAME}-redirect.headers.SSLForceHost=true"
-        - "traefik.http.middlewares.${STACK_NAME}-redirect.headers.SSLHost=${DOMAIN}"
-        - "coop-cloud.${STACK_NAME}.version=1.11.0+1.29.0"
+        - "traefik.http.middlewares.${STACK_NAME}-redirect.redirectscheme.scheme=https"
+        - "traefik.http.middlewares.${STACK_NAME}-redirect.redirectscheme.permanent=true"
+        - "coop-cloud.${STACK_NAME}.version=1.14.0+1.31.5"
         - "backupbot.backup=true"
         - "backupbot.backup.path=/usr/share/nginx/html"
     environment:

renovate.json

@@ -0,0 +1,14 @@
+{
+  "$schema": "https://docs.renovatebot.com/renovate-schema.json",
+  "extends": [
+    "config:recommended"
+  ],
+  "packageRules": [
+    {
+      "matchDatasources": [
+        "docker"
+      ],
+      "pinDigests": true
+    }
+  ]
+}