Add schedule configuration to reduce resource usage by limiting
Renovate runs to a nightly maintenance window.
- schedule: 'after 2am and before 4am'
- timezone: Europe/Amsterdam
Renovate will now only check for updates during this window instead
of running continuously.
Add support for Renovate to detect and update Docker image versions
defined in Terraform files using annotation comments.
Changes:
- Add 3 regex managers to config.js.tpl for different annotation patterns:
- Basic: # renovate: datasource=docker
- With versioning: # renovate: datasource=docker versioning=semver
- Separate variable: # renovate: datasource=docker depName=redis
- Update README.md with comprehensive Docker container annotation docs
- Update QUICKSTART.md with Terraform Docker container examples
- Add example-annotated-containers.tf with usage patterns
This enables Renovate to automatically create PRs when Docker images
used in Terraform container definitions have updates available.
Comprehensive documentation cleanup to align with current implementation
and remove outdated/confusing content.
DELETED:
- SUMMARY.md - Historical migration document from Ansible EDA to Renovate
(migration is complete, document no longer needed)
UPDATED README.md Variables Section:
- Split into "Terraform Variables" and "Vault-Stored Configuration" sections
- Removed 5 incorrectly documented variables that are actually stored in Vault:
* renovate_platform, renovate_endpoint, renovate_token
* renovate_git_author, renovate_username
- Added missing variable documentation:
* dns_servers (list of DNS servers for hostname resolution)
* vault_skip_tls_verify (skip TLS verification for Vault)
- Fixed log_level default value: "info" → "debug" (matches variables.tf)
- Added clear explanation that Vault keys are NOT Terraform variables
- Added reference to "Store Credentials in Vault" section
UPDATED QUICKSTART.md Troubleshooting:
- Added DNS resolution error troubleshooting section
- Documents ENOTFOUND errors and how to resolve them
- Provides diagnostic commands (dig @DNS_SERVER hostname)
- Shows how to configure dns_servers variable
- Explains hostname verification (git.bsdserver.nl vs gitea.bsdserver.nl)
- Provides alternative solution (use IP address instead of hostname)
These changes ensure documentation accurately reflects:
- Current implementation (Vault-based credential storage)
- All available configuration options (including dns_servers)
- Correct default values
- Clear separation between TF vars and Vault-stored config
- Complete troubleshooting guidance for common issues
Changed dns configuration to use conditional assignment to avoid
setting empty DNS list which Docker might ignore.
Changes:
- dns = length(var.dns_servers) > 0 ? var.dns_servers : null
This ensures that:
- If dns_servers is empty, dns is set to null (Docker uses defaults)
- If dns_servers has values, they are properly applied to container
Added TF_VAR_dns_servers to all pipeline stages to configure the
Renovate container to use internal DNS server for hostname resolution.
Changes:
- Added TF_VAR_dns_servers: '["192.168.2.2"]' to all pipeline env blocks
- Applied to: terraform-plan (init and plan)
- Applied to: terraform-apply (init and apply)
- Applied to: terraform-destroy (init, plan, execute)
This configures the Renovate container to use 192.168.2.2 as its DNS
server, allowing it to resolve internal hostnames like gitea.bsdserver.nl.
Fixes the ENOTFOUND DNS error:
getaddrinfo ENOTFOUND gitea.bsdserver.nl
The DNS configuration is passed as a Terraform variable in JSON array
format: '["192.168.2.2"]'
Added dns_servers variable to allow configuring custom DNS servers for
the container to resolve internal hostnames.
Changes:
- Added dns_servers variable (list of strings, default empty)
- Added dns configuration to docker_container resource in main.tf
- Allows container to resolve internal domains like gitea.bsdserver.nl
This fixes the ENOTFOUND DNS resolution error where the container
couldn't resolve internal Gitea hostname, which was being reported
as an "Authentication failure" but was actually a network/DNS issue.
The error was:
getaddrinfo ENOTFOUND gitea.bsdserver.nl
Usage:
dns_servers = ["192.168.x.x", "192.168.x.y"]
If not specified (default), container uses Docker's default DNS.
Updated comprehensive documentation across README, QUICKSTART, and
MIGRATION_GUIDE to clarify that Renovate credentials are stored in
HashiCorp Vault, not passed as Terraform variables.
Changes to README.md:
- Added detailed Vault setup section in Gitea Bot Setup
- Documented all 5 required keys in secret/renovate path
- Added vault kv put example with all required fields
- Added token regeneration instructions
- Clarified prerequisites to include Vault secret requirements
- Emphasized CRITICAL nature of Vault storage
Changes to QUICKSTART.md:
- Added comprehensive Step 3: Store Credentials in Vault
- Included complete vault kv put command with all keys
- Added verification steps with expected output
- Listed common mistakes to avoid (missing username, wrong endpoint, etc.)
- Updated Step 4 to clarify tfvars only needs Vault auth
- Renumbered subsequent steps (5-9)
- Added environment variable verification in Step 6
- Added troubleshooting steps for authentication errors
Changes to MIGRATION_GUIDE.md:
- Clearly separated Vault-stored config from Terraform variables
- Added vault kv put example in New Required Configuration section
- Updated migration steps to include Vault credential storage
- Clarified that renovate_endpoint and renovate_token are NOT tfvars
- Listed all 5 required Vault keys with descriptions
These changes address the authentication failures caused by:
- Missing renovate_username in environment variables
- Confusion about where credentials should be stored
- Token regeneration without updating Vault
All documentation now consistently emphasizes the Vault-first approach
and provides clear, copy-paste-ready commands for proper setup.
The renovate_username value was stored in Vault but not being passed
as an environment variable to the container, causing authentication
failures with Gitea.
Changes:
- Added RENOVATE_USERNAME to the environment variables list in main.tf
- Value is retrieved from Vault at secret/renovate with key renovate_username
This should resolve the "Authentication failure" error in the Renovate
container logs, as the username is required for proper Gitea authentication.
The renovate_endpoint and renovate_token values are retrieved from
Vault (secret/renovate) via data sources in the Terraform code, not
passed as Terraform variables.
Changes:
- Commented out TF_VAR_renovate_endpoint in all pipeline stages
- Commented out TF_VAR_renovate_token in all pipeline stages
- These values are properly sourced from Vault data sources
This fixes the container restart issue where Renovate couldn't find
the Gitea personal access token because the environment variable
wasn't being set correctly from Vault data.
Affected stages:
- terraform-validate (init and validate steps)
- terraform-plan (init and plan steps)
- terraform-apply (init and apply steps)
- terraform-destroy (init, plan, and execute steps)
Updated Docker provider configuration:
- Changed from tcp://192.168.2.170:2376 to ssh://ansible@wbyc-srv-docker01.bsdserver.lan:22
- Added ssh_opts with path to SSH key and StrictHostKeyChecking=no
- Removed cert_path configuration (not needed for SSH)
This matches the working configuration from terraform-docker-eda module
and uses the SSH key retrieved from Vault via setup-ssh.sh script.
Added vault_skip_tls_verify variable to fix Terraform validation error.
This variable is referenced in provider.tf but was not declared in
variables.tf.
Default value is false for security, can be set to true for
self-signed certificates in development/testing environments.
Added working pipeline based on terraform-docker-eda module:
- Added pipeline.yaml with complete CI/CD workflow including Vault CLI setup
- Added setup-ssh.sh for Docker provider SSH key authentication
- Added .tflint.hcl for Terraform linting configuration
- Removed old sonarqube.yaml pipeline file
Pipeline now includes:
- Vault CLI installation and SSH key setup via script
- Proper backend configuration with -backend-config flags
- All security scans: TFLint, Tfsec, Checkov
- SonarQube integration
- Terraform plan/apply with MinIO artifact storage
- Terraform destroy workflow with manual approval
This pipeline configuration has been proven to work with Vault, MinIO,
and Docker providers using self-signed certificates.
- Added required_version constraint (>= 1.5.0)
- Added DNS provider to required_providers with version ~> 3.4
- Updated provider versions to use pessimistic constraint operator (~>)
- Fixes TFLint warnings for missing version constraints
Complete rewrite of the module to deploy a Renovate bot for automated
dependency management with Gitea integration.
Breaking Changes:
- Module purpose changed from Ansible EDA to Renovate bot
- All variables restructured for Renovate configuration
- State file path updated to home/docker/renovate/renovate.tfstate
- Volumes changed from EDA rulebooks/logs to config/cache
- Container image now uses renovate/renovate:latest
Added:
- Gitea platform integration with token authentication
- Renovate configuration template (config.js.tpl)
- Repository configuration examples
- Gitea Actions workflow examples
- SonarQube integration examples
- Comprehensive documentation (README, QUICKSTART, MIGRATION_GUIDE)
- CHANGELOG.md for version tracking
- Security best practices
Removed:
- All Ansible EDA-specific configuration
- Traefik labels (not needed for Renovate)
- Old EDA documentation files
- example-rulebook.yml
Updated:
- Complete README with Gitea setup instructions
- terraform.tfvars with Renovate configuration
- All resource names from ansible_eda to renovate
- Backend state path
This is version 2.0.0 - not backward compatible with previous EDA version.
See MIGRATION_GUIDE.md for detailed migration instructions.
