system/hosts/istal/services/renovate.nix

{ config, pkgs, ... }:

{
  age.secrets.renovate-gitea-token.file = ./renovate-gitea-token.age;
  age.secrets.renovate-github-token.file = ./renovate-github-token.age;

  services.renovate = {
    enable = true;
    package = pkgs.unstable.renovate;
    schedule = "0..3,10..23:00";
    credentials = {
      RENOVATE_TOKEN = config.age.secrets.renovate-gitea-token.path;
      GITHUB_COM_TOKEN = config.age.secrets.renovate-github-token.path;
    };
    runtimePackages = with pkgs.unstable; [
      nodePackages.pnpm
      nodePackages.npm
      python312
      poetry
      gnumake
      cargo
    ];
    settings = {
      platform = "gitea";
      endpoint = "https://git.pleshevski.ru";
      assignees = [ "pleshevskiy" ];
      autodiscover = true;
      packageRules = [
        {
          matchUpdateTypes = [ "minor" "patch" "pin" "digest" ];
          automerge = true;
        }
      ];
      automergeStrategy = "fast-forward";
      onboardingConfig = {
        "$schema" = "https://docs.renovatebot.com/renovate-schema.json";
        extends = [ "config:recommended" ];
        configMigration = true;
      };
      globalExtends = ["npm:unpublishSafe"];

      cacheHardTtlMinutes = 30;
      httpCacheTtlDays = 1;
    };
  };

  # systemd.services.renovate.environment.LOG_LEVEL = "debug";
}