host/istal: add renovate bot

flake.nix

@@ -178,7 +178,8 @@
                 ]
                 ++ extraModules
                 ++ [ ./modules/nixos ]
-                ++ [ ./hosts/${hostname}/configuration.nix ];
+                ++ [ ./hosts/${hostname}/configuration.nix ]
+                ++ [ "${inputs.nixpkgs-unstable}/nixos/modules/services/misc/renovate.nix" ];
             })
           (import ./hosts inputs);
       diskoConfigurations = {

hosts/istal/services/default.nix

@@ -4,5 +4,6 @@
     ./wireguard
     ./docker-registry-proxy.nix
     ./nginx.nix
+    ./renovate.nix
   ];
 }

hosts/istal/services/renovate.nix

@@ -0,0 +1,46 @@
+{ config, pkgs, ... }:
+
+{
+  age.secrets.renovate-gitea-token.file = ./renovate-gitea-token.age;
+  age.secrets.renovate-github-token.file = ./renovate-github-token.age;
+
+  services.renovate = {
+    enable = true;
+    package = pkgs.unstable.renovate;
+    schedule = "0..3,10..23:00/15";
+    credentials = {
+      RENOVATE_TOKEN = config.age.secrets.renovate-gitea-token.path;
+      GITHUB_COM_TOKEN = config.age.secrets.renovate-github-token.path;
+    };
+    runtimePackages = with pkgs.unstable; [
+      nodePackages.pnpm
+      nodePackages.npm
+      python312
+      poetry
+      gnumake
+      cargo
+    ];
+    settings = {
+      platform = "gitea";
+      endpoint = "https://git.pleshevski.ru";
+      assignees = [ "pleshevskiy" ];
+      autodiscover = true;
+      packageRules = [
+        {
+          matchUpdateTypes = [ "minor" "patch" "pin" "digest" ];
+          automerge = true;
+        }
+      ];
+      automergeStrategy = "fast-forward";
+      onboardingConfig = {
+        "$schema" = "https://docs.renovatebot.com/renovate-schema.json";
+        extends = [ "config:recommended" ];
+        configMigration = true;
+      };
+      globalExtends = ["npm:unpublishSafe"];
+
+      cacheHardTtlMinutes = 60 * 24;
+      httpCacheTtlDays = 7;
+    };
+  };
+}