[dependabot]

Bumps postgres from 17.11 to 18.6.

[DanielBoring]

Prepared and reviewed at 66fc9a5, based on main cd62a22. Only gitea/compose.yaml and gitea/README.md differ from main. The live application image is unchanged (exact pinned image reports Gitea 1.27.3 locally). PostgreSQL 18.6 now uses Dependabot's refreshed digest 979bccfde35445db618c65107d27d08c6c21339d8dc3ad4c830c6633947be0e4 and the required /var/lib/postgresql mount.

Vendor guidance: https://docs.gitea.com/1.27/installation/database-prep/ supports PostgreSQL >=12; https://docs.gitea.com/1.27/administration/backup-and-restore/ requires a consistent stopped-app database/files/repositories backup. This range is not an explicit vendor certification of the user's deployment.

Validation passed: 26 checker tests, all 48 dummy Compose checks, README Bash syntax and scope/whitespace checks. Exact-image isolated LOCAL rehearsal passed synthetic user/private repository/issue, HTTP push and HTTP/SSH clones, native database dump/globals and cold app copy, PostgreSQL 18 restore, app/database recreation persistence, and rollback to original PostgreSQL 17 plus cold app state. PostgreSQL-18-only writes were intentionally absent after rollback, demonstrating that rollback is only lossless before normal writes resume. The refreshed PostgreSQL digest was retested. No production data/settings, live SQL queries, published ports, Docker socket or external integrations were used.

Final-head CI: https://github.com/DanielBoring/HomeLab/actions/runs/41213370852

HOLD: DO NOT MERGE OR AUTO-DEPLOY onto existing PostgreSQL 17 data. Gitea is live and Portainer polls main. The user chose to run commands in the TrueNAS shell. README starts with a read-only host/storage preflight, requires private actual Portainer Compose/settings exports, gates ZFS/custom roles/external storage, and stages the exact reviewed PR commit without merging. Live backup recoverability, actual host layout, Portainer adoption, production integrations and full feature acceptance remain unverified. Keep polling paused through any separately approved migration and reconcile Portainer only after successful acceptance and merge approval.

[DanielBoring]

Operator backup helper added and reviewed at 62b9a17. PostgreSQL/Gitea image pins are unchanged from the previously successful migration rehearsal. New source changes since prior review are gitea/backup-before-pg18.sh plus a short README link.

The helper is BACKUP ONLY: guarded TrueNAS/native local Docker/Gitea image and bind checks, root-private empty sibling destination, explicit GitOps-paused/downtime confirmation, image archives before downtime, stopped-app native dump/globals, clean stopped-PG17 and full-app cold archives, then DB readiness before restarting the original app. Original container IDs/images are checked during recovery. Archive listings/checksums run after service recovery. No upgrade, restore, source rename/chown, pruning or GitOps mutation occurs.

Reviewed LF script SHA-256: ffa26a67d0e00115f26e737654de6ee4f3e964e3fed6ca6e2c91a0031d565d4b. Fixed source: https://raw.githubusercontent.com/DanielBoring/HomeLab/62b9a17b5eca5c11d075da21c85f31c1759b1510/gitea/backup-before-pg18.sh

Local tests used fixture host/container lifecycle metadata plus real synthetic PostgreSQL 17 dumps, GNU tar and checksum operations. Success, nonzero backup-folder group, remaining DB client refusal, archive/stop failure recovery, no-overwrite and wrong-host guards passed. These tests do not prove TrueNAS/Portainer lifecycle or actual backup restore. Actual restore verification remains a separate step. Fixture resources were removed; production was untouched.

Final-head CI passed: https://github.com/DanielBoring/HomeLab/actions/runs/41214763420

PR remains UNMERGED. The user will run the reviewed helper in the TrueNAS shell only after approving the backup downtime and pausing Gitea GitOps. The chosen local backup is on the same SSD pool and is not off-host protection. A separate live migration/merge approval is still required.

[DanielBoring]

Post-merge/live verification (2026-11-01):

• PR merged at e79b1780b536c77526bf357b38b20f331c63f54d; post-merge CI passed.
• Portainer stack 195 now records that same main commit. The targeted adoption left both Gitea container identities unchanged; the other 80 container identities also remained unchanged.
• PostgreSQL reports 18.6 with /var/lib/postgresql/18/docker. Counts remain 1 user, 11 repository records, 0 issues. Both containers are healthy with zero restarts; HTTPS health returns 200 with certificate validation.
• Gitea remains 1.27.3 on its original exact image and captured runtime settings. The user confirmed login and repository browsing. Clone transport testing remains unconfirmed and was disclosed before merge approval.
• Original PG17 data, fresh cutover dump/settings and backups are retained. Shared Git-source polling and the Gitea webhook remain disabled while the remaining campaign migrations are prepared.

The README adoption-gate text records the pre-merge checkpoint; this comment records its subsequent completed merge/adoption. No backup metadata-fidelity or off-host-durability claims have been added.