ci(renovate): enable Dockerfile manager for the HTTP Gitea registry

Turn on the `dockerfile` manager so Renovate also proposes base-image bumps for
docker/Dockerfile (mcr.microsoft.com/dotnet/* and our internal
192.168.1.95:3000/timothy/ersatztv-ffmpeg). The internal registry is HTTP-only,
so the workflow passes a host rule (insecureRegistry + registry read creds reused
from REGISTRY_USER/REGISTRY_PASSWORD) via RENOVATE_HOST_RULES — kept in the
workflow env, not in the committed renovate.json.

- Scope: only the built amd64 docker/Dockerfile; the vestigial upstream
  arm32v7/arm64/ffmpeg-tests Dockerfiles (archived ghcr base) are disabled.
- Group mcr.microsoft.com/dotnet/* base images into one PR.
- Compose files are build-only (no image tags) -> docker-compose manager not needed.

refs server-management#484

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

.gitea/workflows/renovate.yml

@@ -61,6 +61,10 @@ jobs:
           RENOVATE_REPOSITORIES: timothy/ersatztv
           RENOVATE_AUTODISCOVER: 'false'
           RENOVATE_GIT_AUTHOR: 'Renovate Bot <renovate@tblindustries.be>'
+          # Let the dockerfile manager query our HTTP-only Gitea container registry for the
+          # ersatztv-ffmpeg base image. Creds (reused from the image-push secrets) + insecureRegistry
+          # live here, NOT in renovate.json, so they stay out of the committed config.
+          RENOVATE_HOST_RULES: '[{"matchHost":"192.168.1.95:3000","hostType":"docker","username":"${{ secrets.REGISTRY_USER }}","password":"${{ secrets.REGISTRY_PASSWORD }}","insecureRegistry":true}]'
           RENOVATE_DRY_RUN: ${{ inputs.dryRun }}
           LOG_LEVEL: ${{ inputs.logLevel || 'info' }}
         run: renovate

renovate.json

@@ -7,13 +7,29 @@
   "semanticCommits": "enabled",
   "dependencyDashboard": true,
   "labels": ["dependencies"],
-  "enabledManagers": ["nuget", "github-actions"],
+  "enabledManagers": ["nuget", "github-actions", "dockerfile"],
   "osvVulnerabilityAlerts": true,
   "vulnerabilityAlerts": {
     "labels": ["dependencies", "security"]
   },
   "prConcurrentLimit": 5,
   "packageRules": [
+    {
+      "description": "Only manage the built amd64 docker/Dockerfile; ignore the vestigial upstream arm/ffmpeg-tests Dockerfiles (this fork ships amd64-only)",
+      "matchManagers": ["dockerfile"],
+      "matchFileNames": [
+        "docker/arm32v7/Dockerfile",
+        "docker/arm64/Dockerfile",
+        "docker/ffmpeg-tests/Dockerfile"
+      ],
+      "enabled": false
+    },
+    {
+      "description": "Group the .NET base images (mcr.microsoft.com/dotnet/*) into one PR",
+      "matchManagers": ["dockerfile"],
+      "matchPackageNames": ["/^mcr\\.microsoft\\.com\\/dotnet\\//"],
+      "groupName": ".NET base images"
+    },
     {
       "description": "Group the Microsoft.Extensions.* family into one PR",
       "matchPackageNames": ["/^Microsoft\\.Extensions\\./"],