build(deps): bump esphome/esphome in /docker/home/esphome

Bumps [esphome/esphome](https://github.com/esphome/esphome) from 2025.12.6 to 2025.12.7.
- [Release notes](https://github.com/esphome/esphome/releases)
- [Commits](https://github.com/esphome/esphome/compare/2025.12.6...2025.12.7)

---
updated-dependencies:
- dependency-name: esphome/esphome
  dependency-version: 2025.12.7
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>

.github/dependabot.yml

@@ -5,6 +5,7 @@ updates:
     schedule:
       interval: weekly
     directories:
+      - "/docker/gitea-actions"
       - "/docker/home/esphome"
       - "/docker/home/matter-server"
       - "/docker/home/mosquitto-mqtt"
@@ -45,6 +46,7 @@ updates:
       - "/kubernetes/code/gitea"
       - "/kubernetes/code/harbor"
       - "/kubernetes/home/home-assisant"
+      - "/kubernetes/home/zigbee2mqtt"
       - "/kubernetes/infrastructure/authentik"
       - "/kubernetes/personal/linkwarden"
       - "/kubernetes/personal/notesnook"

.swarmcd/stacks.yaml

@@ -1,3 +1,10 @@
+gitea-actions:
+  repo: homeprod
+  branch: main
+  compose_file: docker/gitea-actions/docker-compose.yml
+  sops_files:
+    - docker/gitea-actions/.env
+
 esphome:
   repo: homeprod
   branch: main

docker/gitea-actions/.env

@@ -0,0 +1,11 @@
+GITEA_INSTANCE_URL=ENC[AES256_GCM,data:PYjmpgDEvPEC1S7MrN6d91IUBnGbFA9Xag==,iv:m7YQOMnuEoT5wDyy47aaTqjJG+dhqTJKf5i3hQs6GwY=,tag:2ldKTNRqdJEXTxr3uAyLLQ==,type:str]
+GITEA_RUNNER_REGISTRATION_TOKEN=ENC[AES256_GCM,data:RDnENtxQw80C7SwmMZV2DTlEx4+uvzVMy95leGb/1RR6egc6S4xWnQ==,iv:wThZ2+qukJqC+ApvXC9GBdneXJ00jkkTyq+2VXSDG+w=,tag:KygPnxauOpaI1goZ4+uf3g==,type:str]
+GITEA_RUNNER_NAME=ENC[AES256_GCM,data:HvNmmQyKxk16WQV8dRfPOfCO39w=,iv:z1YuNWvglBYaXQwZXjMzXD4ZN2d7c3eD9GdSaG1maNY=,tag:FtX6wG47uTGjTQ8UNvGfcg==,type:str]
+GITEA_RUNNER_LABELS=
+sops_lastmodified=2025-09-16T19:22:00Z
+sops_mac=ENC[AES256_GCM,data:JIp7wyaIsy2Jg9p3ybHAljkDn8vpDRHtf7Zm2/M4exe6CbWCRn1jGMle+SnKBv2DKVciquQ9B9cKtKnVCpEAQOceZ1WakwS/mCmjYTIHqcvm8/vst1BYiL1Ovbw2dDstzWo8g+UTKAmVC7E0TJ01vAbsOab+fVacKLHF97pBqW8=,iv:5tcuJntPXrWCeNTGQbXzLaGZnCc8rr+gKG+UTRBNUaY=,tag:g7EYMAaOmwjKFYfz1ID5xQ==,type:str]
+sops_pgp__list_0__map_created_at=2025-09-16T19:22:00Z
+sops_pgp__list_0__map_enc=-----BEGIN PGP MESSAGE-----\n\nhQIMA7uy4qQr71wiAQ//c0J+b0XwnMbLlQku3tAEutXuEkQPMMrdOpPYwrua9nNu\nSVPBSiamnTeoaP2kM5lcaQ7HUaRLiS1qjXNVPsnAdkGPPID3SxUJzUo7Ca/JOq7e\n39ihqetWAcn9dNDofTxVKyvKXhXKGaDFy2LhaKugj4tkx6qdMA/XAldvRD6ik1jK\nAZjl2xGYTvZ+XgTGtFs6u3Z9ugD6Q3yPjKRSfeIO8NPT5OFFzY70wqlZflxcpupD\npnsvXQkAK1Rnz6F9+dh6jJYYijTdEe9Q0i+0Uy3q+wMsf8KRWs4ARD05DpgIOnUA\nG0s2kdOOlvqoJ/m2fSV7vkIcCvCwhEirn5kfrdUGi3ENazh0g3vpppAfE0ynZdSo\nDiXI7dzCwMxYi8edieOhK3RrOn8bx7B8F1WE+mHL6StQmD2G+xfvgtKlsEJGY2Ed\n1CpMZSQ0TwFx58fYiK+HsZrwAw/3YVzPWryaYvJ6P8QnY3oJOJihSYGRMmyH5WRo\nle1Rxd+Lrt1UnWyZQ7rpqMsYiIzihsNgNix/2wS1R9R1wRFXPdNDfzjrv1BGm/aJ\nOOqUFo6Hd3jEwYcSsG7mbe+hCAAXoJjZSU43dVzeZ0k5ls/lpOjqjQrZZLgz33uF\nNVNRAKTYD2y+/mQ4vpDUsHhu5rtjxh8u1CJf0++q1W/w+Z4ooq5hcNm3ud3DHYjS\nXgF1JA9ThTS+Hs1fV5SFzGMyFMFGeiTVJeww26R+1Vws7fFwbyAYugOqAgkiNkIf\nS2dsxlH1TRjBq1XD4GYk6P3VDUU5UyxG/5XiOexGEVSxBL/wg6TwpyL1hjvgc9k=\n=fmOe\n-----END PGP MESSAGE-----
+sops_pgp__list_0__map_fp=DC6910268E657FF70BA7EC289974494E76938DDC
+sops_unencrypted_suffix=_unencrypted
+sops_version=3.10.2

docker/gitea-actions/docker-compose.yml

@@ -0,0 +1,6 @@
+services:
+  runner:
+    image: docker.io/gitea/act_runner:nightly
+    env_file: .env
+    volumes:
+      - /var/run/docker.sock:/var/run/docker.sock

docker/home/esphome/docker-compose.yml

@@ -1,6 +1,6 @@
 services:
   esphome:
-    image: ghcr.io/esphome/esphome:2026.1.0
+    image: ghcr.io/esphome/esphome:2025.12.7
     ports:
       - "6052"
     networks:

docker/home/n8n/docker-compose.yml

@@ -1,6 +1,6 @@
 services:
   n8n:
-    image: docker.n8n.io/n8nio/n8n:2.4.6
+    image: docker.n8n.io/n8nio/n8n:2.3.4
     environment:
       - TZ=Europe/Paris
       - N8N_SECURE_COOKIE=false

docker/infrastructure/mail/stalwart/docker-compose.yml

@@ -1,6 +1,6 @@
 services:
   stalwart:
-    image: stalwartlabs/stalwart:v0.15.4
+    image: stalwartlabs/stalwart:v0.15.3
     container_name: stalwart
     networks:
       - default

docker/personal/media/films-series/jackett/docker-compose.yml

@@ -1,7 +1,7 @@
 services:
   jackett:
     container_name: jackett
-    image: ghcr.io/hotio/jackett:release-0.24.900
+    image: ghcr.io/hotio/jackett:release-0.24.834
     ports:
       - "9117"
     networks:

docker/personal/paperless/docker-compose.yml

@@ -16,7 +16,7 @@ services:
       POSTGRES_DB: paperless
 
   paperless-webserver:
-    image: ghcr.io/paperless-ngx/paperless-ngx:2.20.5
+    image: ghcr.io/paperless-ngx/paperless-ngx:2.20.4
     restart: unless-stopped
     networks:
       - default

docker/personal/radicale/docker-compose.yml

@@ -1,6 +1,6 @@
 services:
   radicale:
-    image: tomsquest/docker-radicale:3.6.0.0
+    image: tomsquest/docker-radicale:3.5.10.0
     container_name: radicale
     ports:
       - 5232

docker/production/buildpath/docker-compose.yml

@@ -10,7 +10,7 @@ services:
     env_file: .env
 
   patch_detector:
-    image: git.vhaudiquet.fr/vhaudiquet/lolstats-patch_detector:e0a39dab0a5130d8f98e956e3a1c5676410b2d25
+    image: git.vhaudiquet.fr/vhaudiquet/lolstats-patch_detector:de9406a583835dc0840da8586a6d539abdfb603f
     build: ./patch_detector
     restart: "no"
     deploy:
@@ -22,7 +22,7 @@ services:
 
 
   match_collector:
-    image: git.vhaudiquet.fr/vhaudiquet/lolstats-match_collector:e0a39dab0a5130d8f98e956e3a1c5676410b2d25
+    image: git.vhaudiquet.fr/vhaudiquet/lolstats-match_collector:de9406a583835dc0840da8586a6d539abdfb603f
     build: ./match_collector
     restart: "no"
     deploy:
@@ -33,7 +33,7 @@ services:
     env_file: .env
 
   frontend:
-    image: git.vhaudiquet.fr/vhaudiquet/lolstats-frontend:e0a39dab0a5130d8f98e956e3a1c5676410b2d25
+    image: git.vhaudiquet.fr/vhaudiquet/lolstats-frontend:de9406a583835dc0840da8586a6d539abdfb603f
     build: ./frontend
     restart: always
     networks:

infra/r740/docker/main.tf

@@ -1,49 +0,0 @@
-terraform {
-  required_providers {
-    docker = {
-      source  = "kreuzwerker/docker"
-      version = "3.6.2"
-    }
-  }
-}
-
-# Docker configuration
-provider "docker" {
-  host = "ssh://root@${var.docker_host}"
-}
-
-resource "docker_image" "swarm-cd" {
-  name = "swarm-cd:latest"
-  # For now, custom-built image based on custom development branch
-  # Once this reaches upstream, back to upstream tag, like:
-  # ghcr.io/m-adawi/swarm-cd:1.9.0
-}
-
-resource "docker_container" "swarm-cd" {
-  name  = "swarm-cd"
-  image = docker_image.swarm-cd.image_id
-  volumes {
-      host_path = "/var/run/docker.sock"
-      container_path = "/var/run/docker.sock"
-      read_only = true
-  }
-  volumes {
-    host_path = "/root/homeprod/.swarmcd/repos.yaml"
-    container_path = "/app/repos.yaml"
-    read_only = true
-  }
-  volumes {
-    host_path = "/root/homeprod/.swarmcd/stacks.yaml"
-    container_path = "/app/stacks.yaml"
-    read_only = true
-  }
-  volumes {
-    host_path = "/app/swarm-cd/data"
-    container_path = "/data"
-  }
-  env = [
-    "SOPS_GPG_PRIVATE_KEY=${var.sops_private_key}"
-  ]
-
-  depends_on = [ docker_image.swarm-cd ]
-}

infra/r740/docker/variables.tf

@@ -1,8 +0,0 @@
-variable "sops_private_key" {
-  description = "Private SOPS GPG key for SwarmCD to decrypt secrets"
-  type = string
-}
-variable "docker_host" {
-  description = "Docker machine hostname"
-  type = string
-}

kubernetes/tools/dashy/repository.yaml

@@ -5,4 +5,4 @@ metadata:
   namespace: dashy
 spec:
   interval: 1m
-  url: https://ivanwongtf.github.io/nas-helm-charts/
+  url: https://krzwiatrzyk.github.io/charts/

kubernetes/tools/dashy/values.yaml

@@ -1,11 +1,34 @@
-ingress:
-  main:
-    enabled: true
-    hosts:
-        - host: dashy.lan
-          paths:
-            - path: /
-              pathType: ImplementationSpecific
-persistence:
-  data:
-    enabled: true
+ingressRoute:
+    main:
+        enabled: true
+        hosts:
+            - host: dashy.lan
+              paths:
+                - path: /
+                  pathType: prefix
+sops:
+    lastmodified: "2026-01-18T00:16:51Z"
+    mac: ENC[AES256_GCM,data:J8ztKcQ+hK/LQT4H8iygc7tfjc8H7pMRRF/38Ly1r3SbrYZ2Yo79aUhVjkZUuO46OSNPgxn5MY/Krvjs087kVruxihWFO4tJ1mP6XIf5qe26sSmifEX9v1/ZnvGDB9NbMx0ResrhqqyB8uZo5cpcFuYF2MA5fZO1eGy71kJu4rU=,iv:eQdxbqyCT+oLQvjwGUK/8volvO0CRMeqyorn58qslq0=,tag:+nNgbpNJauZQFhdws4C1GA==,type:str]
+    pgp:
+        - created_at: "2026-01-18T00:16:51Z"
+          enc: |-
+            -----BEGIN PGP MESSAGE-----
+
+            hQIMA7uy4qQr71wiAQ/8C/4cUpuI+wXwawD1p5No5vPiiMFGf7tQUxtzIwjqpNc9
+            8dpNnvk4NFvuntrw/4+o5IgnFmxBjR41CgmG8U9YxBkxKeK13ia4Z31dfFWP28Fx
+            17Kvn8mZBpQhslTTaNCfqSrH2dDqraQwyCS3ZNOYOKpj+4bHAaaX8fruFXrogqQM
+            gCyo2icY5Nwo5RA730c0X5mFh7C/DCwXP+Uj9YlEWpY0otaHhX/HeNnEUnH4egMB
+            QITy0ouCWtrGwW1HcKl+McrFA9Ic/qw+tm+terllPkqxfDa1O9B1rsh8o1pTcYaM
+            JzZyrZsgpzI2J9Zp2Sb4qQ8Wlb/cuDZQLvK1CQ3Vc45qUcrGwgINaWdmzM9bv/ZA
+            hAhzGE+7vAS02q16OG2gRIujChlL95IlRMIfOF9sTglcE0j4N1/Nc9CgxP8MUO+6
+            zwoY+MQ5urdPadAB4WSutRneiDcLWmn24XKI44eJ/Vd3S/GoOq7LCNy9sU/Fpymo
+            cc9xfCCNgtNsErTC4PIKS9z5hfYXIvRs8sTzvUS7vfbNDv1dSgxagl79YiQoiJ/g
+            JgoS7mBvpV5DwyXjsuUlyjSrz3QjvltajX0T12ahHF/ercBE3ddGirUDUDYeHu32
+            +LaHFW84pDFRPI8OAJ6bN3M0wa+k1rToCOJMFSXGddbIieGB78SmVAjgYrvhL2TS
+            XgHRMDYdkgHw8s47NaFH08Rb2yMUmQCY1CF1IGZpeDuKADhtGki6c46FJh/qLpwU
+            MXwdeyhSgZle7Orr3rrJBYD6xK2q9jg07bsq7TwOL98Y8BkWf/hLHd5jAMzz01I=
+            =XjBN
+            -----END PGP MESSAGE-----
+          fp: DC6910268E657FF70BA7EC289974494E76938DDC
+    encrypted_regex: ^(password|value|ssh-key|api-key|user|username|privateKey|clientSecret|clientId|apiKey|extraArgs.*|.*Secret.*|extraEnvVars|.*SECRET.*|.*secret.*|key|.*Password|.*\.ya?ml)$
+    version: 3.10.2