From 5e04305c644c1e82d5d7f2a6bf8cf3f5ccb48eca Mon Sep 17 00:00:00 2001
From: "Simon L." <szaimen@e.mail.de>
Date: Wed, 2 Sep 2026 11:07:46 +0200
Subject: [PATCH] chore: update base image to HAProxy 3.4 LTS and track LTS in
 Renovate

Move the production and debugging images from HAProxy 3.2.22 to 3.4.4
on Alpine 3.24. 3.4 is the current LTS branch, supported until 2031-Q2,
where 3.2 reaches EOL in 2030-Q2.

Deliberately skip 3.3: it is a non-LTS branch that stops receiving fixes
around 2027-Q1, so it would be a downgrade in support horizon.

The pinned haproxy-python-spoa commit is unchanged and remains upstream
HEAD. Verified against 3.4.4 by building both images and driving traffic
through the exapps frontend: the SPOE agent returns verdicts for request
paths up to 6 KB and headers up to 7 KB (multi-segment frames, which the
pinned single-write commit exists to handle) with no SPOP frame, mux, or
reset errors, and the container reports healthy.

Configure Renovate to keep the base image on LTS branches only. HAProxy
ships LTS on even minors, so match that shape rather than a fixed version
ceiling, which would have let a future non-LTS branch through. Minor and
major bumps are split into their own PR labelled needs-spoe-testing, since
those are the ones that can change SPOP mux behaviour.

Also replace the deprecated config:base preset with config:recommended and
group GitHub Actions bumps into a single PR.

Signed-off-by: Simon L. <szaimen@e.mail.de>
---
 .github/renovate.json            | 24 +++++++++++++++++++++++-
 Dockerfile                       |  6 +++---
 development/debugging/Dockerfile |  2 +-
 3 files changed, 27 insertions(+), 5 deletions(-)

diff --git a/.github/renovate.json b/.github/renovate.json
index d752477..b4ce6a2 100644
--- a/.github/renovate.json
+++ b/.github/renovate.json
@@ -1,10 +1,32 @@
 {
   "$schema": "https://docs.renovatebot.com/renovate-schema.json",
   "extends": [
-    "config:base",
+    "config:recommended",
     ":disableDependencyDashboard"
   ],
   "ignorePaths": [
     "**/tests/**"
+  ],
+  "packageRules": [
+    {
+      "description": "Track only HAProxy LTS branches. Upstream ships LTS on even minors (3.0, 3.2, 3.4, ...) with ~5 years of support; odd minors (3.1, 3.3, ...) are non-LTS and go EOL about a year after release. See https://www.haproxy.org/ for branch status.",
+      "matchDatasources": ["docker"],
+      "matchPackageNames": ["docker.io/library/haproxy", "haproxy"],
+      "allowedVersions": "/^\\d+\\.\\d*[02468](\\.\\d+)?(-alpine.*)?$/",
+      "groupName": "haproxy base image"
+    },
+    {
+      "description": "A HAProxy minor bump can change SPOP mux behaviour, which the pinned haproxy-python-spoa commit compensates for. Keep those PRs separate from routine patch bumps so the SPOE agent gets tested against the new branch.",
+      "matchDatasources": ["docker"],
+      "matchPackageNames": ["docker.io/library/haproxy", "haproxy"],
+      "matchUpdateTypes": ["major", "minor"],
+      "groupName": "haproxy LTS branch upgrade",
+      "addLabels": ["needs-spoe-testing"]
+    },
+    {
+      "description": "Group GitHub Actions bumps into a single PR.",
+      "matchManagers": ["github-actions"],
+      "groupName": "github-actions"
+    }
   ]
 }
diff --git a/Dockerfile b/Dockerfile
index ff77765..caf103f 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -23,7 +23,7 @@
 #  - HP_SHARED_KEY or HP_SHARED_KEY_FILE must be provided at runtime.
 # -------------------------------------------------------------------------
 
-FROM docker.io/library/haproxy:3.2.22-alpine3.24
+FROM docker.io/library/haproxy:3.4.4-alpine3.24
 
 USER root
 
@@ -67,8 +67,8 @@ RUN set -ex; \
 
 # Install the Python SPOA library.
 # Pinned to a commit: the single-write frame emission it contains is required for
-# HAProxy 3.2+, whose SPOP mux resets connections when a frame arrives split
-# across TCP segments. Bump this deliberately together with the library.
+# HAProxy 3.2+ (we run 3.4 LTS), whose SPOP mux resets connections when a frame
+# arrives split across TCP segments. Bump this deliberately together with the library.
 RUN pip install --break-system-packages \
         pydantic==2.13.4 \
         git+https://github.com/cloud-py-api/haproxy-python-spoa.git@f00f3f7b1b0f56e10052af6c0d07e81c5195d84d
diff --git a/development/debugging/Dockerfile b/development/debugging/Dockerfile
index e6651df..cef1ab8 100644
--- a/development/debugging/Dockerfile
+++ b/development/debugging/Dockerfile
@@ -1,7 +1,7 @@
 # SPDX-FileCopyrightText: 2025 Nextcloud GmbH and Nextcloud contributors
 # SPDX-License-Identifier: AGPL-3.0-or-later
 
-FROM haproxy:3.2.22-alpine3.24
+FROM haproxy:3.4.4-alpine3.24
 
 USER root