Pin gluetun in values too, so Renovate proposes it there

The chart bundles nine independently versioned upstreams, and eight of them
were already pinned in values.yaml while only gluetun took its tag from
appVersion. That split had no upside: it made gluetun the one image Renovate
could not reach through the built-in helm-values manager, and it implied a
"main app" the stack does not have.

gluetun now carries gluetun.image.repository/tag like every other image, and
the StatefulSet renders it from there. No tag comes from appVersion any more.
Renovate picks all nine up through helm-values - the manager the repo already
relies on for sidecar images - and ci/renovate-bump-chart.sh bumps the chart
version with each update.

Consequences, all documented where they bite:
- renovate.json5 deliberately gets no app-version block for this chart. One
  would either duplicate the helm-values updates or rewrite an appVersion that
  selects no image. The absence is commented so it does not read as an
  oversight.
- freesailarr leaves the change-app-version.yml choice list. That workflow
  rewrites appVersion and republishes, which for this chart would change no
  deployed image at all.
- appVersion becomes a hand-maintained marker for the gluetun line. Since
  renovate-bump-chart.sh bumps the patch level on an unchanged appVersion, a
  gluetun update has to be paired with a hand edit of appVersion, or the +up
  suffix stops describing what the chart deploys. Noted in Chart.yaml,
  values.yaml and README.

freesailarr/Chart.yaml

@@ -6,6 +6,13 @@ icon: https://raw.githubusercontent.com/qdm12/gluetun/master/doc/logo_256.png
 type: application
 
 version: 1.0.0+upv3.41.1
+# Hand-maintained marker for the gluetun line this chart is built around - it
+# is NOT the source of any image tag. All nine images, gluetun included, are
+# pinned in values.yaml so Renovate's helm-values manager can propose them
+# there; consequently this chart has no app-version block in renovate.json5 and
+# nothing rewrites this field automatically. Update it by hand together with
+# gluetun.image.tag, otherwise the +up suffix of version: stops describing what
+# the chart deploys.
 appVersion: "v3.41.1"
 
 maintainers:

freesailarr/templates/freesailarr.sfs.yaml

@@ -86,7 +86,7 @@ spec:
         # internet only through the Wireguard tunnel (gluetun's firewall acts
         # as kill switch).
         - name: gluetun
-          image: "qmcgaw/gluetun:{{ .Chart.AppVersion }}"
+          image: "{{ .Values.gluetun.image.repository }}:{{ .Values.gluetun.image.tag }}"
           imagePullPolicy: IfNotPresent
           # An uncleanly exited gluetun (crash, OOM killer, node issue) leaves
           # its ip rule, routing table and tun device behind in the shared pod

freesailarr/values.yaml

@@ -4,10 +4,21 @@
 # the Wireguard tunnel.
 #
 # Image pinning (documented deviation from the Chart.AppVersion standard):
-# appVersion pins the gluetun image only. All other app images are pinned via
-# values (<app>.image.repository / <app>.image.tag) because the stack combines
-# nine independently versioned upstream projects; the pinned tags are reviewed
-# alongside every app-version update round, like side images in other charts.
+# NO image tag comes from appVersion. All nine images, gluetun included, are
+# pinned here via <app>.image.repository / <app>.image.tag, because the stack
+# combines nine independently versioned upstream projects and none of them is
+# "the" one app version.
+#
+# That is also what puts every image under Renovate: the built-in helm-values
+# manager reads image.repository/image.tag pairs out of this file and proposes
+# one update per image, and ci/renovate-bump-chart.sh bumps the chart version
+# along with it. A chart whose main image came from appVersion would instead
+# need a hard-coded block in renovate.json5 - freesailarr deliberately has none.
+#
+# Chart.yaml's appVersion is therefore a hand-maintained marker for the gluetun
+# line this chart is built around, not the source of any tag. Keep it in step
+# with gluetun.image.tag below when you accept a gluetun update, otherwise the
+# +up suffix of the chart version drifts away from what is actually deployed.
 
 # Scale the whole chart down without uninstalling it: scaleDown: true renders
 # every Deployment/StatefulSet with replicas: 0 (and suspends CronJobs) and
@@ -113,7 +124,11 @@ ingress:
   annotations: {}
 
 gluetun:
-  # Image tag comes from Chart.AppVersion (gluetun is the chart's main app).
+  # Pinned here like every other image in this chart, so Renovate's helm-values
+  # manager proposes gluetun updates too. Docker Hub tags carry a v prefix.
+  image:
+    repository: qmcgaw/gluetun
+    tag: v3.41.1
   vpn:
     serviceProvider: mullvad
     type: wireguard