2026-04-13 08:40:49 -07:00
|
|
|
# Service / Tooling/ Application Version Tracking
|
2026-02-16 17:02:56 -08:00
|
|
|
#
|
|
|
|
|
# Tracks when each BlumeOps service was last reviewed for version freshness.
|
|
|
|
|
# Used by `mise run service-review` to surface stale services.
|
|
|
|
|
#
|
|
|
|
|
# Fields:
|
|
|
|
|
# name - kebab-case service identifier
|
2026-04-12 08:54:32 -07:00
|
|
|
# type - argocd | ansible | nixos | fly | mise
|
2026-02-16 17:02:56 -08:00
|
|
|
# last-reviewed - date (YYYY-MM-DD) or null
|
|
|
|
|
# current-version - deployed version string or null
|
|
|
|
|
# upstream-source - URL to upstream releases/changelog
|
|
|
|
|
# notes - optional context
|
|
|
|
|
|
|
|
|
|
services:
|
|
|
|
|
- name: prometheus
|
|
|
|
|
type: argocd
|
2026-03-18 08:46:07 -07:00
|
|
|
last-reviewed: 2026-03-18
|
|
|
|
|
current-version: "v3.10.0"
|
2026-02-16 17:02:56 -08:00
|
|
|
upstream-source: https://github.com/prometheus/prometheus/releases
|
|
|
|
|
|
|
|
|
|
- name: loki
|
|
|
|
|
type: argocd
|
2026-03-20 16:10:19 -07:00
|
|
|
last-reviewed: 2026-03-20
|
|
|
|
|
current-version: "3.6.7"
|
2026-02-16 17:02:56 -08:00
|
|
|
upstream-source: https://github.com/grafana/loki/releases
|
|
|
|
|
|
|
|
|
|
- name: kube-state-metrics
|
|
|
|
|
type: argocd
|
2026-03-22 19:31:22 -07:00
|
|
|
last-reviewed: 2026-03-22
|
2026-02-16 17:14:38 -08:00
|
|
|
current-version: "v2.18.0"
|
2026-02-16 17:02:56 -08:00
|
|
|
upstream-source: https://github.com/kubernetes/kube-state-metrics/releases
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
- name: ntfy
|
|
|
|
|
type: argocd
|
2026-03-23 10:32:06 -07:00
|
|
|
last-reviewed: 2026-03-23
|
|
|
|
|
current-version: "v2.19.2"
|
2026-02-16 17:02:56 -08:00
|
|
|
upstream-source: https://github.com/binwiederhier/ntfy/releases
|
|
|
|
|
|
|
|
|
|
- name: homepage
|
2026-02-22 17:12:45 -08:00
|
|
|
type: argocd
|
2026-03-26 10:17:36 -07:00
|
|
|
last-reviewed: 2026-03-26
|
|
|
|
|
current-version: "v1.11.0"
|
2026-02-16 17:02:56 -08:00
|
|
|
upstream-source: https://github.com/gethomepage/homepage/releases
|
Replace Homepage Helm chart with kustomize manifests and custom Dockerfile (#221)
## Summary
- Replace third-party Helm chart (jameswynn/homepage v2.1.0, pinned at app v1.2.0) with plain kustomize manifests and a custom Dockerfile building from forge mirror at v1.10.1
- Adds Dockerfile (`containers/homepage/`) with multi-stage build (node:22-slim builder, node:22-alpine runtime)
- Creates kustomize manifests: Deployment, Service, ConfigMap (6 config files), ServiceAccount, ClusterRole, ClusterRoleBinding
- Keeps existing ingress-tailscale.yaml and all 6 ExternalSecret resources unchanged
- Updates ArgoCD app definition from multi-source Helm to single directory source
## Prerequisite
- Homepage source mirrored at forge.ops.eblu.me/eblume/homepage.git ✅
- Container must be built and pushed before syncing: `mise run container-release homepage v1.10.1`
## Deployment and Testing
- [ ] Build and push container image: `mise run container-release homepage v1.10.1`
- [ ] Branch-test via ArgoCD: `argocd app set homepage --revision feature/homepage-kustomize && argocd app sync homepage`
- [ ] Verify dashboard loads at go.ops.eblu.me / go.tail8d86e.ts.net
- [ ] Verify k8s autodiscovery works (services appear on dashboard)
- [ ] Verify widgets load (weather, Forgejo, Jellyfin, etc.)
- [ ] After merge: `argocd app set homepage --revision main && argocd app sync homepage`
🤖 Generated with [Claude Code](https://claude.com/claude-code)
Reviewed-on: https://forge.ops.eblu.me/eblume/blumeops/pulls/221
2026-02-19 18:29:19 -08:00
|
|
|
notes: Custom container, kustomize manifests
|
2026-02-16 17:02:56 -08:00
|
|
|
|
2026-02-19 14:27:04 -08:00
|
|
|
- name: nvidia-device-plugin
|
|
|
|
|
type: argocd
|
2026-03-27 07:19:24 -07:00
|
|
|
last-reviewed: 2026-03-27
|
|
|
|
|
current-version: "v0.19.0"
|
2026-02-19 14:27:04 -08:00
|
|
|
upstream-source: https://github.com/NVIDIA/k8s-device-plugin/releases
|
|
|
|
|
notes: DaemonSet + RuntimeClass on ringtail for GPU workloads
|
|
|
|
|
|
2026-02-16 17:02:56 -08:00
|
|
|
- name: frigate
|
|
|
|
|
type: argocd
|
2026-03-24 07:30:18 -07:00
|
|
|
last-reviewed: 2026-03-24
|
|
|
|
|
current-version: "0.17.1"
|
2026-02-16 17:02:56 -08:00
|
|
|
upstream-source: https://github.com/blakeblackshear/frigate/releases
|
|
|
|
|
|
|
|
|
|
- name: frigate-notify
|
|
|
|
|
type: argocd
|
Migrate Forgejo from Homebrew to source build (#316)
## Summary
- Migrate Forgejo from Homebrew to source-built binary with mcquack LaunchAgent
- Matches the established pattern used by zot, caddy, and alloy
- Upgrades to v14.0.3 (7 security fixes: PKCE bypass, OAuth scope bypass, open redirect, and more)
## Changes
- **Ansible role**: Replace brew install/services with binary stat check + LaunchAgent
- **Paths**: `/opt/homebrew/var/forgejo` → `~/forgejo`, binary at `~/code/3rd/forgejo/forgejo`
- **Run user**: `forgejo` → `erichblume` (LaunchAgent user; SSH git user stays `forgejo`)
- **Docs**: Updated Forgejo reference card, restart-indri guide
- **Service review**: Stamped frigate-notify, cloudnative-pg, blumeops-pg as current
## One-time migration steps (manual, on indri)
1. Clone from Codeberg, add forge mirror remote
2. Check out v14.0.3, build with `make build && make forgejo`
3. Stop brew, `cp -a` data to `~/forgejo`, fix ownership
4. Run `provision-indri --tags forgejo`
5. Verify, then `brew uninstall forgejo`
## Data safety
- `cp -a` preserves everything (repos, SQLite DB, LFS, sessions, OAuth config)
- Brew version stays installed as rollback until verification passes
- No schema changes between 14.0.2 → 14.0.3
Reviewed-on: https://forge.eblu.me/eblume/blumeops/pulls/316
2026-03-28 08:19:23 -07:00
|
|
|
last-reviewed: 2026-03-28
|
2026-02-22 08:42:47 -08:00
|
|
|
current-version: "v0.5.4"
|
2026-02-16 17:02:56 -08:00
|
|
|
upstream-source: https://github.com/0x2142/frigate-notify/releases
|
|
|
|
|
|
2026-03-05 10:51:07 -08:00
|
|
|
- name: tempo
|
|
|
|
|
type: argocd
|
2026-04-02 13:45:02 -07:00
|
|
|
last-reviewed: 2026-04-02
|
|
|
|
|
current-version: "2.10.3"
|
2026-03-05 10:51:07 -08:00
|
|
|
upstream-source: https://github.com/grafana/tempo/releases
|
2026-04-02 13:45:02 -07:00
|
|
|
notes: Home-built container from forge mirror
|
2026-03-05 10:51:07 -08:00
|
|
|
|
|
|
|
|
- name: alloy-tracing-ringtail
|
|
|
|
|
type: argocd
|
2026-03-13 16:25:27 -07:00
|
|
|
last-reviewed: 2026-03-13
|
|
|
|
|
current-version: "v1.14.0"
|
2026-03-05 10:51:07 -08:00
|
|
|
upstream-source: https://github.com/grafana/alloy/releases
|
|
|
|
|
notes: Privileged DaemonSet with Beyla eBPF for HTTP tracing on ringtail
|
|
|
|
|
|
2026-03-13 16:25:27 -07:00
|
|
|
- name: alloy-ringtail
|
|
|
|
|
type: argocd
|
|
|
|
|
last-reviewed: 2026-03-13
|
|
|
|
|
current-version: "v1.14.0"
|
|
|
|
|
upstream-source: https://github.com/grafana/alloy/releases
|
|
|
|
|
notes: DaemonSet on ringtail for host metrics and pod logs
|
|
|
|
|
|
2026-02-16 17:02:56 -08:00
|
|
|
- name: alloy-k8s
|
|
|
|
|
type: argocd
|
2026-03-13 16:25:27 -07:00
|
|
|
last-reviewed: 2026-03-13
|
|
|
|
|
current-version: "v1.14.0"
|
2026-02-16 17:02:56 -08:00
|
|
|
upstream-source: https://github.com/grafana/alloy/releases
|
|
|
|
|
|
|
|
|
|
- name: tailscale-operator
|
|
|
|
|
type: argocd
|
2026-03-22 19:31:22 -07:00
|
|
|
last-reviewed: 2026-03-22
|
2026-03-22 19:41:40 -07:00
|
|
|
current-version: "v1.94.2"
|
2026-02-16 17:02:56 -08:00
|
|
|
upstream-source: https://github.com/tailscale/tailscale/releases
|
|
|
|
|
|
|
|
|
|
- name: grafana
|
|
|
|
|
type: argocd
|
2026-04-02 11:33:19 -07:00
|
|
|
last-reviewed: 2026-04-02
|
|
|
|
|
current-version: "12.4.2"
|
2026-02-16 17:02:56 -08:00
|
|
|
upstream-source: https://github.com/grafana/grafana/releases
|
2026-03-04 07:53:22 -08:00
|
|
|
notes: Home-built container from Alpine; upgraded from Helm to Kustomize
|
2026-02-16 17:02:56 -08:00
|
|
|
|
2026-03-03 13:48:24 -08:00
|
|
|
- name: grafana-sidecar
|
|
|
|
|
type: argocd
|
2026-03-24 13:27:36 -07:00
|
|
|
parent: grafana
|
2026-04-13 07:57:13 -07:00
|
|
|
last-reviewed: "2026-04-13"
|
|
|
|
|
current-version: "2.6.0"
|
2026-03-03 13:48:24 -08:00
|
|
|
upstream-source: https://github.com/kiwigrid/k8s-sidecar/releases
|
|
|
|
|
notes: Dashboard ConfigMap watcher sidecar in grafana deployment
|
|
|
|
|
|
2026-02-16 17:02:56 -08:00
|
|
|
- name: cloudnative-pg
|
|
|
|
|
type: argocd
|
Migrate Forgejo from Homebrew to source build (#316)
## Summary
- Migrate Forgejo from Homebrew to source-built binary with mcquack LaunchAgent
- Matches the established pattern used by zot, caddy, and alloy
- Upgrades to v14.0.3 (7 security fixes: PKCE bypass, OAuth scope bypass, open redirect, and more)
## Changes
- **Ansible role**: Replace brew install/services with binary stat check + LaunchAgent
- **Paths**: `/opt/homebrew/var/forgejo` → `~/forgejo`, binary at `~/code/3rd/forgejo/forgejo`
- **Run user**: `forgejo` → `erichblume` (LaunchAgent user; SSH git user stays `forgejo`)
- **Docs**: Updated Forgejo reference card, restart-indri guide
- **Service review**: Stamped frigate-notify, cloudnative-pg, blumeops-pg as current
## One-time migration steps (manual, on indri)
1. Clone from Codeberg, add forge mirror remote
2. Check out v14.0.3, build with `make build && make forgejo`
3. Stop brew, `cp -a` data to `~/forgejo`, fix ownership
4. Run `provision-indri --tags forgejo`
5. Verify, then `brew uninstall forgejo`
## Data safety
- `cp -a` preserves everything (repos, SQLite DB, LFS, sessions, OAuth config)
- Brew version stays installed as rollback until verification passes
- No schema changes between 14.0.2 → 14.0.3
Reviewed-on: https://forge.eblu.me/eblume/blumeops/pulls/316
2026-03-28 08:19:23 -07:00
|
|
|
last-reviewed: 2026-03-28
|
2026-02-24 07:26:52 -08:00
|
|
|
current-version: "v1.28.1"
|
2026-02-16 17:02:56 -08:00
|
|
|
upstream-source: https://github.com/cloudnative-pg/cloudnative-pg/releases
|
2026-02-24 07:26:52 -08:00
|
|
|
notes: Deployed via Helm chart (chart v0.27.1 from forge mirror)
|
2026-02-16 17:02:56 -08:00
|
|
|
|
|
|
|
|
- name: immich
|
|
|
|
|
type: argocd
|
2026-04-04 09:42:25 -07:00
|
|
|
last-reviewed: 2026-04-04
|
|
|
|
|
current-version: "v2.6.3"
|
2026-02-16 17:02:56 -08:00
|
|
|
upstream-source: https://github.com/immich-app/immich/releases
|
2026-04-04 09:42:25 -07:00
|
|
|
notes: Kustomize manifests with upstream images
|
2026-02-16 17:02:56 -08:00
|
|
|
|
|
|
|
|
- name: external-secrets
|
|
|
|
|
type: argocd
|
2026-03-25 15:56:41 -07:00
|
|
|
last-reviewed: 2026-03-25
|
|
|
|
|
current-version: "v2.2.0"
|
2026-02-16 17:02:56 -08:00
|
|
|
upstream-source: https://github.com/external-secrets/external-secrets/releases
|
2026-03-25 15:56:41 -07:00
|
|
|
notes: Static kustomize manifests rendered from upstream Helm chart
|
2026-02-16 17:02:56 -08:00
|
|
|
|
|
|
|
|
- name: 1password-connect
|
|
|
|
|
type: argocd
|
Migrate 1Password Connect from Helm to kustomize (1.8.1 → 1.8.2) (#326)
## Summary
- Renders manifests from `connect-helm-charts v2.4.1` as plain kustomize (deployment + service)
- Bumps 1Password Connect from 1.8.1 → 1.8.2
- Completes the no-helm-policy migration — all services now use kustomize
- Retains all production hardening from the Helm chart (securityContext, runAsNonRoot, drop ALL, seccomp, resource limits)
## Changes
- **New:** `deployment.yaml`, `service.yaml`, `kustomization.yaml` in `argocd/manifests/1password-connect/`
- **Rewritten:** Both ArgoCD app definitions (indri + ringtail) — single source kustomize instead of multi-source Helm
- **Deleted:** `values.yaml` (Helm values no longer needed)
- **Updated:** `no-helm-policy.md`, `service-versions.yaml`, `README.md`
## Deployment plan
1. Sync `apps` app to pick up the new app definitions
2. `argocd app set 1password-connect --revision 1password-connect-kustomize`
3. `argocd app sync 1password-connect` — verify on indri
4. Repeat for ringtail
5. After merge: reset revision to main, re-sync both
## Test plan
- [ ] `kubectl kustomize` renders cleanly (verified locally)
- [ ] ArgoCD diff shows expected changes (Helm labels removed, images bumped)
- [ ] Pods come up healthy on indri
- [ ] External Secrets still resolves 1Password items
- [ ] Repeat on ringtail
Reviewed-on: https://forge.eblu.me/eblume/blumeops/pulls/326
2026-04-06 07:31:40 -07:00
|
|
|
last-reviewed: 2026-04-06
|
|
|
|
|
current-version: "1.8.2"
|
2026-02-26 06:51:50 -08:00
|
|
|
upstream-source: https://hub.docker.com/r/1password/connect-api/tags
|
Migrate 1Password Connect from Helm to kustomize (1.8.1 → 1.8.2) (#326)
## Summary
- Renders manifests from `connect-helm-charts v2.4.1` as plain kustomize (deployment + service)
- Bumps 1Password Connect from 1.8.1 → 1.8.2
- Completes the no-helm-policy migration — all services now use kustomize
- Retains all production hardening from the Helm chart (securityContext, runAsNonRoot, drop ALL, seccomp, resource limits)
## Changes
- **New:** `deployment.yaml`, `service.yaml`, `kustomization.yaml` in `argocd/manifests/1password-connect/`
- **Rewritten:** Both ArgoCD app definitions (indri + ringtail) — single source kustomize instead of multi-source Helm
- **Deleted:** `values.yaml` (Helm values no longer needed)
- **Updated:** `no-helm-policy.md`, `service-versions.yaml`, `README.md`
## Deployment plan
1. Sync `apps` app to pick up the new app definitions
2. `argocd app set 1password-connect --revision 1password-connect-kustomize`
3. `argocd app sync 1password-connect` — verify on indri
4. Repeat for ringtail
5. After merge: reset revision to main, re-sync both
## Test plan
- [ ] `kubectl kustomize` renders cleanly (verified locally)
- [ ] ArgoCD diff shows expected changes (Helm labels removed, images bumped)
- [ ] Pods come up healthy on indri
- [ ] External Secrets still resolves 1Password items
- [ ] Repeat on ringtail
Reviewed-on: https://forge.eblu.me/eblume/blumeops/pulls/326
2026-04-06 07:31:40 -07:00
|
|
|
notes: Kustomize manifests rendered from connect-helm-charts v2.4.1
|
2026-02-16 17:02:56 -08:00
|
|
|
|
|
|
|
|
- name: argocd
|
|
|
|
|
type: argocd
|
2026-04-07 08:21:11 -07:00
|
|
|
last-reviewed: 2026-04-07
|
|
|
|
|
current-version: "v3.3.6"
|
2026-02-16 17:02:56 -08:00
|
|
|
upstream-source: https://github.com/argoproj/argo-cd/releases
|
2026-02-26 06:51:50 -08:00
|
|
|
notes: Kustomize-based install with ServerSideApply
|
2026-02-16 17:02:56 -08:00
|
|
|
|
|
|
|
|
- name: blumeops-pg
|
|
|
|
|
type: argocd
|
Migrate Forgejo from Homebrew to source build (#316)
## Summary
- Migrate Forgejo from Homebrew to source-built binary with mcquack LaunchAgent
- Matches the established pattern used by zot, caddy, and alloy
- Upgrades to v14.0.3 (7 security fixes: PKCE bypass, OAuth scope bypass, open redirect, and more)
## Changes
- **Ansible role**: Replace brew install/services with binary stat check + LaunchAgent
- **Paths**: `/opt/homebrew/var/forgejo` → `~/forgejo`, binary at `~/code/3rd/forgejo/forgejo`
- **Run user**: `forgejo` → `erichblume` (LaunchAgent user; SSH git user stays `forgejo`)
- **Docs**: Updated Forgejo reference card, restart-indri guide
- **Service review**: Stamped frigate-notify, cloudnative-pg, blumeops-pg as current
## One-time migration steps (manual, on indri)
1. Clone from Codeberg, add forge mirror remote
2. Check out v14.0.3, build with `make build && make forgejo`
3. Stop brew, `cp -a` data to `~/forgejo`, fix ownership
4. Run `provision-indri --tags forgejo`
5. Verify, then `brew uninstall forgejo`
## Data safety
- `cp -a` preserves everything (repos, SQLite DB, LFS, sessions, OAuth config)
- Brew version stays installed as rollback until verification passes
- No schema changes between 14.0.2 → 14.0.3
Reviewed-on: https://forge.eblu.me/eblume/blumeops/pulls/316
2026-03-28 08:19:23 -07:00
|
|
|
last-reviewed: 2026-03-28
|
2026-02-27 16:25:32 -08:00
|
|
|
current-version: "18.3"
|
2026-02-16 17:02:56 -08:00
|
|
|
upstream-source: https://github.com/cloudnative-pg/cloudnative-pg/releases
|
2026-02-27 16:25:32 -08:00
|
|
|
notes: CloudNativePG Cluster resource; pinned to PG minor version
|
2026-02-16 17:02:56 -08:00
|
|
|
|
2026-02-20 22:50:01 -08:00
|
|
|
- name: authentik
|
2026-02-22 17:12:45 -08:00
|
|
|
type: argocd
|
2026-04-08 10:53:03 -07:00
|
|
|
last-reviewed: "2026-04-08"
|
|
|
|
|
current-version: "2026.2.2"
|
2026-02-20 22:50:01 -08:00
|
|
|
upstream-source: https://github.com/goauthentik/authentik/releases
|
|
|
|
|
|
2026-03-24 13:27:36 -07:00
|
|
|
- name: authentik-redis
|
|
|
|
|
type: argocd
|
|
|
|
|
parent: authentik
|
|
|
|
|
last-reviewed: "2026-03-24"
|
|
|
|
|
current-version: "8.2.3"
|
|
|
|
|
upstream-source: https://github.com/redis/redis/releases
|
|
|
|
|
notes: >-
|
|
|
|
|
Attached service: Redis cache/broker for Authentik (sessions, Celery task
|
|
|
|
|
queue, caching). Nix-built container from nixpkgs with version assertion.
|
|
|
|
|
|
2026-03-02 20:39:51 -08:00
|
|
|
- name: ollama
|
|
|
|
|
type: argocd
|
2026-04-09 06:42:05 -07:00
|
|
|
last-reviewed: "2026-04-09"
|
|
|
|
|
current-version: "0.20.4"
|
2026-03-02 20:39:51 -08:00
|
|
|
upstream-source: https://github.com/ollama/ollama/releases
|
|
|
|
|
notes: LLM inference server on ringtail (GPU); upstream container image
|
|
|
|
|
|
2026-02-16 17:02:56 -08:00
|
|
|
- name: navidrome
|
2026-02-22 17:12:45 -08:00
|
|
|
type: argocd
|
2026-04-11 17:11:56 -07:00
|
|
|
last-reviewed: 2026-04-11
|
|
|
|
|
current-version: "v0.61.1"
|
2026-02-16 17:02:56 -08:00
|
|
|
upstream-source: https://github.com/navidrome/navidrome/releases
|
|
|
|
|
|
|
|
|
|
- name: miniflux
|
2026-02-22 17:12:45 -08:00
|
|
|
type: argocd
|
2026-04-12 08:54:32 -07:00
|
|
|
last-reviewed: 2026-04-12
|
|
|
|
|
current-version: "2.2.19"
|
2026-02-16 17:02:56 -08:00
|
|
|
upstream-source: https://github.com/miniflux/v2/releases
|
|
|
|
|
|
|
|
|
|
- name: teslamate
|
2026-02-22 17:12:45 -08:00
|
|
|
type: argocd
|
2026-04-14 07:20:52 -07:00
|
|
|
last-reviewed: 2026-04-14
|
2026-03-03 11:56:40 -08:00
|
|
|
current-version: "v3.0.0"
|
2026-02-16 17:02:56 -08:00
|
|
|
upstream-source: https://github.com/teslamate-org/teslamate/releases
|
|
|
|
|
|
|
|
|
|
- name: transmission
|
2026-02-22 17:12:45 -08:00
|
|
|
type: argocd
|
2026-04-15 11:26:00 -07:00
|
|
|
last-reviewed: 2026-04-15
|
2026-03-04 07:44:33 -08:00
|
|
|
current-version: "4.1.1-r1"
|
2026-02-16 17:02:56 -08:00
|
|
|
upstream-source: https://github.com/transmission/transmission/releases
|
|
|
|
|
|
2026-03-04 21:55:00 -08:00
|
|
|
- name: transmission-exporter
|
|
|
|
|
type: argocd
|
2026-04-15 11:26:00 -07:00
|
|
|
last-reviewed: 2026-04-15
|
2026-03-05 08:04:02 -08:00
|
|
|
current-version: "1.0.1"
|
2026-03-04 21:55:00 -08:00
|
|
|
upstream-source: null
|
|
|
|
|
notes: Homegrown Python exporter, no upstream
|
|
|
|
|
|
2026-02-16 17:02:56 -08:00
|
|
|
- name: kiwix
|
2026-02-22 17:12:45 -08:00
|
|
|
type: argocd
|
2026-04-17 13:56:32 -07:00
|
|
|
last-reviewed: 2026-04-17
|
2026-03-05 08:12:32 -08:00
|
|
|
current-version: "3.8.2"
|
2026-02-16 17:02:56 -08:00
|
|
|
upstream-source: https://github.com/kiwix/kiwix-tools/releases
|
|
|
|
|
|
|
|
|
|
- name: devpi
|
2026-04-29 13:38:36 -07:00
|
|
|
type: ansible
|
|
|
|
|
last-reviewed: 2026-04-29
|
2026-04-18 07:57:05 -07:00
|
|
|
current-version: "6.19.3"
|
2026-02-16 17:02:56 -08:00
|
|
|
upstream-source: https://github.com/devpi/devpi/releases
|
2026-04-29 13:38:36 -07:00
|
|
|
notes: Installed via uv into a venv on indri; version pinned in ansible/roles/devpi/defaults/main.yml
|
2026-02-16 17:02:56 -08:00
|
|
|
|
|
|
|
|
- name: cv
|
2026-02-22 17:12:45 -08:00
|
|
|
type: argocd
|
2026-04-27 11:57:33 -07:00
|
|
|
last-reviewed: 2026-04-27
|
2026-02-20 22:50:01 -08:00
|
|
|
current-version: "1.0.3"
|
2026-03-27 07:11:22 -07:00
|
|
|
upstream-source: https://forge.eblu.me/eblume/cv
|
|
|
|
|
notes: Personal static site; review build deps (WeasyPrint, Jinja2) in source repo
|
2026-02-16 17:02:56 -08:00
|
|
|
|
|
|
|
|
- name: docs
|
2026-02-22 17:12:45 -08:00
|
|
|
type: argocd
|
2026-03-07 09:10:16 -08:00
|
|
|
last-reviewed: 2026-03-07
|
2026-02-20 22:50:01 -08:00
|
|
|
current-version: "1.28.2"
|
2026-02-16 17:02:56 -08:00
|
|
|
upstream-source: https://github.com/jackyzha0/quartz/releases
|
2026-02-20 22:50:01 -08:00
|
|
|
notes: Quartz static site generator; container version tracks nginx base
|
2026-02-16 17:02:56 -08:00
|
|
|
|
|
|
|
|
- name: forgejo-runner
|
2026-02-22 17:12:45 -08:00
|
|
|
type: argocd
|
2026-04-20 09:15:35 -07:00
|
|
|
last-reviewed: 2026-04-20
|
2026-04-20 09:03:54 -07:00
|
|
|
current-version: "12.8.2"
|
2026-02-16 17:02:56 -08:00
|
|
|
upstream-source: https://code.forgejo.org/forgejo/runner/releases
|
2026-02-22 17:12:45 -08:00
|
|
|
notes: >-
|
2026-02-23 17:44:51 -08:00
|
|
|
Runner daemon version (code.forgejo.org/forgejo/runner). Job execution
|
|
|
|
|
image is tracked separately as runner-job-image.
|
|
|
|
|
|
|
|
|
|
- name: runner-job-image
|
|
|
|
|
type: argocd
|
2026-04-21 08:12:33 -07:00
|
|
|
last-reviewed: 2026-04-21
|
|
|
|
|
current-version: "0.20.6"
|
2026-02-23 17:44:51 -08:00
|
|
|
upstream-source: https://github.com/dagger/dagger/releases
|
|
|
|
|
notes: >-
|
|
|
|
|
Forgejo Actions job execution image. CONTAINER_APP_VERSION tracks the
|
|
|
|
|
Dagger CLI version, the primary build tool in the image.
|
2026-02-16 17:02:56 -08:00
|
|
|
|
2026-02-22 17:12:45 -08:00
|
|
|
- name: nix-container-builder
|
|
|
|
|
type: nixos
|
2026-04-01 21:37:57 -07:00
|
|
|
last-reviewed: 2026-04-01
|
|
|
|
|
current-version: "12.7.2"
|
2026-02-22 17:12:45 -08:00
|
|
|
upstream-source: https://code.forgejo.org/forgejo/runner/releases
|
2026-04-01 21:37:57 -07:00
|
|
|
notes: >-
|
|
|
|
|
Forgejo runner on ringtail; pinned via nixpkgs-services overlay in flake.nix.
|
|
|
|
|
Update nixpkgs-services rev during service reviews, not via nix flake update.
|
2026-02-16 17:02:56 -08:00
|
|
|
|
2026-03-24 20:51:40 -07:00
|
|
|
- name: snowflake-proxy
|
|
|
|
|
type: nixos
|
2026-04-01 21:37:57 -07:00
|
|
|
last-reviewed: 2026-04-01
|
2026-03-24 20:51:40 -07:00
|
|
|
current-version: "2.11.0"
|
|
|
|
|
upstream-source: https://gitlab.torproject.org/tpo/anti-censorship/pluggable-transports/snowflake/-/releases
|
2026-04-01 21:37:57 -07:00
|
|
|
notes: >-
|
|
|
|
|
Tor Snowflake proxy on ringtail; pinned via nixpkgs-services overlay in flake.nix.
|
|
|
|
|
Anti-censorship bridge, not an exit node.
|
|
|
|
|
|
|
|
|
|
- name: k3s
|
|
|
|
|
type: nixos
|
|
|
|
|
last-reviewed: 2026-04-01
|
|
|
|
|
current-version: "1.34.5+k3s1"
|
|
|
|
|
upstream-source: https://github.com/k3s-io/k3s/releases
|
|
|
|
|
notes: >-
|
|
|
|
|
Single-node k3s cluster on ringtail; pinned via nixpkgs-services overlay in flake.nix.
|
|
|
|
|
Update nixpkgs-services rev during service reviews.
|
|
|
|
|
|
|
|
|
|
- name: minikube
|
|
|
|
|
type: ansible
|
|
|
|
|
last-reviewed: 2026-04-01
|
|
|
|
|
current-version: "1.38.0"
|
|
|
|
|
upstream-source: https://github.com/kubernetes/minikube/releases
|
|
|
|
|
notes: >-
|
|
|
|
|
Single-node minikube on indri; installed via homebrew (not version-pinned).
|
|
|
|
|
Homebrew may silently upgrade on brew update/upgrade.
|
2026-03-24 20:51:40 -07:00
|
|
|
|
2026-03-16 21:59:10 -07:00
|
|
|
- name: mealie
|
|
|
|
|
type: argocd
|
|
|
|
|
last-reviewed: 2026-03-16
|
|
|
|
|
current-version: "v3.12.0"
|
|
|
|
|
upstream-source: https://github.com/mealie-recipes/mealie/releases
|
|
|
|
|
notes: Recipe manager; built from source via forge mirror
|
|
|
|
|
|
2026-04-08 17:54:12 -07:00
|
|
|
- name: paperless
|
|
|
|
|
type: argocd
|
|
|
|
|
last-reviewed: "2026-04-08"
|
|
|
|
|
current-version: "v2.20.13"
|
|
|
|
|
upstream-source: https://github.com/paperless-ngx/paperless-ngx/releases
|
|
|
|
|
notes: Document management; built from source via forge mirror
|
|
|
|
|
|
2026-03-16 15:52:45 -07:00
|
|
|
- name: unpoller
|
|
|
|
|
type: argocd
|
|
|
|
|
last-reviewed: 2026-03-16
|
|
|
|
|
current-version: "v2.34.0"
|
|
|
|
|
upstream-source: https://github.com/unpoller/unpoller/releases
|
|
|
|
|
notes: UniFi metrics exporter for Prometheus
|
|
|
|
|
|
2026-03-24 16:08:09 -07:00
|
|
|
- name: prowler
|
|
|
|
|
type: argocd
|
2026-04-14 13:45:28 -07:00
|
|
|
last-reviewed: 2026-04-14
|
|
|
|
|
current-version: "5.23.0"
|
2026-03-24 16:08:09 -07:00
|
|
|
upstream-source: https://github.com/prowler-cloud/prowler/releases
|
|
|
|
|
notes: CIS Kubernetes Benchmark scanner; weekly CronJob on minikube-indri
|
|
|
|
|
|
2026-03-30 06:34:49 -07:00
|
|
|
- name: kingfisher
|
|
|
|
|
type: argocd
|
|
|
|
|
last-reviewed: 2026-03-29
|
|
|
|
|
current-version: "165768b"
|
|
|
|
|
upstream-source: https://github.com/mongodb/kingfisher/releases
|
|
|
|
|
notes: Secret scanner; sporked from upstream with --clone-url-base patch. Version is upstream main SHA.
|
|
|
|
|
|
2026-02-16 17:02:56 -08:00
|
|
|
- name: forgejo
|
|
|
|
|
type: ansible
|
Migrate Forgejo from Homebrew to source build (#316)
## Summary
- Migrate Forgejo from Homebrew to source-built binary with mcquack LaunchAgent
- Matches the established pattern used by zot, caddy, and alloy
- Upgrades to v14.0.3 (7 security fixes: PKCE bypass, OAuth scope bypass, open redirect, and more)
## Changes
- **Ansible role**: Replace brew install/services with binary stat check + LaunchAgent
- **Paths**: `/opt/homebrew/var/forgejo` → `~/forgejo`, binary at `~/code/3rd/forgejo/forgejo`
- **Run user**: `forgejo` → `erichblume` (LaunchAgent user; SSH git user stays `forgejo`)
- **Docs**: Updated Forgejo reference card, restart-indri guide
- **Service review**: Stamped frigate-notify, cloudnative-pg, blumeops-pg as current
## One-time migration steps (manual, on indri)
1. Clone from Codeberg, add forge mirror remote
2. Check out v14.0.3, build with `make build && make forgejo`
3. Stop brew, `cp -a` data to `~/forgejo`, fix ownership
4. Run `provision-indri --tags forgejo`
5. Verify, then `brew uninstall forgejo`
## Data safety
- `cp -a` preserves everything (repos, SQLite DB, LFS, sessions, OAuth config)
- Brew version stays installed as rollback until verification passes
- No schema changes between 14.0.2 → 14.0.3
Reviewed-on: https://forge.eblu.me/eblume/blumeops/pulls/316
2026-03-28 08:19:23 -07:00
|
|
|
last-reviewed: 2026-03-28
|
|
|
|
|
current-version: "14.0.3"
|
2026-02-16 17:02:56 -08:00
|
|
|
upstream-source: https://codeberg.org/forgejo/forgejo/releases
|
Migrate Forgejo from Homebrew to source build (#316)
## Summary
- Migrate Forgejo from Homebrew to source-built binary with mcquack LaunchAgent
- Matches the established pattern used by zot, caddy, and alloy
- Upgrades to v14.0.3 (7 security fixes: PKCE bypass, OAuth scope bypass, open redirect, and more)
## Changes
- **Ansible role**: Replace brew install/services with binary stat check + LaunchAgent
- **Paths**: `/opt/homebrew/var/forgejo` → `~/forgejo`, binary at `~/code/3rd/forgejo/forgejo`
- **Run user**: `forgejo` → `erichblume` (LaunchAgent user; SSH git user stays `forgejo`)
- **Docs**: Updated Forgejo reference card, restart-indri guide
- **Service review**: Stamped frigate-notify, cloudnative-pg, blumeops-pg as current
## One-time migration steps (manual, on indri)
1. Clone from Codeberg, add forge mirror remote
2. Check out v14.0.3, build with `make build && make forgejo`
3. Stop brew, `cp -a` data to `~/forgejo`, fix ownership
4. Run `provision-indri --tags forgejo`
5. Verify, then `brew uninstall forgejo`
## Data safety
- `cp -a` preserves everything (repos, SQLite DB, LFS, sessions, OAuth config)
- Brew version stays installed as rollback until verification passes
- No schema changes between 14.0.2 → 14.0.3
Reviewed-on: https://forge.eblu.me/eblume/blumeops/pulls/316
2026-03-28 08:19:23 -07:00
|
|
|
notes: Built from source on indri (~/code/3rd/forgejo)
|
2026-02-16 17:02:56 -08:00
|
|
|
|
|
|
|
|
- name: alloy
|
|
|
|
|
type: ansible
|
2026-03-13 16:25:27 -07:00
|
|
|
last-reviewed: 2026-03-13
|
|
|
|
|
current-version: "v1.14.0"
|
2026-02-16 17:02:56 -08:00
|
|
|
upstream-source: https://github.com/grafana/alloy/releases
|
|
|
|
|
notes: Built from source on indri
|
|
|
|
|
|
|
|
|
|
- name: zot
|
|
|
|
|
type: ansible
|
2026-03-14 10:00:40 -07:00
|
|
|
last-reviewed: 2026-03-14
|
|
|
|
|
current-version: "v2.1.15"
|
2026-02-16 17:02:56 -08:00
|
|
|
upstream-source: https://github.com/project-zot/zot/releases
|
|
|
|
|
notes: Built from source on indri
|
|
|
|
|
|
|
|
|
|
- name: caddy
|
|
|
|
|
type: ansible
|
2026-03-15 10:33:48 -07:00
|
|
|
last-reviewed: 2026-03-15
|
|
|
|
|
current-version: "v2.11.2"
|
2026-02-16 17:02:56 -08:00
|
|
|
upstream-source: https://github.com/caddyserver/caddy/releases
|
2026-03-15 10:33:48 -07:00
|
|
|
notes: Built from source with Gandi DNS and Layer 4 plugins
|
2026-02-16 17:02:56 -08:00
|
|
|
|
|
|
|
|
- name: borgmatic
|
|
|
|
|
type: ansible
|
2026-04-15 07:23:46 -07:00
|
|
|
last-reviewed: 2026-04-15
|
|
|
|
|
current-version: "2.1.4"
|
2026-02-16 17:02:56 -08:00
|
|
|
upstream-source: https://github.com/borgmatic-collective/borgmatic/releases
|
2026-04-15 07:23:46 -07:00
|
|
|
notes: Installed via mise (pipx); version pinned in ansible/roles/borgmatic/defaults/main.yml and mise.toml
|
2026-02-16 17:02:56 -08:00
|
|
|
|
|
|
|
|
- name: jellyfin
|
|
|
|
|
type: ansible
|
2026-03-17 13:06:23 -07:00
|
|
|
last-reviewed: 2026-03-17
|
|
|
|
|
current-version: "10.11.6"
|
2026-02-16 17:02:56 -08:00
|
|
|
upstream-source: https://github.com/jellyfin/jellyfin/releases
|
|
|
|
|
|
|
|
|
|
- name: automounter
|
|
|
|
|
type: ansible
|
2026-03-17 13:06:23 -07:00
|
|
|
last-reviewed: 2026-03-17
|
|
|
|
|
current-version: "1.11.0"
|
|
|
|
|
upstream-source: https://www.pixeleyes.co.nz/automounter/
|
|
|
|
|
notes: Mac App Store app, no Ansible role. Updates via App Store.
|
2026-04-10 19:40:57 -07:00
|
|
|
|
|
|
|
|
- name: flyio-tailscale
|
|
|
|
|
type: fly
|
|
|
|
|
last-reviewed: "2026-04-10"
|
|
|
|
|
current-version: "v1.94.1"
|
|
|
|
|
upstream-source: https://github.com/tailscale/tailscale/releases
|
|
|
|
|
notes: >-
|
|
|
|
|
Pinned after v1.96.5 broke MagicDNS in containers. Test DNS resolution
|
|
|
|
|
inside Fly container before upgrading. COPY --from in fly/Dockerfile.
|
|
|
|
|
|
|
|
|
|
- name: flyio-nginx
|
|
|
|
|
type: fly
|
|
|
|
|
last-reviewed: "2026-04-10"
|
|
|
|
|
current-version: "1.29.6-alpine"
|
|
|
|
|
upstream-source: https://hub.docker.com/_/nginx
|
|
|
|
|
notes: Base image for Fly proxy (fly/Dockerfile)
|
|
|
|
|
|
|
|
|
|
- name: flyio-alloy
|
|
|
|
|
type: fly
|
|
|
|
|
parent: flyio-nginx
|
|
|
|
|
last-reviewed: "2026-04-10"
|
|
|
|
|
current-version: "v1.14.1"
|
|
|
|
|
upstream-source: https://github.com/grafana/alloy/releases
|
|
|
|
|
notes: COPY --from in fly/Dockerfile for log shipping and metrics
|
2026-04-12 08:54:32 -07:00
|
|
|
|
|
|
|
|
- name: dagger
|
|
|
|
|
type: mise
|
2026-04-21 08:12:33 -07:00
|
|
|
last-reviewed: 2026-04-21
|
|
|
|
|
current-version: "0.20.6"
|
2026-04-12 08:54:32 -07:00
|
|
|
upstream-source: https://github.com/dagger/dagger/releases
|
|
|
|
|
notes: Dagger CI/CD engine; pinned in mise.toml
|
|
|
|
|
|
|
|
|
|
- name: ansible-core
|
|
|
|
|
type: mise
|
|
|
|
|
last-reviewed: 2026-04-12
|
|
|
|
|
current-version: "2.20.1"
|
|
|
|
|
upstream-source: https://github.com/ansible/ansible/releases
|
|
|
|
|
notes: Installed via pipx/uvx with botocore and boto3
|
|
|
|
|
|
|
|
|
|
- name: prek
|
|
|
|
|
type: mise
|
|
|
|
|
last-reviewed: 2026-04-12
|
|
|
|
|
current-version: "0.3.4"
|
|
|
|
|
upstream-source: https://github.com/j178/prek/releases
|
|
|
|
|
notes: Pre-commit hook runner (Rust reimplementation)
|
|
|
|
|
|
|
|
|
|
- name: pulumi-cli
|
|
|
|
|
type: mise
|
|
|
|
|
last-reviewed: 2026-04-12
|
|
|
|
|
current-version: "3.215.0"
|
|
|
|
|
upstream-source: https://github.com/pulumi/pulumi/releases
|
|
|
|
|
notes: IaC CLI for tailscale and gandi stacks
|
|
|
|
|
|
|
|
|
|
- name: ty
|
|
|
|
|
type: mise
|
|
|
|
|
last-reviewed: 2026-04-12
|
|
|
|
|
current-version: "0.0.29"
|
|
|
|
|
upstream-source: https://github.com/astral-sh/ty/releases
|
|
|
|
|
notes: Astral Python typechecker (beta); prek hook
|