2026-04-13 08:40:49 -07:00
|
|
|
# Service / Tooling/ Application Version Tracking
|
2026-02-16 17:02:56 -08:00
|
|
|
#
|
|
|
|
|
# Tracks when each BlumeOps service was last reviewed for version freshness.
|
|
|
|
|
# Used by `mise run service-review` to surface stale services.
|
|
|
|
|
#
|
|
|
|
|
# Fields:
|
|
|
|
|
# name - kebab-case service identifier
|
2026-04-12 08:54:32 -07:00
|
|
|
# type - argocd | ansible | nixos | fly | mise
|
2026-02-16 17:02:56 -08:00
|
|
|
# last-reviewed - date (YYYY-MM-DD) or null
|
|
|
|
|
# current-version - deployed version string or null
|
|
|
|
|
# upstream-source - URL to upstream releases/changelog
|
|
|
|
|
# notes - optional context
|
|
|
|
|
|
|
|
|
|
services:
|
|
|
|
|
- name: prometheus
|
|
|
|
|
type: argocd
|
2026-03-18 08:46:07 -07:00
|
|
|
last-reviewed: 2026-03-18
|
|
|
|
|
current-version: "v3.10.0"
|
2026-02-16 17:02:56 -08:00
|
|
|
upstream-source: https://github.com/prometheus/prometheus/releases
|
|
|
|
|
|
|
|
|
|
- name: loki
|
|
|
|
|
type: argocd
|
2026-03-20 16:10:19 -07:00
|
|
|
last-reviewed: 2026-03-20
|
|
|
|
|
current-version: "3.6.7"
|
2026-02-16 17:02:56 -08:00
|
|
|
upstream-source: https://github.com/grafana/loki/releases
|
|
|
|
|
|
|
|
|
|
- name: kube-state-metrics
|
|
|
|
|
type: argocd
|
2026-03-22 19:31:22 -07:00
|
|
|
last-reviewed: 2026-03-22
|
2026-02-16 17:14:38 -08:00
|
|
|
current-version: "v2.18.0"
|
2026-02-16 17:02:56 -08:00
|
|
|
upstream-source: https://github.com/kubernetes/kube-state-metrics/releases
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
- name: ntfy
|
|
|
|
|
type: argocd
|
2026-03-23 10:32:06 -07:00
|
|
|
last-reviewed: 2026-03-23
|
|
|
|
|
current-version: "v2.19.2"
|
2026-02-16 17:02:56 -08:00
|
|
|
upstream-source: https://github.com/binwiederhier/ntfy/releases
|
|
|
|
|
|
|
|
|
|
- name: homepage
|
2026-02-22 17:12:45 -08:00
|
|
|
type: argocd
|
2026-03-26 10:17:36 -07:00
|
|
|
last-reviewed: 2026-03-26
|
|
|
|
|
current-version: "v1.11.0"
|
2026-02-16 17:02:56 -08:00
|
|
|
upstream-source: https://github.com/gethomepage/homepage/releases
|
Replace Homepage Helm chart with kustomize manifests and custom Dockerfile (#221)
## Summary
- Replace third-party Helm chart (jameswynn/homepage v2.1.0, pinned at app v1.2.0) with plain kustomize manifests and a custom Dockerfile building from forge mirror at v1.10.1
- Adds Dockerfile (`containers/homepage/`) with multi-stage build (node:22-slim builder, node:22-alpine runtime)
- Creates kustomize manifests: Deployment, Service, ConfigMap (6 config files), ServiceAccount, ClusterRole, ClusterRoleBinding
- Keeps existing ingress-tailscale.yaml and all 6 ExternalSecret resources unchanged
- Updates ArgoCD app definition from multi-source Helm to single directory source
## Prerequisite
- Homepage source mirrored at forge.ops.eblu.me/eblume/homepage.git ✅
- Container must be built and pushed before syncing: `mise run container-release homepage v1.10.1`
## Deployment and Testing
- [ ] Build and push container image: `mise run container-release homepage v1.10.1`
- [ ] Branch-test via ArgoCD: `argocd app set homepage --revision feature/homepage-kustomize && argocd app sync homepage`
- [ ] Verify dashboard loads at go.ops.eblu.me / go.tail8d86e.ts.net
- [ ] Verify k8s autodiscovery works (services appear on dashboard)
- [ ] Verify widgets load (weather, Forgejo, Jellyfin, etc.)
- [ ] After merge: `argocd app set homepage --revision main && argocd app sync homepage`
🤖 Generated with [Claude Code](https://claude.com/claude-code)
Reviewed-on: https://forge.ops.eblu.me/eblume/blumeops/pulls/221
2026-02-19 18:29:19 -08:00
|
|
|
notes: Custom container, kustomize manifests
|
2026-02-16 17:02:56 -08:00
|
|
|
|
C1: deploy adelaide-baby-shower-app to ringtail k3s (#349)
## Summary
Brings up the Adelaide / Heidi / Addie baby shower app on ringtail k3s with the public/private split that the app's hosting contract calls for: `shower.eblu.me` (public, via Fly proxy) and `shower.ops.eblu.me` (tailnet). App is consumed as a wheel from the Forgejo PyPI index — source lives at [`adelaide-baby-shower-app`](https://forge.eblu.me/eblume/adelaide-baby-shower-app).
### What's included
- **ArgoCD app + manifests** under `argocd/manifests/shower/` (deployment, service, ProxyGroup ingress, ConfigMap for `DJANGO_DEBUG`/`DJANGO_ADMIN_URL`, ExternalSecret for `DJANGO_SECRET_KEY` from 1Password item `Shower (blumeops)`, NFS PV on sifaka, RWX media PVC, RWO local-path data PVC for SQLite). Recreate rollout because SQLite is single-writer.
- **Public surface** (`fly/`): new `shower.eblu.me` server block proxying to `shower.ops.eblu.me`. `/admin/` returns 403 at the edge except `/admin/login/` and `/admin/logout/`, which are rate-limited via a new `shower_auth` zone. `X-Clacks-Overhead` on. GNU Terry Pratchett.
- **fail2ban** filter (`shower-admin-login.conf`) matching 401/403/429 on `/admin/login/` and jail (`shower.conf`) with `maxretry=5/findtime=600/bantime=3600`. The `nginx-deny` action was generalized to take a per-jail `nginx_deny_file` so the shower has its own deny list (forge keeps using the legacy default).
- **Caddy** route on indri (`shower.ops.eblu.me` → `https://shower.tail8d86e.ts.net`).
- **Pulumi** Gandi CNAME `shower.eblu.me → blumeops-proxy.fly.dev.`.
- **Grafana** APM dashboard `configmap-shower-apm.yaml` (request rate, error rate, failed admin login count, latency percentiles, bandwidth, access logs) mirroring `docs-apm.json` with a `host="shower.eblu.me"` filter.
- **Container** `containers/shower/default.nix` — `dockerTools.buildLayeredImage` with a nixpkgs Python and a startup wrapper that creates `/app/data/.venv`, pip-installs `adelaide-baby-shower-app==1.0.0` from the forge PyPI index on first boot, runs migrations + collectstatic, and execs gunicorn. A `local_settings.py` shim pins `DATABASES.NAME`/`MEDIA_ROOT`/`STATIC_ROOT` to absolute paths so they don't end up in site-packages.
- **Docs** runbook at `docs/how-to/operations/shower-app.md` linked from the apps registry, plus changelog fragments.
### Defense layers on the public surface
1. fly nginx geo+fail2ban `$shower_banned` (per-service deny list)
2. fly nginx `limit_req zone=shower_auth` (3 r/s per Fly-Client-IP)
3. django-axes (5 fails / 1h, keyed on username+ip_address)
4. edge `/admin/` block (returns 403 for anything that isn't login/logout)
## Prerequisites for the user to do (NOT in this PR)
Halted on these per request — they touch shared/manual systems:
- [x] **NFS share** on sifaka: `/volume1/shower`, NFS rule for ringtail RW, `chown 1000:1000`
- [ ] **1Password item** `Shower (blumeops)` in the blumeops vault with a freshly minted `secret-key` field (`openssl rand -base64 48`) — do NOT reuse anything that has lived in git
- [ ] **Container build**: `mise run container-build-and-release shower`, then update `images[].newTag` in `argocd/manifests/shower/kustomization.yaml` to the resulting `v1.0.0-<sha>-nix`
- [x] **DNS**: `mise run dns-up` after merge
- [x] **Fly cert**: `fly certs add shower.eblu.me -a blumeops-proxy`
- [ ] **Caddy push**: `mise run provision-indri -- --tags caddy`
- [ ] **Fly redeploy** to pick up the new nginx block + fail2ban jail: `mise run fly-deploy`
- [ ] **ArgoCD sync**: `argocd app set shower --revision shower-app-deploy && argocd app sync shower` to test from this branch before merging
## Test plan
- [ ] Container builds successfully on nix-container-builder runner
- [ ] Pod starts, migrations run, gunicorn answers on :8000
- [ ] `kubectl --context=k3s-ringtail -n shower logs deploy/shower` clean
- [ ] `curl -sf https://shower.ops.eblu.me/` returns the splash page (tailnet)
- [ ] `curl -I -H "Host: shower.eblu.me" https://blumeops-proxy.fly.dev/` returns 200 (pre-DNS verification)
- [ ] `curl -I -H "Host: shower.eblu.me" https://blumeops-proxy.fly.dev/admin/users/` returns 403 (edge block)
- [ ] `curl -I -H "Host: shower.eblu.me" https://blumeops-proxy.fly.dev/admin/login/` returns a Django login response
- [ ] After DNS is up: `curl -I https://shower.eblu.me/` returns 200 with `X-Clacks-Overhead`
- [ ] Grafana dashboard "Shower APM" appears and starts showing traffic
- [ ] `mise run services-check` passes
Reviewed-on: https://forge.eblu.me/eblume/blumeops/pulls/349
2026-05-11 13:47:18 -07:00
|
|
|
- name: shower
|
|
|
|
|
type: argocd
|
|
|
|
|
last-reviewed: 2026-05-10
|
|
|
|
|
current-version: "1.0.2"
|
|
|
|
|
upstream-source: https://forge.eblu.me/eblume/adelaide-baby-shower-app
|
|
|
|
|
notes: |
|
|
|
|
|
Django app for Adelaide / Heidi / Addie's baby shower. Wheel
|
|
|
|
|
published to Forgejo Packages PyPI; runs on ringtail k3s. Public
|
|
|
|
|
at shower.eblu.me (fly proxy), tailnet admin at shower.ops.eblu.me.
|
|
|
|
|
|
2026-02-19 14:27:04 -08:00
|
|
|
- name: nvidia-device-plugin
|
|
|
|
|
type: argocd
|
2026-03-27 07:19:24 -07:00
|
|
|
last-reviewed: 2026-03-27
|
|
|
|
|
current-version: "v0.19.0"
|
2026-02-19 14:27:04 -08:00
|
|
|
upstream-source: https://github.com/NVIDIA/k8s-device-plugin/releases
|
|
|
|
|
notes: DaemonSet + RuntimeClass on ringtail for GPU workloads
|
|
|
|
|
|
2026-02-16 17:02:56 -08:00
|
|
|
- name: frigate
|
|
|
|
|
type: argocd
|
2026-03-24 07:30:18 -07:00
|
|
|
last-reviewed: 2026-03-24
|
|
|
|
|
current-version: "0.17.1"
|
2026-02-16 17:02:56 -08:00
|
|
|
upstream-source: https://github.com/blakeblackshear/frigate/releases
|
|
|
|
|
|
|
|
|
|
- name: frigate-notify
|
|
|
|
|
type: argocd
|
Migrate Forgejo from Homebrew to source build (#316)
## Summary
- Migrate Forgejo from Homebrew to source-built binary with mcquack LaunchAgent
- Matches the established pattern used by zot, caddy, and alloy
- Upgrades to v14.0.3 (7 security fixes: PKCE bypass, OAuth scope bypass, open redirect, and more)
## Changes
- **Ansible role**: Replace brew install/services with binary stat check + LaunchAgent
- **Paths**: `/opt/homebrew/var/forgejo` → `~/forgejo`, binary at `~/code/3rd/forgejo/forgejo`
- **Run user**: `forgejo` → `erichblume` (LaunchAgent user; SSH git user stays `forgejo`)
- **Docs**: Updated Forgejo reference card, restart-indri guide
- **Service review**: Stamped frigate-notify, cloudnative-pg, blumeops-pg as current
## One-time migration steps (manual, on indri)
1. Clone from Codeberg, add forge mirror remote
2. Check out v14.0.3, build with `make build && make forgejo`
3. Stop brew, `cp -a` data to `~/forgejo`, fix ownership
4. Run `provision-indri --tags forgejo`
5. Verify, then `brew uninstall forgejo`
## Data safety
- `cp -a` preserves everything (repos, SQLite DB, LFS, sessions, OAuth config)
- Brew version stays installed as rollback until verification passes
- No schema changes between 14.0.2 → 14.0.3
Reviewed-on: https://forge.eblu.me/eblume/blumeops/pulls/316
2026-03-28 08:19:23 -07:00
|
|
|
last-reviewed: 2026-03-28
|
2026-02-22 08:42:47 -08:00
|
|
|
current-version: "v0.5.4"
|
2026-02-16 17:02:56 -08:00
|
|
|
upstream-source: https://github.com/0x2142/frigate-notify/releases
|
|
|
|
|
|
2026-03-05 10:51:07 -08:00
|
|
|
- name: tempo
|
|
|
|
|
type: argocd
|
2026-04-02 13:45:02 -07:00
|
|
|
last-reviewed: 2026-04-02
|
|
|
|
|
current-version: "2.10.3"
|
2026-03-05 10:51:07 -08:00
|
|
|
upstream-source: https://github.com/grafana/tempo/releases
|
2026-04-02 13:45:02 -07:00
|
|
|
notes: Home-built container from forge mirror
|
2026-03-05 10:51:07 -08:00
|
|
|
|
|
|
|
|
- name: alloy-tracing-ringtail
|
|
|
|
|
type: argocd
|
2026-05-01 08:05:37 -07:00
|
|
|
last-reviewed: 2026-04-30
|
|
|
|
|
current-version: "v1.16.0"
|
2026-03-05 10:51:07 -08:00
|
|
|
upstream-source: https://github.com/grafana/alloy/releases
|
|
|
|
|
notes: Privileged DaemonSet with Beyla eBPF for HTTP tracing on ringtail
|
|
|
|
|
|
2026-03-13 16:25:27 -07:00
|
|
|
- name: alloy-ringtail
|
|
|
|
|
type: argocd
|
2026-05-01 08:05:37 -07:00
|
|
|
last-reviewed: 2026-04-30
|
|
|
|
|
current-version: "v1.16.0"
|
2026-03-13 16:25:27 -07:00
|
|
|
upstream-source: https://github.com/grafana/alloy/releases
|
|
|
|
|
notes: DaemonSet on ringtail for host metrics and pod logs
|
|
|
|
|
|
2026-02-16 17:02:56 -08:00
|
|
|
- name: alloy-k8s
|
|
|
|
|
type: argocd
|
2026-05-01 08:05:37 -07:00
|
|
|
last-reviewed: 2026-04-30
|
|
|
|
|
current-version: "v1.16.0"
|
2026-02-16 17:02:56 -08:00
|
|
|
upstream-source: https://github.com/grafana/alloy/releases
|
|
|
|
|
|
|
|
|
|
- name: tailscale-operator
|
|
|
|
|
type: argocd
|
2026-03-22 19:31:22 -07:00
|
|
|
last-reviewed: 2026-03-22
|
2026-03-22 19:41:40 -07:00
|
|
|
current-version: "v1.94.2"
|
2026-02-16 17:02:56 -08:00
|
|
|
upstream-source: https://github.com/tailscale/tailscale/releases
|
|
|
|
|
|
C1: deploy adelaide-baby-shower-app to ringtail k3s (#349)
## Summary
Brings up the Adelaide / Heidi / Addie baby shower app on ringtail k3s with the public/private split that the app's hosting contract calls for: `shower.eblu.me` (public, via Fly proxy) and `shower.ops.eblu.me` (tailnet). App is consumed as a wheel from the Forgejo PyPI index — source lives at [`adelaide-baby-shower-app`](https://forge.eblu.me/eblume/adelaide-baby-shower-app).
### What's included
- **ArgoCD app + manifests** under `argocd/manifests/shower/` (deployment, service, ProxyGroup ingress, ConfigMap for `DJANGO_DEBUG`/`DJANGO_ADMIN_URL`, ExternalSecret for `DJANGO_SECRET_KEY` from 1Password item `Shower (blumeops)`, NFS PV on sifaka, RWX media PVC, RWO local-path data PVC for SQLite). Recreate rollout because SQLite is single-writer.
- **Public surface** (`fly/`): new `shower.eblu.me` server block proxying to `shower.ops.eblu.me`. `/admin/` returns 403 at the edge except `/admin/login/` and `/admin/logout/`, which are rate-limited via a new `shower_auth` zone. `X-Clacks-Overhead` on. GNU Terry Pratchett.
- **fail2ban** filter (`shower-admin-login.conf`) matching 401/403/429 on `/admin/login/` and jail (`shower.conf`) with `maxretry=5/findtime=600/bantime=3600`. The `nginx-deny` action was generalized to take a per-jail `nginx_deny_file` so the shower has its own deny list (forge keeps using the legacy default).
- **Caddy** route on indri (`shower.ops.eblu.me` → `https://shower.tail8d86e.ts.net`).
- **Pulumi** Gandi CNAME `shower.eblu.me → blumeops-proxy.fly.dev.`.
- **Grafana** APM dashboard `configmap-shower-apm.yaml` (request rate, error rate, failed admin login count, latency percentiles, bandwidth, access logs) mirroring `docs-apm.json` with a `host="shower.eblu.me"` filter.
- **Container** `containers/shower/default.nix` — `dockerTools.buildLayeredImage` with a nixpkgs Python and a startup wrapper that creates `/app/data/.venv`, pip-installs `adelaide-baby-shower-app==1.0.0` from the forge PyPI index on first boot, runs migrations + collectstatic, and execs gunicorn. A `local_settings.py` shim pins `DATABASES.NAME`/`MEDIA_ROOT`/`STATIC_ROOT` to absolute paths so they don't end up in site-packages.
- **Docs** runbook at `docs/how-to/operations/shower-app.md` linked from the apps registry, plus changelog fragments.
### Defense layers on the public surface
1. fly nginx geo+fail2ban `$shower_banned` (per-service deny list)
2. fly nginx `limit_req zone=shower_auth` (3 r/s per Fly-Client-IP)
3. django-axes (5 fails / 1h, keyed on username+ip_address)
4. edge `/admin/` block (returns 403 for anything that isn't login/logout)
## Prerequisites for the user to do (NOT in this PR)
Halted on these per request — they touch shared/manual systems:
- [x] **NFS share** on sifaka: `/volume1/shower`, NFS rule for ringtail RW, `chown 1000:1000`
- [ ] **1Password item** `Shower (blumeops)` in the blumeops vault with a freshly minted `secret-key` field (`openssl rand -base64 48`) — do NOT reuse anything that has lived in git
- [ ] **Container build**: `mise run container-build-and-release shower`, then update `images[].newTag` in `argocd/manifests/shower/kustomization.yaml` to the resulting `v1.0.0-<sha>-nix`
- [x] **DNS**: `mise run dns-up` after merge
- [x] **Fly cert**: `fly certs add shower.eblu.me -a blumeops-proxy`
- [ ] **Caddy push**: `mise run provision-indri -- --tags caddy`
- [ ] **Fly redeploy** to pick up the new nginx block + fail2ban jail: `mise run fly-deploy`
- [ ] **ArgoCD sync**: `argocd app set shower --revision shower-app-deploy && argocd app sync shower` to test from this branch before merging
## Test plan
- [ ] Container builds successfully on nix-container-builder runner
- [ ] Pod starts, migrations run, gunicorn answers on :8000
- [ ] `kubectl --context=k3s-ringtail -n shower logs deploy/shower` clean
- [ ] `curl -sf https://shower.ops.eblu.me/` returns the splash page (tailnet)
- [ ] `curl -I -H "Host: shower.eblu.me" https://blumeops-proxy.fly.dev/` returns 200 (pre-DNS verification)
- [ ] `curl -I -H "Host: shower.eblu.me" https://blumeops-proxy.fly.dev/admin/users/` returns 403 (edge block)
- [ ] `curl -I -H "Host: shower.eblu.me" https://blumeops-proxy.fly.dev/admin/login/` returns a Django login response
- [ ] After DNS is up: `curl -I https://shower.eblu.me/` returns 200 with `X-Clacks-Overhead`
- [ ] Grafana dashboard "Shower APM" appears and starts showing traffic
- [ ] `mise run services-check` passes
Reviewed-on: https://forge.eblu.me/eblume/blumeops/pulls/349
2026-05-11 13:47:18 -07:00
|
|
|
- name: tailscale
|
|
|
|
|
type: container
|
|
|
|
|
last-reviewed: 2026-05-10
|
|
|
|
|
current-version: "1.94.2"
|
|
|
|
|
upstream-source: https://github.com/tailscale/tailscale/releases
|
|
|
|
|
notes: |
|
|
|
|
|
Locally mirrored tailscale image used by ringtail's tailscale-operator
|
|
|
|
|
ProxyClass. Built via containers/tailscale/default.nix.
|
|
|
|
|
|
2026-02-16 17:02:56 -08:00
|
|
|
- name: grafana
|
|
|
|
|
type: argocd
|
2026-04-02 11:33:19 -07:00
|
|
|
last-reviewed: 2026-04-02
|
|
|
|
|
current-version: "12.4.2"
|
2026-02-16 17:02:56 -08:00
|
|
|
upstream-source: https://github.com/grafana/grafana/releases
|
2026-03-04 07:53:22 -08:00
|
|
|
notes: Home-built container from Alpine; upgraded from Helm to Kustomize
|
2026-02-16 17:02:56 -08:00
|
|
|
|
2026-03-03 13:48:24 -08:00
|
|
|
- name: grafana-sidecar
|
|
|
|
|
type: argocd
|
2026-03-24 13:27:36 -07:00
|
|
|
parent: grafana
|
2026-04-13 07:57:13 -07:00
|
|
|
last-reviewed: "2026-04-13"
|
|
|
|
|
current-version: "2.6.0"
|
2026-03-03 13:48:24 -08:00
|
|
|
upstream-source: https://github.com/kiwigrid/k8s-sidecar/releases
|
|
|
|
|
notes: Dashboard ConfigMap watcher sidecar in grafana deployment
|
|
|
|
|
|
2026-02-16 17:02:56 -08:00
|
|
|
- name: cloudnative-pg
|
|
|
|
|
type: argocd
|
Migrate Forgejo from Homebrew to source build (#316)
## Summary
- Migrate Forgejo from Homebrew to source-built binary with mcquack LaunchAgent
- Matches the established pattern used by zot, caddy, and alloy
- Upgrades to v14.0.3 (7 security fixes: PKCE bypass, OAuth scope bypass, open redirect, and more)
## Changes
- **Ansible role**: Replace brew install/services with binary stat check + LaunchAgent
- **Paths**: `/opt/homebrew/var/forgejo` → `~/forgejo`, binary at `~/code/3rd/forgejo/forgejo`
- **Run user**: `forgejo` → `erichblume` (LaunchAgent user; SSH git user stays `forgejo`)
- **Docs**: Updated Forgejo reference card, restart-indri guide
- **Service review**: Stamped frigate-notify, cloudnative-pg, blumeops-pg as current
## One-time migration steps (manual, on indri)
1. Clone from Codeberg, add forge mirror remote
2. Check out v14.0.3, build with `make build && make forgejo`
3. Stop brew, `cp -a` data to `~/forgejo`, fix ownership
4. Run `provision-indri --tags forgejo`
5. Verify, then `brew uninstall forgejo`
## Data safety
- `cp -a` preserves everything (repos, SQLite DB, LFS, sessions, OAuth config)
- Brew version stays installed as rollback until verification passes
- No schema changes between 14.0.2 → 14.0.3
Reviewed-on: https://forge.eblu.me/eblume/blumeops/pulls/316
2026-03-28 08:19:23 -07:00
|
|
|
last-reviewed: 2026-03-28
|
2026-02-24 07:26:52 -08:00
|
|
|
current-version: "v1.28.1"
|
2026-02-16 17:02:56 -08:00
|
|
|
upstream-source: https://github.com/cloudnative-pg/cloudnative-pg/releases
|
2026-02-24 07:26:52 -08:00
|
|
|
notes: Deployed via Helm chart (chart v0.27.1 from forge mirror)
|
2026-02-16 17:02:56 -08:00
|
|
|
|
|
|
|
|
- name: immich
|
|
|
|
|
type: argocd
|
2026-04-04 09:42:25 -07:00
|
|
|
last-reviewed: 2026-04-04
|
|
|
|
|
current-version: "v2.6.3"
|
2026-02-16 17:02:56 -08:00
|
|
|
upstream-source: https://github.com/immich-app/immich/releases
|
2026-04-04 09:42:25 -07:00
|
|
|
notes: Kustomize manifests with upstream images
|
2026-02-16 17:02:56 -08:00
|
|
|
|
2026-05-01 17:40:03 -07:00
|
|
|
- name: valkey
|
|
|
|
|
type: argocd
|
|
|
|
|
last-reviewed: 2026-05-01
|
|
|
|
|
current-version: "8.1.6-r0"
|
|
|
|
|
upstream-source: https://pkgs.alpinelinux.org/package/v3.22/community/aarch64/valkey
|
|
|
|
|
notes: >-
|
|
|
|
|
Shared Alpine-built valkey image, used as a sidecar/cache by paperless
|
|
|
|
|
(sidecar) and immich (separate Deployment). Mirrors the upstream
|
|
|
|
|
docker.io/valkey/valkey:8.1-alpine. Pinned to Alpine 3.22 for valkey 8.1.x;
|
|
|
|
|
Alpine 3.23 jumps to 9.0. Distinct from authentik-redis (nix-built Redis
|
|
|
|
|
8.x) which has its own entry.
|
|
|
|
|
|
2026-02-16 17:02:56 -08:00
|
|
|
- name: external-secrets
|
|
|
|
|
type: argocd
|
2026-03-25 15:56:41 -07:00
|
|
|
last-reviewed: 2026-03-25
|
|
|
|
|
current-version: "v2.2.0"
|
2026-02-16 17:02:56 -08:00
|
|
|
upstream-source: https://github.com/external-secrets/external-secrets/releases
|
2026-03-25 15:56:41 -07:00
|
|
|
notes: Static kustomize manifests rendered from upstream Helm chart
|
2026-02-16 17:02:56 -08:00
|
|
|
|
|
|
|
|
- name: 1password-connect
|
|
|
|
|
type: argocd
|
Migrate 1Password Connect from Helm to kustomize (1.8.1 → 1.8.2) (#326)
## Summary
- Renders manifests from `connect-helm-charts v2.4.1` as plain kustomize (deployment + service)
- Bumps 1Password Connect from 1.8.1 → 1.8.2
- Completes the no-helm-policy migration — all services now use kustomize
- Retains all production hardening from the Helm chart (securityContext, runAsNonRoot, drop ALL, seccomp, resource limits)
## Changes
- **New:** `deployment.yaml`, `service.yaml`, `kustomization.yaml` in `argocd/manifests/1password-connect/`
- **Rewritten:** Both ArgoCD app definitions (indri + ringtail) — single source kustomize instead of multi-source Helm
- **Deleted:** `values.yaml` (Helm values no longer needed)
- **Updated:** `no-helm-policy.md`, `service-versions.yaml`, `README.md`
## Deployment plan
1. Sync `apps` app to pick up the new app definitions
2. `argocd app set 1password-connect --revision 1password-connect-kustomize`
3. `argocd app sync 1password-connect` — verify on indri
4. Repeat for ringtail
5. After merge: reset revision to main, re-sync both
## Test plan
- [ ] `kubectl kustomize` renders cleanly (verified locally)
- [ ] ArgoCD diff shows expected changes (Helm labels removed, images bumped)
- [ ] Pods come up healthy on indri
- [ ] External Secrets still resolves 1Password items
- [ ] Repeat on ringtail
Reviewed-on: https://forge.eblu.me/eblume/blumeops/pulls/326
2026-04-06 07:31:40 -07:00
|
|
|
last-reviewed: 2026-04-06
|
|
|
|
|
current-version: "1.8.2"
|
2026-02-26 06:51:50 -08:00
|
|
|
upstream-source: https://hub.docker.com/r/1password/connect-api/tags
|
Migrate 1Password Connect from Helm to kustomize (1.8.1 → 1.8.2) (#326)
## Summary
- Renders manifests from `connect-helm-charts v2.4.1` as plain kustomize (deployment + service)
- Bumps 1Password Connect from 1.8.1 → 1.8.2
- Completes the no-helm-policy migration — all services now use kustomize
- Retains all production hardening from the Helm chart (securityContext, runAsNonRoot, drop ALL, seccomp, resource limits)
## Changes
- **New:** `deployment.yaml`, `service.yaml`, `kustomization.yaml` in `argocd/manifests/1password-connect/`
- **Rewritten:** Both ArgoCD app definitions (indri + ringtail) — single source kustomize instead of multi-source Helm
- **Deleted:** `values.yaml` (Helm values no longer needed)
- **Updated:** `no-helm-policy.md`, `service-versions.yaml`, `README.md`
## Deployment plan
1. Sync `apps` app to pick up the new app definitions
2. `argocd app set 1password-connect --revision 1password-connect-kustomize`
3. `argocd app sync 1password-connect` — verify on indri
4. Repeat for ringtail
5. After merge: reset revision to main, re-sync both
## Test plan
- [ ] `kubectl kustomize` renders cleanly (verified locally)
- [ ] ArgoCD diff shows expected changes (Helm labels removed, images bumped)
- [ ] Pods come up healthy on indri
- [ ] External Secrets still resolves 1Password items
- [ ] Repeat on ringtail
Reviewed-on: https://forge.eblu.me/eblume/blumeops/pulls/326
2026-04-06 07:31:40 -07:00
|
|
|
notes: Kustomize manifests rendered from connect-helm-charts v2.4.1
|
2026-02-16 17:02:56 -08:00
|
|
|
|
|
|
|
|
- name: argocd
|
|
|
|
|
type: argocd
|
2026-04-07 08:21:11 -07:00
|
|
|
last-reviewed: 2026-04-07
|
|
|
|
|
current-version: "v3.3.6"
|
2026-02-16 17:02:56 -08:00
|
|
|
upstream-source: https://github.com/argoproj/argo-cd/releases
|
2026-02-26 06:51:50 -08:00
|
|
|
notes: Kustomize-based install with ServerSideApply
|
2026-02-16 17:02:56 -08:00
|
|
|
|
|
|
|
|
- name: blumeops-pg
|
|
|
|
|
type: argocd
|
Migrate Forgejo from Homebrew to source build (#316)
## Summary
- Migrate Forgejo from Homebrew to source-built binary with mcquack LaunchAgent
- Matches the established pattern used by zot, caddy, and alloy
- Upgrades to v14.0.3 (7 security fixes: PKCE bypass, OAuth scope bypass, open redirect, and more)
## Changes
- **Ansible role**: Replace brew install/services with binary stat check + LaunchAgent
- **Paths**: `/opt/homebrew/var/forgejo` → `~/forgejo`, binary at `~/code/3rd/forgejo/forgejo`
- **Run user**: `forgejo` → `erichblume` (LaunchAgent user; SSH git user stays `forgejo`)
- **Docs**: Updated Forgejo reference card, restart-indri guide
- **Service review**: Stamped frigate-notify, cloudnative-pg, blumeops-pg as current
## One-time migration steps (manual, on indri)
1. Clone from Codeberg, add forge mirror remote
2. Check out v14.0.3, build with `make build && make forgejo`
3. Stop brew, `cp -a` data to `~/forgejo`, fix ownership
4. Run `provision-indri --tags forgejo`
5. Verify, then `brew uninstall forgejo`
## Data safety
- `cp -a` preserves everything (repos, SQLite DB, LFS, sessions, OAuth config)
- Brew version stays installed as rollback until verification passes
- No schema changes between 14.0.2 → 14.0.3
Reviewed-on: https://forge.eblu.me/eblume/blumeops/pulls/316
2026-03-28 08:19:23 -07:00
|
|
|
last-reviewed: 2026-03-28
|
2026-02-27 16:25:32 -08:00
|
|
|
current-version: "18.3"
|
2026-02-16 17:02:56 -08:00
|
|
|
upstream-source: https://github.com/cloudnative-pg/cloudnative-pg/releases
|
2026-02-27 16:25:32 -08:00
|
|
|
notes: CloudNativePG Cluster resource; pinned to PG minor version
|
2026-02-16 17:02:56 -08:00
|
|
|
|
2026-02-20 22:50:01 -08:00
|
|
|
- name: authentik
|
2026-02-22 17:12:45 -08:00
|
|
|
type: argocd
|
2026-04-08 10:53:03 -07:00
|
|
|
last-reviewed: "2026-04-08"
|
|
|
|
|
current-version: "2026.2.2"
|
2026-02-20 22:50:01 -08:00
|
|
|
upstream-source: https://github.com/goauthentik/authentik/releases
|
|
|
|
|
|
2026-03-24 13:27:36 -07:00
|
|
|
- name: authentik-redis
|
|
|
|
|
type: argocd
|
|
|
|
|
parent: authentik
|
|
|
|
|
last-reviewed: "2026-03-24"
|
|
|
|
|
current-version: "8.2.3"
|
|
|
|
|
upstream-source: https://github.com/redis/redis/releases
|
|
|
|
|
notes: >-
|
|
|
|
|
Attached service: Redis cache/broker for Authentik (sessions, Celery task
|
|
|
|
|
queue, caching). Nix-built container from nixpkgs with version assertion.
|
|
|
|
|
|
2026-03-02 20:39:51 -08:00
|
|
|
- name: ollama
|
|
|
|
|
type: argocd
|
2026-04-09 06:42:05 -07:00
|
|
|
last-reviewed: "2026-04-09"
|
|
|
|
|
current-version: "0.20.4"
|
2026-03-02 20:39:51 -08:00
|
|
|
upstream-source: https://github.com/ollama/ollama/releases
|
|
|
|
|
notes: LLM inference server on ringtail (GPU); upstream container image
|
|
|
|
|
|
2026-02-16 17:02:56 -08:00
|
|
|
- name: navidrome
|
2026-02-22 17:12:45 -08:00
|
|
|
type: argocd
|
2026-04-11 17:11:56 -07:00
|
|
|
last-reviewed: 2026-04-11
|
|
|
|
|
current-version: "v0.61.1"
|
2026-02-16 17:02:56 -08:00
|
|
|
upstream-source: https://github.com/navidrome/navidrome/releases
|
|
|
|
|
|
|
|
|
|
- name: miniflux
|
2026-02-22 17:12:45 -08:00
|
|
|
type: argocd
|
2026-04-12 08:54:32 -07:00
|
|
|
last-reviewed: 2026-04-12
|
|
|
|
|
current-version: "2.2.19"
|
2026-02-16 17:02:56 -08:00
|
|
|
upstream-source: https://github.com/miniflux/v2/releases
|
|
|
|
|
|
|
|
|
|
- name: teslamate
|
2026-02-22 17:12:45 -08:00
|
|
|
type: argocd
|
2026-04-14 07:20:52 -07:00
|
|
|
last-reviewed: 2026-04-14
|
2026-03-03 11:56:40 -08:00
|
|
|
current-version: "v3.0.0"
|
2026-02-16 17:02:56 -08:00
|
|
|
upstream-source: https://github.com/teslamate-org/teslamate/releases
|
|
|
|
|
|
|
|
|
|
- name: transmission
|
2026-02-22 17:12:45 -08:00
|
|
|
type: argocd
|
2026-04-15 11:26:00 -07:00
|
|
|
last-reviewed: 2026-04-15
|
2026-03-04 07:44:33 -08:00
|
|
|
current-version: "4.1.1-r1"
|
2026-02-16 17:02:56 -08:00
|
|
|
upstream-source: https://github.com/transmission/transmission/releases
|
|
|
|
|
|
2026-03-04 21:55:00 -08:00
|
|
|
- name: transmission-exporter
|
|
|
|
|
type: argocd
|
2026-04-15 11:26:00 -07:00
|
|
|
last-reviewed: 2026-04-15
|
2026-03-05 08:04:02 -08:00
|
|
|
current-version: "1.0.1"
|
2026-03-04 21:55:00 -08:00
|
|
|
upstream-source: null
|
|
|
|
|
notes: Homegrown Python exporter, no upstream
|
|
|
|
|
|
2026-02-16 17:02:56 -08:00
|
|
|
- name: kiwix
|
2026-02-22 17:12:45 -08:00
|
|
|
type: argocd
|
2026-04-17 13:56:32 -07:00
|
|
|
last-reviewed: 2026-04-17
|
2026-03-05 08:12:32 -08:00
|
|
|
current-version: "3.8.2"
|
2026-02-16 17:02:56 -08:00
|
|
|
upstream-source: https://github.com/kiwix/kiwix-tools/releases
|
|
|
|
|
|
|
|
|
|
- name: devpi
|
2026-04-29 13:38:36 -07:00
|
|
|
type: ansible
|
|
|
|
|
last-reviewed: 2026-04-29
|
2026-04-18 07:57:05 -07:00
|
|
|
current-version: "6.19.3"
|
2026-02-16 17:02:56 -08:00
|
|
|
upstream-source: https://github.com/devpi/devpi/releases
|
2026-04-29 13:38:36 -07:00
|
|
|
notes: Installed via uv into a venv on indri; version pinned in ansible/roles/devpi/defaults/main.yml
|
2026-02-16 17:02:56 -08:00
|
|
|
|
|
|
|
|
- name: cv
|
C1: migrate cv + docs from minikube to indri-native (#342)
## Summary
Replace the cv (`cv.eblu.me`) and docs (`docs.eblu.me`) minikube Deployments with indri-native ansible roles. Caddy serves the extracted release tarballs directly via a new `kind: static` service-block — no daemon, no nginx pod, no ProxyGroup ingress on the request path. Mirrors the rationale of the recent devpi migration; part of the broader minikube wind-down.
## What's in this commit
- `ansible/roles/{cv,docs}` — sentinel-gated tarball download + extract into `~/{cv,docs}/content/`
- `ansible/roles/caddy/` — new `kind: static` branch in the Caddyfile template (encoded gzip, immutable cache headers for fingerprinted assets, optional `try_html` for Quartz-style clean URLs, optional per-path `download_paths` for the resume PDF's `Content-Disposition`)
- `ansible/playbooks/indri.yml` — wires `cv` and `docs` roles before `caddy`
- `service-versions.yaml` — both services flip to `type: ansible`. `docs.current-version` stays at `1.28.2` for this commit so `container-version-check` keeps passing while `containers/quartz/Dockerfile` still exists; it moves to the docs release tag in the cleanup commit
- `.forgejo/workflows/{cv-deploy,build-blumeops}.yaml` — deploy step now bumps `cv_version`/`docs_version` in the role defaults and pushes; running ansible + purging the Fly cache is manual from gilbert (matches devpi)
- Docs: `docs/how-to/operations/{cv,docs}-on-indri.md`, updated `docs/reference/services/{cv,docs}.md`, changelog fragment
## What is not in this commit
The dead artifacts. After PR review and successful cutover, a follow-up commit deletes:
- `argocd/apps/{cv,docs}.yaml` and `argocd/manifests/{cv,docs}/`
- `containers/cv/`, `containers/quartz/`
- `CONTAINER_TO_SERVICE['quartz']` mapping in `mise-tasks/container-version-check`
- bumps `docs.current-version` in `service-versions.yaml` to the release tag
## Cutover plan (manual, from gilbert, after review)
1. **Take down old:**
- Remove the cv and docs Applications: `argocd app delete cv --cascade && argocd app delete docs --cascade`
- Verify k8s namespaces gone: `kubectl --context=minikube-indri get ns | grep -E '^(cv|docs)\\b'` (should be empty)
- Verify tailnet MagicDNS no longer advertises the VIPs: `nslookup cv.tail8d86e.ts.net` and `nslookup docs.tail8d86e.ts.net` should both fail
2. **Bring up new:**
- `mise run provision-indri -- --tags cv,docs,caddy --check --diff` (already validated on branch)
- `mise run provision-indri -- --tags cv,docs,caddy`
- `fly ssh console -a blumeops-proxy -C "sh -c 'rm -rf /tmp/cache && nginx -s reload'"`
3. **Verify:** `mise run services-check` and the curl checks listed in `docs/how-to/operations/{cv,docs}-on-indri.md`
4. **Cleanup commit + merge.**
Total expected downtime: minutes (not the few-hour budget you authorized).
## Test plan
- [ ] `mise run provision-indri -- --tags cv,docs --check --diff` clean
- [ ] `mise run provision-indri -- --tags caddy --check --diff` shows only the cv + docs blocks changing as previewed in the PR thread
- [ ] After cutover: `cv.eblu.me`, `cv.ops.eblu.me`, `docs.eblu.me`, `docs.ops.eblu.me` all return 200
- [ ] `cv.eblu.me/resume.pdf` includes `Content-Disposition: attachment`
- [ ] A clean Quartz URL (e.g. `docs.eblu.me/explanation/agent-change-process`) resolves to the right page
- [ ] `mise run services-check` clean
- [ ] `mise run service-review --type ansible` shows cv and docs
🤖 Generated with [Claude Code](https://claude.com/claude-code)
Reviewed-on: https://forge.eblu.me/eblume/blumeops/pulls/342
2026-04-29 14:55:11 -07:00
|
|
|
type: ansible
|
|
|
|
|
last-reviewed: 2026-04-29
|
2026-02-20 22:50:01 -08:00
|
|
|
current-version: "1.0.3"
|
2026-03-27 07:11:22 -07:00
|
|
|
upstream-source: https://forge.eblu.me/eblume/cv
|
C1: migrate cv + docs from minikube to indri-native (#342)
## Summary
Replace the cv (`cv.eblu.me`) and docs (`docs.eblu.me`) minikube Deployments with indri-native ansible roles. Caddy serves the extracted release tarballs directly via a new `kind: static` service-block — no daemon, no nginx pod, no ProxyGroup ingress on the request path. Mirrors the rationale of the recent devpi migration; part of the broader minikube wind-down.
## What's in this commit
- `ansible/roles/{cv,docs}` — sentinel-gated tarball download + extract into `~/{cv,docs}/content/`
- `ansible/roles/caddy/` — new `kind: static` branch in the Caddyfile template (encoded gzip, immutable cache headers for fingerprinted assets, optional `try_html` for Quartz-style clean URLs, optional per-path `download_paths` for the resume PDF's `Content-Disposition`)
- `ansible/playbooks/indri.yml` — wires `cv` and `docs` roles before `caddy`
- `service-versions.yaml` — both services flip to `type: ansible`. `docs.current-version` stays at `1.28.2` for this commit so `container-version-check` keeps passing while `containers/quartz/Dockerfile` still exists; it moves to the docs release tag in the cleanup commit
- `.forgejo/workflows/{cv-deploy,build-blumeops}.yaml` — deploy step now bumps `cv_version`/`docs_version` in the role defaults and pushes; running ansible + purging the Fly cache is manual from gilbert (matches devpi)
- Docs: `docs/how-to/operations/{cv,docs}-on-indri.md`, updated `docs/reference/services/{cv,docs}.md`, changelog fragment
## What is not in this commit
The dead artifacts. After PR review and successful cutover, a follow-up commit deletes:
- `argocd/apps/{cv,docs}.yaml` and `argocd/manifests/{cv,docs}/`
- `containers/cv/`, `containers/quartz/`
- `CONTAINER_TO_SERVICE['quartz']` mapping in `mise-tasks/container-version-check`
- bumps `docs.current-version` in `service-versions.yaml` to the release tag
## Cutover plan (manual, from gilbert, after review)
1. **Take down old:**
- Remove the cv and docs Applications: `argocd app delete cv --cascade && argocd app delete docs --cascade`
- Verify k8s namespaces gone: `kubectl --context=minikube-indri get ns | grep -E '^(cv|docs)\\b'` (should be empty)
- Verify tailnet MagicDNS no longer advertises the VIPs: `nslookup cv.tail8d86e.ts.net` and `nslookup docs.tail8d86e.ts.net` should both fail
2. **Bring up new:**
- `mise run provision-indri -- --tags cv,docs,caddy --check --diff` (already validated on branch)
- `mise run provision-indri -- --tags cv,docs,caddy`
- `fly ssh console -a blumeops-proxy -C "sh -c 'rm -rf /tmp/cache && nginx -s reload'"`
3. **Verify:** `mise run services-check` and the curl checks listed in `docs/how-to/operations/{cv,docs}-on-indri.md`
4. **Cleanup commit + merge.**
Total expected downtime: minutes (not the few-hour budget you authorized).
## Test plan
- [ ] `mise run provision-indri -- --tags cv,docs --check --diff` clean
- [ ] `mise run provision-indri -- --tags caddy --check --diff` shows only the cv + docs blocks changing as previewed in the PR thread
- [ ] After cutover: `cv.eblu.me`, `cv.ops.eblu.me`, `docs.eblu.me`, `docs.ops.eblu.me` all return 200
- [ ] `cv.eblu.me/resume.pdf` includes `Content-Disposition: attachment`
- [ ] A clean Quartz URL (e.g. `docs.eblu.me/explanation/agent-change-process`) resolves to the right page
- [ ] `mise run services-check` clean
- [ ] `mise run service-review --type ansible` shows cv and docs
🤖 Generated with [Claude Code](https://claude.com/claude-code)
Reviewed-on: https://forge.eblu.me/eblume/blumeops/pulls/342
2026-04-29 14:55:11 -07:00
|
|
|
notes: >-
|
|
|
|
|
Static tarball downloaded by ansible/roles/cv into ~/blumeops/cv/content on indri;
|
|
|
|
|
served directly by Caddy (kind=static). Migrated from minikube 2026-04-29.
|
|
|
|
|
Review build deps (WeasyPrint, Jinja2) in source repo on upstream review.
|
2026-02-16 17:02:56 -08:00
|
|
|
|
|
|
|
|
- name: docs
|
C1: migrate cv + docs from minikube to indri-native (#342)
## Summary
Replace the cv (`cv.eblu.me`) and docs (`docs.eblu.me`) minikube Deployments with indri-native ansible roles. Caddy serves the extracted release tarballs directly via a new `kind: static` service-block — no daemon, no nginx pod, no ProxyGroup ingress on the request path. Mirrors the rationale of the recent devpi migration; part of the broader minikube wind-down.
## What's in this commit
- `ansible/roles/{cv,docs}` — sentinel-gated tarball download + extract into `~/{cv,docs}/content/`
- `ansible/roles/caddy/` — new `kind: static` branch in the Caddyfile template (encoded gzip, immutable cache headers for fingerprinted assets, optional `try_html` for Quartz-style clean URLs, optional per-path `download_paths` for the resume PDF's `Content-Disposition`)
- `ansible/playbooks/indri.yml` — wires `cv` and `docs` roles before `caddy`
- `service-versions.yaml` — both services flip to `type: ansible`. `docs.current-version` stays at `1.28.2` for this commit so `container-version-check` keeps passing while `containers/quartz/Dockerfile` still exists; it moves to the docs release tag in the cleanup commit
- `.forgejo/workflows/{cv-deploy,build-blumeops}.yaml` — deploy step now bumps `cv_version`/`docs_version` in the role defaults and pushes; running ansible + purging the Fly cache is manual from gilbert (matches devpi)
- Docs: `docs/how-to/operations/{cv,docs}-on-indri.md`, updated `docs/reference/services/{cv,docs}.md`, changelog fragment
## What is not in this commit
The dead artifacts. After PR review and successful cutover, a follow-up commit deletes:
- `argocd/apps/{cv,docs}.yaml` and `argocd/manifests/{cv,docs}/`
- `containers/cv/`, `containers/quartz/`
- `CONTAINER_TO_SERVICE['quartz']` mapping in `mise-tasks/container-version-check`
- bumps `docs.current-version` in `service-versions.yaml` to the release tag
## Cutover plan (manual, from gilbert, after review)
1. **Take down old:**
- Remove the cv and docs Applications: `argocd app delete cv --cascade && argocd app delete docs --cascade`
- Verify k8s namespaces gone: `kubectl --context=minikube-indri get ns | grep -E '^(cv|docs)\\b'` (should be empty)
- Verify tailnet MagicDNS no longer advertises the VIPs: `nslookup cv.tail8d86e.ts.net` and `nslookup docs.tail8d86e.ts.net` should both fail
2. **Bring up new:**
- `mise run provision-indri -- --tags cv,docs,caddy --check --diff` (already validated on branch)
- `mise run provision-indri -- --tags cv,docs,caddy`
- `fly ssh console -a blumeops-proxy -C "sh -c 'rm -rf /tmp/cache && nginx -s reload'"`
3. **Verify:** `mise run services-check` and the curl checks listed in `docs/how-to/operations/{cv,docs}-on-indri.md`
4. **Cleanup commit + merge.**
Total expected downtime: minutes (not the few-hour budget you authorized).
## Test plan
- [ ] `mise run provision-indri -- --tags cv,docs --check --diff` clean
- [ ] `mise run provision-indri -- --tags caddy --check --diff` shows only the cv + docs blocks changing as previewed in the PR thread
- [ ] After cutover: `cv.eblu.me`, `cv.ops.eblu.me`, `docs.eblu.me`, `docs.ops.eblu.me` all return 200
- [ ] `cv.eblu.me/resume.pdf` includes `Content-Disposition: attachment`
- [ ] A clean Quartz URL (e.g. `docs.eblu.me/explanation/agent-change-process`) resolves to the right page
- [ ] `mise run services-check` clean
- [ ] `mise run service-review --type ansible` shows cv and docs
🤖 Generated with [Claude Code](https://claude.com/claude-code)
Reviewed-on: https://forge.eblu.me/eblume/blumeops/pulls/342
2026-04-29 14:55:11 -07:00
|
|
|
type: ansible
|
|
|
|
|
last-reviewed: 2026-04-29
|
C1: clean up cv + docs minikube artifacts (#343)
## Summary
Follow-up to #342. The cv and docs services are now live on indri (Caddy file_server backed by ansible-managed tarball extraction) and verified working. This PR removes the dead minikube artifacts and the tooling shims that referenced them.
## Changes
**Deletions:**
- ``argocd/apps/{cv,docs}.yaml``
- ``argocd/manifests/{cv,docs}/`` (deployment, service, ingress, pdb, kustomization)
- ``containers/{cv,quartz}/`` (Dockerfiles + start scripts)
**Tooling:**
- ``mise-tasks/container-version-check``: remove the ``quartz``→``docs`` CONTAINER_TO_SERVICE mapping (containers/quartz no longer exists)
- ``service-versions.yaml``: bump ``docs.current-version`` to ``v1.16.0`` (the blumeops docs release tag) and trim the migration-window comment
## Live state context
The argocd Applications ``cv`` and ``docs`` were already deleted from the cluster manually as part of the cutover; this PR just removes the YAML files that the ``apps`` app-of-apps was still ingesting. After merge, ``argocd app sync apps`` will reconcile and the ``apps`` Application returns to Synced.
The Caddyfile ``handle_errors`` bug that briefly crashed all ``*.ops.eblu.me`` services during cutover is fixed in a separate C0 (``2ee53fe``) on main, not here.
## Test plan
- [x] ``mise run container-version-check --all-files`` clean
- [x] ``mise run service-review --type ansible`` shows cv at 1.0.3, docs at v1.16.0
- [ ] After merge: ``argocd app sync apps`` returns clean (cv/docs entries gone, no children to reconcile)
🤖 Generated with [Claude Code](https://claude.com/claude-code)
Reviewed-on: https://forge.eblu.me/eblume/blumeops/pulls/343
2026-04-29 15:18:39 -07:00
|
|
|
current-version: "v1.16.0"
|
C1: migrate cv + docs from minikube to indri-native (#342)
## Summary
Replace the cv (`cv.eblu.me`) and docs (`docs.eblu.me`) minikube Deployments with indri-native ansible roles. Caddy serves the extracted release tarballs directly via a new `kind: static` service-block — no daemon, no nginx pod, no ProxyGroup ingress on the request path. Mirrors the rationale of the recent devpi migration; part of the broader minikube wind-down.
## What's in this commit
- `ansible/roles/{cv,docs}` — sentinel-gated tarball download + extract into `~/{cv,docs}/content/`
- `ansible/roles/caddy/` — new `kind: static` branch in the Caddyfile template (encoded gzip, immutable cache headers for fingerprinted assets, optional `try_html` for Quartz-style clean URLs, optional per-path `download_paths` for the resume PDF's `Content-Disposition`)
- `ansible/playbooks/indri.yml` — wires `cv` and `docs` roles before `caddy`
- `service-versions.yaml` — both services flip to `type: ansible`. `docs.current-version` stays at `1.28.2` for this commit so `container-version-check` keeps passing while `containers/quartz/Dockerfile` still exists; it moves to the docs release tag in the cleanup commit
- `.forgejo/workflows/{cv-deploy,build-blumeops}.yaml` — deploy step now bumps `cv_version`/`docs_version` in the role defaults and pushes; running ansible + purging the Fly cache is manual from gilbert (matches devpi)
- Docs: `docs/how-to/operations/{cv,docs}-on-indri.md`, updated `docs/reference/services/{cv,docs}.md`, changelog fragment
## What is not in this commit
The dead artifacts. After PR review and successful cutover, a follow-up commit deletes:
- `argocd/apps/{cv,docs}.yaml` and `argocd/manifests/{cv,docs}/`
- `containers/cv/`, `containers/quartz/`
- `CONTAINER_TO_SERVICE['quartz']` mapping in `mise-tasks/container-version-check`
- bumps `docs.current-version` in `service-versions.yaml` to the release tag
## Cutover plan (manual, from gilbert, after review)
1. **Take down old:**
- Remove the cv and docs Applications: `argocd app delete cv --cascade && argocd app delete docs --cascade`
- Verify k8s namespaces gone: `kubectl --context=minikube-indri get ns | grep -E '^(cv|docs)\\b'` (should be empty)
- Verify tailnet MagicDNS no longer advertises the VIPs: `nslookup cv.tail8d86e.ts.net` and `nslookup docs.tail8d86e.ts.net` should both fail
2. **Bring up new:**
- `mise run provision-indri -- --tags cv,docs,caddy --check --diff` (already validated on branch)
- `mise run provision-indri -- --tags cv,docs,caddy`
- `fly ssh console -a blumeops-proxy -C "sh -c 'rm -rf /tmp/cache && nginx -s reload'"`
3. **Verify:** `mise run services-check` and the curl checks listed in `docs/how-to/operations/{cv,docs}-on-indri.md`
4. **Cleanup commit + merge.**
Total expected downtime: minutes (not the few-hour budget you authorized).
## Test plan
- [ ] `mise run provision-indri -- --tags cv,docs --check --diff` clean
- [ ] `mise run provision-indri -- --tags caddy --check --diff` shows only the cv + docs blocks changing as previewed in the PR thread
- [ ] After cutover: `cv.eblu.me`, `cv.ops.eblu.me`, `docs.eblu.me`, `docs.ops.eblu.me` all return 200
- [ ] `cv.eblu.me/resume.pdf` includes `Content-Disposition: attachment`
- [ ] A clean Quartz URL (e.g. `docs.eblu.me/explanation/agent-change-process`) resolves to the right page
- [ ] `mise run services-check` clean
- [ ] `mise run service-review --type ansible` shows cv and docs
🤖 Generated with [Claude Code](https://claude.com/claude-code)
Reviewed-on: https://forge.eblu.me/eblume/blumeops/pulls/342
2026-04-29 14:55:11 -07:00
|
|
|
upstream-source: https://forge.eblu.me/eblume/blumeops/releases
|
|
|
|
|
notes: >-
|
|
|
|
|
Quartz-built tarball downloaded by ansible/roles/docs into ~/blumeops/docs/content
|
C1: clean up cv + docs minikube artifacts (#343)
## Summary
Follow-up to #342. The cv and docs services are now live on indri (Caddy file_server backed by ansible-managed tarball extraction) and verified working. This PR removes the dead minikube artifacts and the tooling shims that referenced them.
## Changes
**Deletions:**
- ``argocd/apps/{cv,docs}.yaml``
- ``argocd/manifests/{cv,docs}/`` (deployment, service, ingress, pdb, kustomization)
- ``containers/{cv,quartz}/`` (Dockerfiles + start scripts)
**Tooling:**
- ``mise-tasks/container-version-check``: remove the ``quartz``→``docs`` CONTAINER_TO_SERVICE mapping (containers/quartz no longer exists)
- ``service-versions.yaml``: bump ``docs.current-version`` to ``v1.16.0`` (the blumeops docs release tag) and trim the migration-window comment
## Live state context
The argocd Applications ``cv`` and ``docs`` were already deleted from the cluster manually as part of the cutover; this PR just removes the YAML files that the ``apps`` app-of-apps was still ingesting. After merge, ``argocd app sync apps`` will reconcile and the ``apps`` Application returns to Synced.
The Caddyfile ``handle_errors`` bug that briefly crashed all ``*.ops.eblu.me`` services during cutover is fixed in a separate C0 (``2ee53fe``) on main, not here.
## Test plan
- [x] ``mise run container-version-check --all-files`` clean
- [x] ``mise run service-review --type ansible`` shows cv at 1.0.3, docs at v1.16.0
- [ ] After merge: ``argocd app sync apps`` returns clean (cv/docs entries gone, no children to reconcile)
🤖 Generated with [Claude Code](https://claude.com/claude-code)
Reviewed-on: https://forge.eblu.me/eblume/blumeops/pulls/343
2026-04-29 15:18:39 -07:00
|
|
|
on indri; served directly by Caddy (kind=static, try_html). current-version
|
|
|
|
|
tracks the blumeops docs release tag.
|
2026-02-16 17:02:56 -08:00
|
|
|
|
|
|
|
|
- name: forgejo-runner
|
2026-02-22 17:12:45 -08:00
|
|
|
type: argocd
|
2026-04-20 09:15:35 -07:00
|
|
|
last-reviewed: 2026-04-20
|
2026-04-20 09:03:54 -07:00
|
|
|
current-version: "12.8.2"
|
2026-02-16 17:02:56 -08:00
|
|
|
upstream-source: https://code.forgejo.org/forgejo/runner/releases
|
2026-02-22 17:12:45 -08:00
|
|
|
notes: >-
|
2026-02-23 17:44:51 -08:00
|
|
|
Runner daemon version (code.forgejo.org/forgejo/runner). Job execution
|
|
|
|
|
image is tracked separately as runner-job-image.
|
|
|
|
|
|
|
|
|
|
- name: runner-job-image
|
|
|
|
|
type: argocd
|
2026-04-21 08:12:33 -07:00
|
|
|
last-reviewed: 2026-04-21
|
|
|
|
|
current-version: "0.20.6"
|
2026-02-23 17:44:51 -08:00
|
|
|
upstream-source: https://github.com/dagger/dagger/releases
|
|
|
|
|
notes: >-
|
|
|
|
|
Forgejo Actions job execution image. CONTAINER_APP_VERSION tracks the
|
|
|
|
|
Dagger CLI version, the primary build tool in the image.
|
2026-02-16 17:02:56 -08:00
|
|
|
|
2026-02-22 17:12:45 -08:00
|
|
|
- name: nix-container-builder
|
|
|
|
|
type: nixos
|
2026-04-01 21:37:57 -07:00
|
|
|
last-reviewed: 2026-04-01
|
|
|
|
|
current-version: "12.7.2"
|
2026-02-22 17:12:45 -08:00
|
|
|
upstream-source: https://code.forgejo.org/forgejo/runner/releases
|
2026-04-01 21:37:57 -07:00
|
|
|
notes: >-
|
|
|
|
|
Forgejo runner on ringtail; pinned via nixpkgs-services overlay in flake.nix.
|
|
|
|
|
Update nixpkgs-services rev during service reviews, not via nix flake update.
|
2026-02-16 17:02:56 -08:00
|
|
|
|
2026-03-24 20:51:40 -07:00
|
|
|
- name: snowflake-proxy
|
|
|
|
|
type: nixos
|
2026-04-01 21:37:57 -07:00
|
|
|
last-reviewed: 2026-04-01
|
2026-03-24 20:51:40 -07:00
|
|
|
current-version: "2.11.0"
|
|
|
|
|
upstream-source: https://gitlab.torproject.org/tpo/anti-censorship/pluggable-transports/snowflake/-/releases
|
2026-04-01 21:37:57 -07:00
|
|
|
notes: >-
|
|
|
|
|
Tor Snowflake proxy on ringtail; pinned via nixpkgs-services overlay in flake.nix.
|
|
|
|
|
Anti-censorship bridge, not an exit node.
|
|
|
|
|
|
|
|
|
|
- name: k3s
|
|
|
|
|
type: nixos
|
|
|
|
|
last-reviewed: 2026-04-01
|
|
|
|
|
current-version: "1.34.5+k3s1"
|
|
|
|
|
upstream-source: https://github.com/k3s-io/k3s/releases
|
|
|
|
|
notes: >-
|
|
|
|
|
Single-node k3s cluster on ringtail; pinned via nixpkgs-services overlay in flake.nix.
|
|
|
|
|
Update nixpkgs-services rev during service reviews.
|
|
|
|
|
|
|
|
|
|
- name: minikube
|
|
|
|
|
type: ansible
|
|
|
|
|
last-reviewed: 2026-04-01
|
|
|
|
|
current-version: "1.38.0"
|
|
|
|
|
upstream-source: https://github.com/kubernetes/minikube/releases
|
|
|
|
|
notes: >-
|
|
|
|
|
Single-node minikube on indri; installed via homebrew (not version-pinned).
|
|
|
|
|
Homebrew may silently upgrade on brew update/upgrade.
|
2026-03-24 20:51:40 -07:00
|
|
|
|
2026-03-16 21:59:10 -07:00
|
|
|
- name: mealie
|
|
|
|
|
type: argocd
|
|
|
|
|
last-reviewed: 2026-03-16
|
|
|
|
|
current-version: "v3.12.0"
|
|
|
|
|
upstream-source: https://github.com/mealie-recipes/mealie/releases
|
|
|
|
|
notes: Recipe manager; built from source via forge mirror
|
|
|
|
|
|
2026-04-08 17:54:12 -07:00
|
|
|
- name: paperless
|
|
|
|
|
type: argocd
|
|
|
|
|
last-reviewed: "2026-04-08"
|
|
|
|
|
current-version: "v2.20.13"
|
|
|
|
|
upstream-source: https://github.com/paperless-ngx/paperless-ngx/releases
|
|
|
|
|
notes: Document management; built from source via forge mirror
|
|
|
|
|
|
2026-03-16 15:52:45 -07:00
|
|
|
- name: unpoller
|
|
|
|
|
type: argocd
|
|
|
|
|
last-reviewed: 2026-03-16
|
|
|
|
|
current-version: "v2.34.0"
|
|
|
|
|
upstream-source: https://github.com/unpoller/unpoller/releases
|
|
|
|
|
notes: UniFi metrics exporter for Prometheus
|
|
|
|
|
|
2026-03-24 16:08:09 -07:00
|
|
|
- name: prowler
|
|
|
|
|
type: argocd
|
2026-04-14 13:45:28 -07:00
|
|
|
last-reviewed: 2026-04-14
|
|
|
|
|
current-version: "5.23.0"
|
2026-03-24 16:08:09 -07:00
|
|
|
upstream-source: https://github.com/prowler-cloud/prowler/releases
|
|
|
|
|
notes: CIS Kubernetes Benchmark scanner; weekly CronJob on minikube-indri
|
|
|
|
|
|
2026-03-30 06:34:49 -07:00
|
|
|
- name: kingfisher
|
|
|
|
|
type: argocd
|
|
|
|
|
last-reviewed: 2026-03-29
|
|
|
|
|
current-version: "165768b"
|
|
|
|
|
upstream-source: https://github.com/mongodb/kingfisher/releases
|
|
|
|
|
notes: Secret scanner; sporked from upstream with --clone-url-base patch. Version is upstream main SHA.
|
|
|
|
|
|
2026-02-16 17:02:56 -08:00
|
|
|
- name: forgejo
|
|
|
|
|
type: ansible
|
Migrate Forgejo from Homebrew to source build (#316)
## Summary
- Migrate Forgejo from Homebrew to source-built binary with mcquack LaunchAgent
- Matches the established pattern used by zot, caddy, and alloy
- Upgrades to v14.0.3 (7 security fixes: PKCE bypass, OAuth scope bypass, open redirect, and more)
## Changes
- **Ansible role**: Replace brew install/services with binary stat check + LaunchAgent
- **Paths**: `/opt/homebrew/var/forgejo` → `~/forgejo`, binary at `~/code/3rd/forgejo/forgejo`
- **Run user**: `forgejo` → `erichblume` (LaunchAgent user; SSH git user stays `forgejo`)
- **Docs**: Updated Forgejo reference card, restart-indri guide
- **Service review**: Stamped frigate-notify, cloudnative-pg, blumeops-pg as current
## One-time migration steps (manual, on indri)
1. Clone from Codeberg, add forge mirror remote
2. Check out v14.0.3, build with `make build && make forgejo`
3. Stop brew, `cp -a` data to `~/forgejo`, fix ownership
4. Run `provision-indri --tags forgejo`
5. Verify, then `brew uninstall forgejo`
## Data safety
- `cp -a` preserves everything (repos, SQLite DB, LFS, sessions, OAuth config)
- Brew version stays installed as rollback until verification passes
- No schema changes between 14.0.2 → 14.0.3
Reviewed-on: https://forge.eblu.me/eblume/blumeops/pulls/316
2026-03-28 08:19:23 -07:00
|
|
|
last-reviewed: 2026-03-28
|
|
|
|
|
current-version: "14.0.3"
|
2026-02-16 17:02:56 -08:00
|
|
|
upstream-source: https://codeberg.org/forgejo/forgejo/releases
|
Migrate Forgejo from Homebrew to source build (#316)
## Summary
- Migrate Forgejo from Homebrew to source-built binary with mcquack LaunchAgent
- Matches the established pattern used by zot, caddy, and alloy
- Upgrades to v14.0.3 (7 security fixes: PKCE bypass, OAuth scope bypass, open redirect, and more)
## Changes
- **Ansible role**: Replace brew install/services with binary stat check + LaunchAgent
- **Paths**: `/opt/homebrew/var/forgejo` → `~/forgejo`, binary at `~/code/3rd/forgejo/forgejo`
- **Run user**: `forgejo` → `erichblume` (LaunchAgent user; SSH git user stays `forgejo`)
- **Docs**: Updated Forgejo reference card, restart-indri guide
- **Service review**: Stamped frigate-notify, cloudnative-pg, blumeops-pg as current
## One-time migration steps (manual, on indri)
1. Clone from Codeberg, add forge mirror remote
2. Check out v14.0.3, build with `make build && make forgejo`
3. Stop brew, `cp -a` data to `~/forgejo`, fix ownership
4. Run `provision-indri --tags forgejo`
5. Verify, then `brew uninstall forgejo`
## Data safety
- `cp -a` preserves everything (repos, SQLite DB, LFS, sessions, OAuth config)
- Brew version stays installed as rollback until verification passes
- No schema changes between 14.0.2 → 14.0.3
Reviewed-on: https://forge.eblu.me/eblume/blumeops/pulls/316
2026-03-28 08:19:23 -07:00
|
|
|
notes: Built from source on indri (~/code/3rd/forgejo)
|
2026-02-16 17:02:56 -08:00
|
|
|
|
|
|
|
|
- name: alloy
|
|
|
|
|
type: ansible
|
2026-05-01 08:05:37 -07:00
|
|
|
last-reviewed: 2026-04-30
|
|
|
|
|
current-version: "v1.16.0"
|
2026-02-16 17:02:56 -08:00
|
|
|
upstream-source: https://github.com/grafana/alloy/releases
|
|
|
|
|
notes: Built from source on indri
|
|
|
|
|
|
|
|
|
|
- name: zot
|
|
|
|
|
type: ansible
|
2026-05-04 17:41:07 -07:00
|
|
|
last-reviewed: 2026-05-04
|
|
|
|
|
current-version: "v2.1.16"
|
2026-02-16 17:02:56 -08:00
|
|
|
upstream-source: https://github.com/project-zot/zot/releases
|
|
|
|
|
notes: Built from source on indri
|
|
|
|
|
|
|
|
|
|
- name: caddy
|
|
|
|
|
type: ansible
|
2026-05-06 06:11:15 -07:00
|
|
|
last-reviewed: 2026-05-06
|
2026-03-15 10:33:48 -07:00
|
|
|
current-version: "v2.11.2"
|
2026-02-16 17:02:56 -08:00
|
|
|
upstream-source: https://github.com/caddyserver/caddy/releases
|
2026-03-15 10:33:48 -07:00
|
|
|
notes: Built from source with Gandi DNS and Layer 4 plugins
|
2026-02-16 17:02:56 -08:00
|
|
|
|
|
|
|
|
- name: borgmatic
|
|
|
|
|
type: ansible
|
2026-04-15 07:23:46 -07:00
|
|
|
last-reviewed: 2026-04-15
|
|
|
|
|
current-version: "2.1.4"
|
2026-02-16 17:02:56 -08:00
|
|
|
upstream-source: https://github.com/borgmatic-collective/borgmatic/releases
|
2026-04-15 07:23:46 -07:00
|
|
|
notes: Installed via mise (pipx); version pinned in ansible/roles/borgmatic/defaults/main.yml and mise.toml
|
2026-02-16 17:02:56 -08:00
|
|
|
|
|
|
|
|
- name: jellyfin
|
|
|
|
|
type: ansible
|
2026-03-17 13:06:23 -07:00
|
|
|
last-reviewed: 2026-03-17
|
|
|
|
|
current-version: "10.11.6"
|
2026-02-16 17:02:56 -08:00
|
|
|
upstream-source: https://github.com/jellyfin/jellyfin/releases
|
|
|
|
|
|
|
|
|
|
- name: automounter
|
|
|
|
|
type: ansible
|
2026-03-17 13:06:23 -07:00
|
|
|
last-reviewed: 2026-03-17
|
|
|
|
|
current-version: "1.11.0"
|
|
|
|
|
upstream-source: https://www.pixeleyes.co.nz/automounter/
|
|
|
|
|
notes: Mac App Store app, no Ansible role. Updates via App Store.
|
2026-04-10 19:40:57 -07:00
|
|
|
|
|
|
|
|
- name: flyio-tailscale
|
|
|
|
|
type: fly
|
|
|
|
|
last-reviewed: "2026-04-10"
|
|
|
|
|
current-version: "v1.94.1"
|
|
|
|
|
upstream-source: https://github.com/tailscale/tailscale/releases
|
|
|
|
|
notes: >-
|
|
|
|
|
Pinned after v1.96.5 broke MagicDNS in containers. Test DNS resolution
|
|
|
|
|
inside Fly container before upgrading. COPY --from in fly/Dockerfile.
|
|
|
|
|
|
|
|
|
|
- name: flyio-nginx
|
|
|
|
|
type: fly
|
|
|
|
|
last-reviewed: "2026-04-10"
|
|
|
|
|
current-version: "1.29.6-alpine"
|
|
|
|
|
upstream-source: https://hub.docker.com/_/nginx
|
|
|
|
|
notes: Base image for Fly proxy (fly/Dockerfile)
|
|
|
|
|
|
|
|
|
|
- name: flyio-alloy
|
|
|
|
|
type: fly
|
|
|
|
|
parent: flyio-nginx
|
|
|
|
|
last-reviewed: "2026-04-10"
|
|
|
|
|
current-version: "v1.14.1"
|
|
|
|
|
upstream-source: https://github.com/grafana/alloy/releases
|
|
|
|
|
notes: COPY --from in fly/Dockerfile for log shipping and metrics
|
2026-04-12 08:54:32 -07:00
|
|
|
|
|
|
|
|
- name: dagger
|
|
|
|
|
type: mise
|
2026-04-21 08:12:33 -07:00
|
|
|
last-reviewed: 2026-04-21
|
|
|
|
|
current-version: "0.20.6"
|
2026-04-12 08:54:32 -07:00
|
|
|
upstream-source: https://github.com/dagger/dagger/releases
|
|
|
|
|
notes: Dagger CI/CD engine; pinned in mise.toml
|
|
|
|
|
|
|
|
|
|
- name: ansible-core
|
|
|
|
|
type: mise
|
|
|
|
|
last-reviewed: 2026-04-12
|
|
|
|
|
current-version: "2.20.1"
|
|
|
|
|
upstream-source: https://github.com/ansible/ansible/releases
|
|
|
|
|
notes: Installed via pipx/uvx with botocore and boto3
|
|
|
|
|
|
|
|
|
|
- name: prek
|
|
|
|
|
type: mise
|
|
|
|
|
last-reviewed: 2026-04-12
|
|
|
|
|
current-version: "0.3.4"
|
|
|
|
|
upstream-source: https://github.com/j178/prek/releases
|
|
|
|
|
notes: Pre-commit hook runner (Rust reimplementation)
|
|
|
|
|
|
|
|
|
|
- name: pulumi-cli
|
|
|
|
|
type: mise
|
|
|
|
|
last-reviewed: 2026-04-12
|
|
|
|
|
current-version: "3.215.0"
|
|
|
|
|
upstream-source: https://github.com/pulumi/pulumi/releases
|
|
|
|
|
notes: IaC CLI for tailscale and gandi stacks
|
|
|
|
|
|
|
|
|
|
- name: ty
|
|
|
|
|
type: mise
|
|
|
|
|
last-reviewed: 2026-04-12
|
|
|
|
|
current-version: "0.0.29"
|
|
|
|
|
upstream-source: https://github.com/astral-sh/ty/releases
|
|
|
|
|
notes: Astral Python typechecker (beta); prek hook
|