eblume/blumeops
1
1
Fork 0
Code Issues Pull requests Projects Releases 83 Packages Wiki Activity Actions
blumeops/service-versions.yaml
Erich Blume 292d354902
All checks were successful
Deploy Fly.io Proxy / deploy (push) Successful in 1m12s
Details
C1: deploy adelaide-baby-shower-app to ringtail k3s (#349) 
## Summary

Brings up the Adelaide / Heidi / Addie baby shower app on ringtail k3s with the public/private split that the app's hosting contract calls for: `shower.eblu.me` (public, via Fly proxy) and `shower.ops.eblu.me` (tailnet). App is consumed as a wheel from the Forgejo PyPI index — source lives at [`adelaide-baby-shower-app`](https://forge.eblu.me/eblume/adelaide-baby-shower-app).

### What's included

- **ArgoCD app + manifests** under `argocd/manifests/shower/` (deployment, service, ProxyGroup ingress, ConfigMap for `DJANGO_DEBUG`/`DJANGO_ADMIN_URL`, ExternalSecret for `DJANGO_SECRET_KEY` from 1Password item `Shower (blumeops)`, NFS PV on sifaka, RWX media PVC, RWO local-path data PVC for SQLite). Recreate rollout because SQLite is single-writer.
- **Public surface** (`fly/`): new `shower.eblu.me` server block proxying to `shower.ops.eblu.me`. `/admin/` returns 403 at the edge except `/admin/login/` and `/admin/logout/`, which are rate-limited via a new `shower_auth` zone. `X-Clacks-Overhead` on. GNU Terry Pratchett.
- **fail2ban** filter (`shower-admin-login.conf`) matching 401/403/429 on `/admin/login/` and jail (`shower.conf`) with `maxretry=5/findtime=600/bantime=3600`. The `nginx-deny` action was generalized to take a per-jail `nginx_deny_file` so the shower has its own deny list (forge keeps using the legacy default).
- **Caddy** route on indri (`shower.ops.eblu.me` → `https://shower.tail8d86e.ts.net`).
- **Pulumi** Gandi CNAME `shower.eblu.me → blumeops-proxy.fly.dev.`.
- **Grafana** APM dashboard `configmap-shower-apm.yaml` (request rate, error rate, failed admin login count, latency percentiles, bandwidth, access logs) mirroring `docs-apm.json` with a `host="shower.eblu.me"` filter.
- **Container** `containers/shower/default.nix` — `dockerTools.buildLayeredImage` with a nixpkgs Python and a startup wrapper that creates `/app/data/.venv`, pip-installs `adelaide-baby-shower-app==1.0.0` from the forge PyPI index on first boot, runs migrations + collectstatic, and execs gunicorn. A `local_settings.py` shim pins `DATABASES.NAME`/`MEDIA_ROOT`/`STATIC_ROOT` to absolute paths so they don't end up in site-packages.
- **Docs** runbook at `docs/how-to/operations/shower-app.md` linked from the apps registry, plus changelog fragments.

### Defense layers on the public surface

1. fly nginx geo+fail2ban `$shower_banned` (per-service deny list)
2. fly nginx `limit_req zone=shower_auth` (3 r/s per Fly-Client-IP)
3. django-axes (5 fails / 1h, keyed on username+ip_address)
4. edge `/admin/` block (returns 403 for anything that isn't login/logout)

## Prerequisites for the user to do (NOT in this PR)

Halted on these per request — they touch shared/manual systems:

- [x] **NFS share** on sifaka: `/volume1/shower`, NFS rule for ringtail RW, `chown 1000:1000`
- [ ] **1Password item** `Shower (blumeops)` in the blumeops vault with a freshly minted `secret-key` field (`openssl rand -base64 48`) — do NOT reuse anything that has lived in git
- [ ] **Container build**: `mise run container-build-and-release shower`, then update `images[].newTag` in `argocd/manifests/shower/kustomization.yaml` to the resulting `v1.0.0-<sha>-nix`
- [x] **DNS**: `mise run dns-up` after merge
- [x] **Fly cert**: `fly certs add shower.eblu.me -a blumeops-proxy`
- [ ] **Caddy push**: `mise run provision-indri -- --tags caddy`
- [ ] **Fly redeploy** to pick up the new nginx block + fail2ban jail: `mise run fly-deploy`
- [ ] **ArgoCD sync**: `argocd app set shower --revision shower-app-deploy && argocd app sync shower` to test from this branch before merging

## Test plan

- [ ] Container builds successfully on nix-container-builder runner
- [ ] Pod starts, migrations run, gunicorn answers on :8000
- [ ] `kubectl --context=k3s-ringtail -n shower logs deploy/shower` clean
- [ ] `curl -sf https://shower.ops.eblu.me/` returns the splash page (tailnet)
- [ ] `curl -I -H "Host: shower.eblu.me" https://blumeops-proxy.fly.dev/` returns 200 (pre-DNS verification)
- [ ] `curl -I -H "Host: shower.eblu.me" https://blumeops-proxy.fly.dev/admin/users/` returns 403 (edge block)
- [ ] `curl -I -H "Host: shower.eblu.me" https://blumeops-proxy.fly.dev/admin/login/` returns a Django login response
- [ ] After DNS is up: `curl -I https://shower.eblu.me/` returns 200 with `X-Clacks-Overhead`
- [ ] Grafana dashboard "Shower APM" appears and starts showing traffic
- [ ] `mise run services-check` passes

Reviewed-on: #349
2026-05-11 13:47:18 -07:00

468 lines
15 KiB
YAML
Raw Blame History

# Service / Tooling/ Application Version Tracking
#
# Tracks when each BlumeOps service was last reviewed for version freshness.
# Used by `mise run service-review` to surface stale services.
#
# Fields:
# name - kebab-case service identifier
# type - argocd | ansible | nixos | fly | mise
# last-reviewed - date (YYYY-MM-DD) or null
# current-version - deployed version string or null
# upstream-source - URL to upstream releases/changelog
# notes - optional context
services:
- name: prometheus
type: argocd
last-reviewed: 2026-03-18
current-version: "v3.10.0"
upstream-source: https://github.com/prometheus/prometheus/releases
- name: loki
type: argocd
last-reviewed: 2026-03-20
current-version: "3.6.7"
upstream-source: https://github.com/grafana/loki/releases
- name: kube-state-metrics
type: argocd
last-reviewed: 2026-03-22
current-version: "v2.18.0"
upstream-source: https://github.com/kubernetes/kube-state-metrics/releases
- name: ntfy
type: argocd
last-reviewed: 2026-03-23
current-version: "v2.19.2"
upstream-source: https://github.com/binwiederhier/ntfy/releases
- name: homepage
type: argocd
last-reviewed: 2026-03-26
current-version: "v1.11.0"
upstream-source: https://github.com/gethomepage/homepage/releases
notes: Custom container, kustomize manifests
- name: shower
type: argocd
last-reviewed: 2026-05-10
current-version: "1.0.2"
upstream-source: https://forge.eblu.me/eblume/adelaide-baby-shower-app
notes: |
Django app for Adelaide / Heidi / Addie's baby shower. Wheel
published to Forgejo Packages PyPI; runs on ringtail k3s. Public
at shower.eblu.me (fly proxy), tailnet admin at shower.ops.eblu.me.
- name: nvidia-device-plugin
type: argocd
last-reviewed: 2026-03-27
current-version: "v0.19.0"
upstream-source: https://github.com/NVIDIA/k8s-device-plugin/releases
notes: DaemonSet + RuntimeClass on ringtail for GPU workloads
- name: frigate
type: argocd
last-reviewed: 2026-03-24
current-version: "0.17.1"
upstream-source: https://github.com/blakeblackshear/frigate/releases
- name: frigate-notify
type: argocd
last-reviewed: 2026-03-28
current-version: "v0.5.4"
upstream-source: https://github.com/0x2142/frigate-notify/releases
- name: tempo
type: argocd
last-reviewed: 2026-04-02
current-version: "2.10.3"
upstream-source: https://github.com/grafana/tempo/releases
notes: Home-built container from forge mirror
- name: alloy-tracing-ringtail
type: argocd
last-reviewed: 2026-04-30
current-version: "v1.16.0"
upstream-source: https://github.com/grafana/alloy/releases
notes: Privileged DaemonSet with Beyla eBPF for HTTP tracing on ringtail
- name: alloy-ringtail
type: argocd
last-reviewed: 2026-04-30
current-version: "v1.16.0"
upstream-source: https://github.com/grafana/alloy/releases
notes: DaemonSet on ringtail for host metrics and pod logs
- name: alloy-k8s
type: argocd
last-reviewed: 2026-04-30
current-version: "v1.16.0"
upstream-source: https://github.com/grafana/alloy/releases
- name: tailscale-operator
type: argocd
last-reviewed: 2026-03-22
current-version: "v1.94.2"
upstream-source: https://github.com/tailscale/tailscale/releases
- name: tailscale
type: container
last-reviewed: 2026-05-10
current-version: "1.94.2"
upstream-source: https://github.com/tailscale/tailscale/releases
notes: |
Locally mirrored tailscale image used by ringtail's tailscale-operator
ProxyClass. Built via containers/tailscale/default.nix.
- name: grafana
type: argocd
last-reviewed: 2026-04-02
current-version: "12.4.2"
upstream-source: https://github.com/grafana/grafana/releases
notes: Home-built container from Alpine; upgraded from Helm to Kustomize
- name: grafana-sidecar
type: argocd
parent: grafana
last-reviewed: "2026-04-13"
current-version: "2.6.0"
upstream-source: https://github.com/kiwigrid/k8s-sidecar/releases
notes: Dashboard ConfigMap watcher sidecar in grafana deployment
- name: cloudnative-pg
type: argocd
last-reviewed: 2026-03-28
current-version: "v1.28.1"
upstream-source: https://github.com/cloudnative-pg/cloudnative-pg/releases
notes: Deployed via Helm chart (chart v0.27.1 from forge mirror)
- name: immich
type: argocd
last-reviewed: 2026-04-04
current-version: "v2.6.3"
upstream-source: https://github.com/immich-app/immich/releases
notes: Kustomize manifests with upstream images
- name: valkey
type: argocd
last-reviewed: 2026-05-01
current-version: "8.1.6-r0"
upstream-source: https://pkgs.alpinelinux.org/package/v3.22/community/aarch64/valkey
notes: >-
Shared Alpine-built valkey image, used as a sidecar/cache by paperless
(sidecar) and immich (separate Deployment). Mirrors the upstream
docker.io/valkey/valkey:8.1-alpine. Pinned to Alpine 3.22 for valkey 8.1.x;
Alpine 3.23 jumps to 9.0. Distinct from authentik-redis (nix-built Redis
8.x) which has its own entry.
- name: external-secrets
type: argocd
last-reviewed: 2026-03-25
current-version: "v2.2.0"
upstream-source: https://github.com/external-secrets/external-secrets/releases
notes: Static kustomize manifests rendered from upstream Helm chart
- name: 1password-connect
type: argocd
last-reviewed: 2026-04-06
current-version: "1.8.2"
upstream-source: https://hub.docker.com/r/1password/connect-api/tags
notes: Kustomize manifests rendered from connect-helm-charts v2.4.1
- name: argocd
type: argocd
last-reviewed: 2026-04-07
current-version: "v3.3.6"
upstream-source: https://github.com/argoproj/argo-cd/releases
notes: Kustomize-based install with ServerSideApply
- name: blumeops-pg
type: argocd
last-reviewed: 2026-03-28
current-version: "18.3"
upstream-source: https://github.com/cloudnative-pg/cloudnative-pg/releases
notes: CloudNativePG Cluster resource; pinned to PG minor version
- name: authentik
type: argocd
last-reviewed: "2026-04-08"
current-version: "2026.2.2"
upstream-source: https://github.com/goauthentik/authentik/releases
- name: authentik-redis
type: argocd
parent: authentik
last-reviewed: "2026-03-24"
current-version: "8.2.3"
upstream-source: https://github.com/redis/redis/releases
notes: >-
Attached service: Redis cache/broker for Authentik (sessions, Celery task
queue, caching). Nix-built container from nixpkgs with version assertion.
- name: ollama
type: argocd
last-reviewed: "2026-04-09"
current-version: "0.20.4"
upstream-source: https://github.com/ollama/ollama/releases
notes: LLM inference server on ringtail (GPU); upstream container image
- name: navidrome
type: argocd
last-reviewed: 2026-04-11
current-version: "v0.61.1"
upstream-source: https://github.com/navidrome/navidrome/releases
- name: miniflux
type: argocd
last-reviewed: 2026-04-12
current-version: "2.2.19"
upstream-source: https://github.com/miniflux/v2/releases
- name: teslamate
type: argocd
last-reviewed: 2026-04-14
current-version: "v3.0.0"
upstream-source: https://github.com/teslamate-org/teslamate/releases
- name: transmission
type: argocd
last-reviewed: 2026-04-15
current-version: "4.1.1-r1"
upstream-source: https://github.com/transmission/transmission/releases
- name: transmission-exporter
type: argocd
last-reviewed: 2026-04-15
current-version: "1.0.1"
upstream-source: null
notes: Homegrown Python exporter, no upstream
- name: kiwix
type: argocd
last-reviewed: 2026-04-17
current-version: "3.8.2"
upstream-source: https://github.com/kiwix/kiwix-tools/releases
- name: devpi
type: ansible
last-reviewed: 2026-04-29
current-version: "6.19.3"
upstream-source: https://github.com/devpi/devpi/releases
notes: Installed via uv into a venv on indri; version pinned in ansible/roles/devpi/defaults/main.yml
- name: cv
type: ansible
last-reviewed: 2026-04-29
current-version: "1.0.3"
upstream-source: https://forge.eblu.me/eblume/cv
notes: >-
Static tarball downloaded by ansible/roles/cv into ~/blumeops/cv/content on indri;
served directly by Caddy (kind=static). Migrated from minikube 2026-04-29.
Review build deps (WeasyPrint, Jinja2) in source repo on upstream review.
- name: docs
type: ansible
last-reviewed: 2026-04-29
current-version: "v1.16.0"
upstream-source: https://forge.eblu.me/eblume/blumeops/releases
notes: >-
Quartz-built tarball downloaded by ansible/roles/docs into ~/blumeops/docs/content
on indri; served directly by Caddy (kind=static, try_html). current-version
tracks the blumeops docs release tag.
- name: forgejo-runner
type: argocd
last-reviewed: 2026-04-20
current-version: "12.8.2"
upstream-source: https://code.forgejo.org/forgejo/runner/releases
notes: >-
Runner daemon version (code.forgejo.org/forgejo/runner). Job execution
image is tracked separately as runner-job-image.
- name: runner-job-image
type: argocd
last-reviewed: 2026-04-21
current-version: "0.20.6"
upstream-source: https://github.com/dagger/dagger/releases
notes: >-
Forgejo Actions job execution image. CONTAINER_APP_VERSION tracks the
Dagger CLI version, the primary build tool in the image.
- name: nix-container-builder
type: nixos
last-reviewed: 2026-04-01
current-version: "12.7.2"
upstream-source: https://code.forgejo.org/forgejo/runner/releases
notes: >-
Forgejo runner on ringtail; pinned via nixpkgs-services overlay in flake.nix.
Update nixpkgs-services rev during service reviews, not via nix flake update.
- name: snowflake-proxy
type: nixos
last-reviewed: 2026-04-01
current-version: "2.11.0"
upstream-source: https://gitlab.torproject.org/tpo/anti-censorship/pluggable-transports/snowflake/-/releases
notes: >-
Tor Snowflake proxy on ringtail; pinned via nixpkgs-services overlay in flake.nix.
Anti-censorship bridge, not an exit node.
- name: k3s
type: nixos
last-reviewed: 2026-04-01
current-version: "1.34.5+k3s1"
upstream-source: https://github.com/k3s-io/k3s/releases
notes: >-
Single-node k3s cluster on ringtail; pinned via nixpkgs-services overlay in flake.nix.
Update nixpkgs-services rev during service reviews.
- name: minikube
type: ansible
last-reviewed: 2026-04-01
current-version: "1.38.0"
upstream-source: https://github.com/kubernetes/minikube/releases
notes: >-
Single-node minikube on indri; installed via homebrew (not version-pinned).
Homebrew may silently upgrade on brew update/upgrade.
- name: mealie
type: argocd
last-reviewed: 2026-03-16
current-version: "v3.12.0"
upstream-source: https://github.com/mealie-recipes/mealie/releases
notes: Recipe manager; built from source via forge mirror
- name: paperless
type: argocd
last-reviewed: "2026-04-08"
current-version: "v2.20.13"
upstream-source: https://github.com/paperless-ngx/paperless-ngx/releases
notes: Document management; built from source via forge mirror
- name: unpoller
type: argocd
last-reviewed: 2026-03-16
current-version: "v2.34.0"
upstream-source: https://github.com/unpoller/unpoller/releases
notes: UniFi metrics exporter for Prometheus
- name: prowler
type: argocd
last-reviewed: 2026-04-14
current-version: "5.23.0"
upstream-source: https://github.com/prowler-cloud/prowler/releases
notes: CIS Kubernetes Benchmark scanner; weekly CronJob on minikube-indri
- name: kingfisher
type: argocd
last-reviewed: 2026-03-29
current-version: "165768b"
upstream-source: https://github.com/mongodb/kingfisher/releases
notes: Secret scanner; sporked from upstream with --clone-url-base patch. Version is upstream main SHA.
- name: forgejo
type: ansible
last-reviewed: 2026-03-28
current-version: "14.0.3"
upstream-source: https://codeberg.org/forgejo/forgejo/releases
notes: Built from source on indri (~/code/3rd/forgejo)
- name: alloy
type: ansible
last-reviewed: 2026-04-30
current-version: "v1.16.0"
upstream-source: https://github.com/grafana/alloy/releases
notes: Built from source on indri
- name: zot
type: ansible
last-reviewed: 2026-05-04
current-version: "v2.1.16"
upstream-source: https://github.com/project-zot/zot/releases
notes: Built from source on indri
- name: caddy
type: ansible
last-reviewed: 2026-05-06
current-version: "v2.11.2"
upstream-source: https://github.com/caddyserver/caddy/releases
notes: Built from source with Gandi DNS and Layer 4 plugins
- name: borgmatic
type: ansible
last-reviewed: 2026-04-15
current-version: "2.1.4"
upstream-source: https://github.com/borgmatic-collective/borgmatic/releases
notes: Installed via mise (pipx); version pinned in ansible/roles/borgmatic/defaults/main.yml and mise.toml
- name: jellyfin
type: ansible
last-reviewed: 2026-03-17
current-version: "10.11.6"
upstream-source: https://github.com/jellyfin/jellyfin/releases
- name: automounter
type: ansible
last-reviewed: 2026-03-17
current-version: "1.11.0"
upstream-source: https://www.pixeleyes.co.nz/automounter/
notes: Mac App Store app, no Ansible role. Updates via App Store.
- name: flyio-tailscale
type: fly
last-reviewed: "2026-04-10"
current-version: "v1.94.1"
upstream-source: https://github.com/tailscale/tailscale/releases
notes: >-
Pinned after v1.96.5 broke MagicDNS in containers. Test DNS resolution
inside Fly container before upgrading. COPY --from in fly/Dockerfile.
- name: flyio-nginx
type: fly
last-reviewed: "2026-04-10"
current-version: "1.29.6-alpine"
upstream-source: https://hub.docker.com/_/nginx
notes: Base image for Fly proxy (fly/Dockerfile)
- name: flyio-alloy
type: fly
parent: flyio-nginx
last-reviewed: "2026-04-10"
current-version: "v1.14.1"
upstream-source: https://github.com/grafana/alloy/releases
notes: COPY --from in fly/Dockerfile for log shipping and metrics
- name: dagger
type: mise
last-reviewed: 2026-04-21
current-version: "0.20.6"
upstream-source: https://github.com/dagger/dagger/releases
notes: Dagger CI/CD engine; pinned in mise.toml
- name: ansible-core
type: mise
last-reviewed: 2026-04-12
current-version: "2.20.1"
upstream-source: https://github.com/ansible/ansible/releases
notes: Installed via pipx/uvx with botocore and boto3
- name: prek
type: mise
last-reviewed: 2026-04-12
current-version: "0.3.4"
upstream-source: https://github.com/j178/prek/releases
notes: Pre-commit hook runner (Rust reimplementation)
- name: pulumi-cli
type: mise
last-reviewed: 2026-04-12
current-version: "3.215.0"
upstream-source: https://github.com/pulumi/pulumi/releases
notes: IaC CLI for tailscale and gandi stacks
- name: ty
type: mise
last-reviewed: 2026-04-12
current-version: "0.0.29"
upstream-source: https://github.com/astral-sh/ty/releases
notes: Astral Python typechecker (beta); prek hook
Reference in a new issue View git blame Copy permalink