Update Terraform cloudflare to >= 5

.gitea/workflows/ci.yml

@@ -52,39 +52,3 @@ jobs:
             echo "==> $f"
             nomad job validate "$f"
           done
-
-  image-pull:
-    name: Docker image pull validation
-    runs-on: ubuntu-latest
-    # Only run on PRs that touch nomad job specs
-    if: github.event_name == 'pull_request'
-
-    steps:
-      - uses: actions/checkout@v4
-        with:
-          fetch-depth: 0
-
-      - name: Pull changed images
-        run: |
-          git fetch origin ${{ github.base_ref }}
-          IMAGES=$(git diff origin/${{ github.base_ref }}...HEAD -- '*.nomad.hcl' \
-            | grep '^+\s*image\s*=' \
-            | grep -oP '"[^"]+:[^"]+"' \
-            | tr -d '"' \
-            | sort -u || true)
-
-          if [ -z "$IMAGES" ]; then
-            echo "No image changes detected, skipping pull."
-            exit 0
-          fi
-
-          FAILED=0
-          while IFS= read -r image; do
-            echo "==> Pulling $image"
-            if ! docker pull "$image"; then
-              echo "ERROR: Failed to pull $image"
-              FAILED=1
-            fi
-          done <<< "$IMAGES"
-
-          exit $FAILED

2-nomad-config/.terraform.lock.hcl

@@ -17,18 +17,25 @@ provider "registry.terraform.io/carlpett/sops" {
 }
 
 provider "registry.terraform.io/cloudflare/cloudflare" {
-  version     = "5.5.0"
+  version     = "5.18.0"
-  constraints = "~> 5.0"
+  constraints = ">= 5.0.0"
   hashes = [
-    "h1:wZhU174xytOMZ1t6uDUQiLtR/XKpi2RH9OzMz0XqP9Q=",
+    "h1:2FKT5YVLuHLmv7BnFxDC3UtipD3hSSrb0iJ9Ei2C/ks=",
-    "zh:178f29dee2edac39252780819f34004b1841770c61ee7fb5a625afaece6495cd",
+    "h1:6FoKYTGqaCvKctMEm1Y1c06mmY3I04jhCBRXEYe6mcQ=",
-    "zh:6faf26203167ae20ca5c8ece4a8bb1c4187137505058fb7b1a4bd5095823e648",
+    "h1:AhWro37kF118sAjRjIZ27CuV6kFpg1d+XYDo/7diyjU=",
-    "zh:97c91a95819336b8c41618919786ddd2dca643d28219d52af1d80b88018c6eec",
+    "h1:B9eoAx4QKNVuKHDahNl8JzuSLCCeIGAJiS0MckJu5wQ=",
-    "zh:bbc53670fc2613e3fe81b5bf7b8674c5ad083a206fa8af34f0f055a8d06b2d01",
+    "h1:KfnaaT3RFoyWvPHsNVmsrCV7QEAGPLGNyHWT9IY+bxY=",
-    "zh:d305bcb01249ada21b80e5038e371f6ca0a60d95d7052df82456e4c4963f3bfc",
+    "h1:SPFFA6LxyFkjpEnpWbyQVyVJVXxzP8RLpehfUMRXDp4=",
-    "zh:e2f9db57ead7100676b790a3e4567d88443fae0e19127e66b3505210de93e4b5",
+    "h1:VMUOof+Cf2h4asIe2lin7Fvf15mGWQ9mQYiuGhYM1aw=",
-    "zh:eb8cef2e6cbf05237b8a2f229314ae12c792ed5f8f60fe180102bdf17dc30841",
+    "h1:ny17Q/ce8iuHxppA/yIuRpCkVDtqhE+LDynWtv9/qwI=",
-    "zh:f51a5bb0130d2f42772988ee56723f176aa230701184a0f5598dbb1c7b4c3906",
+    "zh:47e7bdfd8eddd2685f383269c0b6936ef62edd6d8383c8d7757b0cce0a689737",
+    "zh:aa23eb6aa128667883cabc449ceca4072d0181f574cd727e08ebd6d69a4bfd48",
+    "zh:c3da673e05d3bd933c82e2b6ba0f85aa23c5e24fadd3932f7c066314feeb65a3",
+    "zh:c59f07c017fc78b79e80554a0737c9db2a2e681c3e46ff637942d28d1f1a3924",
+    "zh:d559074612835a37fa684d8d7d0cf68911487b71f4067acc59069cb00bb8baf0",
+    "zh:e12290a4eda757c183a4258230245dd170f0def389c37eb771db144ce3b382dd",
+    "zh:ed47e484432ba1bbbb4802061f395ebd253ae8e20be9b72552d3d830fd2ca268",
+    "zh:f35e08d468408697b3e7c4a7f548b874141ac8f8d395ab8edded322201cc7047",
     "zh:f809ab383cca0a5f83072981c64208cbd7fa67e986a86ee02dd2c82333221e32",
   ]
 }

2-nomad-config/1-data/pgadmin.nomad.hcl

@@ -58,10 +58,8 @@ job "pgadmin" {
         ]
 
         check {
-          name     = "alive"
           type     = "http"
           path     = "/"
-          port     = "http"
           interval = "10s"
           timeout  = "2s"
         }

2-nomad-config/1-data/postgres.nomad.hcl

@@ -7,10 +7,6 @@ job "postgres" {
       connect {
         sidecar_service {}
       }
-
-      # Note: TCP checks are not valid for Connect-enabled services (runs through
-      # Envoy sidecar). Postgres is a single-writer DB that we never canary, so
-      # observable health via Consul is lower priority than other services.
     }
 
     task "postgres" {

2-nomad-config/2-ingress/authelia.nomad.hcl

@@ -33,10 +33,8 @@ job "authelia" {
       }
 
       check {
-        name     = "alive"
         type     = "http"
         path     = "/health"
-        port     = "http"
         interval = "10s"
         timeout  = "2s"
       }

2-nomad-config/2-ingress/main.tf

@@ -6,7 +6,7 @@ terraform {
     }
     cloudflare = {
       source  = "cloudflare/cloudflare"
-      version = "~> 5"
+      version = ">= 5"
     }
     postgresql = {
       source = "cyrilgdn/postgresql"

2-nomad-config/2-ingress/traefik.nomad.hcl

@@ -35,8 +35,7 @@ job "traefik" {
 
       check {
         name     = "alive"
-        type     = "http"
+        type     = "tcp"
-        path     = "/ping"
         port     = "api"
         interval = "10s"
         timeout  = "2s"
@@ -86,9 +85,6 @@ api:
   dashboard: true
   insecure: true
 
-ping:
-  entryPoint: traefik
-
 providers:
   file:
     directory: "/etc/traefik/configs/"

2-nomad-config/act-runner.nomad.hcl

@@ -29,6 +29,7 @@ job "act-runner" {
 
       env = {
         GITEA_INSTANCE_URL = "https://gitea-1ef0bea6b75a4fd3e9393a9f7f7e4b02.othrayte.one"
+        CONFIG_FILE        = "/secrets/runner-config.yml"
       }
 
       # Required SOPS key:
@@ -42,6 +43,19 @@ EOF
         env         = true
       }
 
+      # Limit which images/labels the runner will accept so it doesn't pick up
+      # unrelated workloads if more runners are added later.
+      template {
+        data        = <<EOF
+runner:
+  labels:
+    - "ubuntu-latest:docker://node:20-bookworm"
+    - "ubuntu-22.04:docker://node:20-bookworm"
+    - "ubuntu-24.04:docker://node:20-bookworm"
+EOF
+        destination = "secrets/runner-config.yml"
+      }
+
       resources {
         cpu        = 200
         memory     = 256

2-nomad-config/deluge.nomad.hcl

@@ -54,10 +54,8 @@ EOH
       ]
 
       check {
-        name     = "alive"
         type     = "http"
         path     = "/"
-        port     = "http"
         interval = "10s"
         timeout  = "2s"
       }
@@ -80,10 +78,8 @@ EOH
       }
 
       check {
-        name     = "alive"
         type     = "http"
         path     = "/"
-        port     = "http"
         interval = "10s"
         timeout  = "2s"
       }

2-nomad-config/gitea.nomad.hcl

@@ -32,10 +32,8 @@ job "gitea" {
       ]
 
       check {
-        name     = "alive"
         type     = "http"
-        path     = "/api/healthz"
+        path     = "/"
-        port     = "http"
         interval = "10s"
         timeout  = "2s"
       }

2-nomad-config/glance.nomad.hcl

@@ -12,7 +12,7 @@ job "glance" {
       driver = "docker"
 
       config {
-        image = "glanceapp/glance:v0.7.8"
+        image = "glanceapp/glance:latest"
         ports = ["http"]
         volumes = [
           "local/glance.yml:/app/config/glance.yml",
@@ -30,8 +30,7 @@ job "glance" {
 
         check {
           name     = "alive"
-          type     = "http"
+          type     = "tcp"
-          path     = "/"
           port     = "http"
           interval = "10s"
           timeout  = "2s"

2-nomad-config/jellyfin.nomad.hcl

@@ -28,11 +28,10 @@ job "jellyfin" {
 
         check {
           name     = "alive"
-          type     = "http"
+          type     = "tcp"
-          path     = "/health"
           port     = "http"
           interval = "10s"
-          timeout  = "5s"
+          timeout  = "2s"
         }
       }
 

2-nomad-config/main.tf

@@ -12,7 +12,7 @@ terraform {
     }
     cloudflare = {
       source  = "cloudflare/cloudflare"
-      version = "~> 5"
+      version = ">= 5"
     }
     postgresql = {
       source = "cyrilgdn/postgresql"

2-nomad-config/ntfy.nomad.hcl

@@ -33,10 +33,8 @@ job "ntfy" {
       ]
 
       check {
-        name     = "alive"
         type     = "http"
         path     = "/healthz"
-        port     = "http"
         interval = "10s"
         timeout  = "2s"
       }

2-nomad-config/openreader.nomad.hcl

@@ -31,10 +31,8 @@ job "openreader" {
       ]
 
       check {
-        name     = "alive"
         type     = "http"
         path     = "/"
-        port     = "http"
         interval = "10s"
         timeout  = "2s"
       }
@@ -50,10 +48,8 @@ job "openreader" {
       }
 
       check {
-        name     = "alive"
         type     = "http"
         path     = "/"
-        port     = "http"
         interval = "10s"
         timeout  = "2s"
       }

2-nomad-config/prowlarr.nomad.hcl

@@ -34,9 +34,8 @@ job "prowlarr" {
       ]
 
       check {
-        name     = "alive"
         type     = "http"
-        path     = "/ping"
+        path     = "/"
         interval = "10s"
         timeout  = "2s"
       }
@@ -52,9 +51,8 @@ job "prowlarr" {
       }
 
       check {
-        name     = "alive"
         type     = "http"
-        path     = "/ping"
+        path     = "/"
         interval = "10s"
         timeout  = "2s"
       }

2-nomad-config/sonarr.nomad.hcl

@@ -37,9 +37,8 @@ job "sonarr" {
       ]
 
       check {
-        name     = "alive"
         type     = "http"
-        path     = "/ping"
+        path     = "/"
         interval = "10s"
         timeout  = "2s"
       }
@@ -55,9 +54,8 @@ job "sonarr" {
       }
 
       check {
-        name     = "alive"
         type     = "http"
-        path     = "/ping"
+        path     = "/"
         interval = "10s"
         timeout  = "2s"
       }

2-nomad-config/transfer.nomad.hcl

@@ -16,10 +16,8 @@ job "transfer" {
       ]
 
       check {
-        name     = "alive"
         type     = "http"
         path     = "/"
-        port     = "http"
         interval = "10s"
         timeout  = "2s"
       }

2-nomad-config/unifi.nomad.hcl

@@ -21,26 +21,6 @@ job "unifi-network" {
         UNIFI_STDOUT       = "true"
       }
 
-      # Register in Consul so Traefik and health checks can find it.
-      # address_mode=driver uses the macvlan IP (192.168.1.50) rather than the host IP.
-      service {
-        name         = "unifi-network"
-        port         = 8443
-        address_mode = "driver"
-
-        # TCP/HTTP checks from the Consul agent can't reach the macvlan IP (host↔macvlan
-        # isolation). Use a script check instead — it runs inside the container via
-        # docker exec and connects to localhost:8443 directly.
-        check {
-          name     = "alive"
-          type     = "script"
-          command  = "/usr/bin/curl"
-          args     = ["-sk", "--max-time", "5", "-o", "/dev/null", "https://localhost:8443"]
-          interval = "30s"
-          timeout  = "10s"
-        }
-      }
-
       volume_mount {
         volume      = "unraid_appdata_unifi_network"
         destination = "/unifi" # Expected root directory (contains data, log, cert subdirs)

archive/1-coreos/2-install-coreos/.terraform.lock.hcl

@@ -2,34 +2,23 @@
 # Manual edits may be lost in future updates.
 
 provider "registry.terraform.io/dmacvicar/libvirt" {
-  version     = "0.9.8"
+  version     = "0.7.6"
-  constraints = "0.9.8"
+  constraints = "0.7.6"
   hashes = [
-    "h1:/9TSq9ibeojseTyT6Jx3z/dbvT5uw8ka3/18NKonrQc=",
+    "h1:mmbm4vTyC/DCGO4Ed/vbp5AKvy1gmVn/94fzB9VmR08=",
-    "h1:BN5hy1RaHlpcV0BDJYrSOEklK4YNdZCpiXOOGn0ce9k=",
+    "zh:0bde54f6f658b20b620b875daf106b5b25b1bae4d15408d6c5f06d58360e254d",
-    "h1:MNJ6dcFru4DwQM7maIUAADJIHn3aF+L8XsnRJlleNaM=",
+    "zh:0c97c6930015918b8a34b6d7a2b0c3d17a649c226fcd1874fcba5bbbc0f35972",
-    "h1:P1Cx0VZGTe6cpWpQ4JFOPJJb+Z+N50t4e1VA76T1tAA=",
+    "zh:1bdd7aa0011c5f024a09a124836ee9bc8e71b05a6ece810c61824275fd3f695f",
-    "h1:Pm9du7Rzsg1bhLq+XnW9VaLSjTu0Yytr9AOdP9FLQvM=",
+    "zh:2b0cc7c794e4caf395d84ffff0b380d17e4b3219a4696264271bfe5059450efe",
-    "h1:Q/JvNhRskJqDKPJoO9DW3+Ons3mk8kc++zlT4TucyFw=",
+    "zh:2f8633f7fe07f76c188836ed6f93321ec5fbf5c004bc7699e1741d9b21ed5f37",
-    "h1:Tzk+wRzhboY3F3wB1u0y3ySMMd4ZPtJbOYlTbbkxZc0=",
+    "zh:5bf47eed286ce55ed10a5cf657de49a34ab21cc8677c56fef3aab69cdde41a27",
-    "h1:Uuk8gkDEzmXfOTW/nm8GMG2aen7n/+X5GsTAf7eVRJc=",
+    "zh:7dca790fc5fd1d42bc4bc7170be003a7093602026d0f95c8aab84ad551fdf2a4",
-    "h1:cRBlnB/TG4+l0y0i42QLU0JoLDBxxJEwCguLXS9Rv8A=",
+    "zh:80476b68bc84e3d661d1390025f83879b88f9cdc836de9751af09bd5716089cb",
-    "h1:jn+hA9lIJzH5T0550IaKNsHxEAbyTGtvYWm02JCxexM=",
+    "zh:82f3e2f3f50176cd6041c8ba36e295cbda1b289ef52ab75b5eceb0f921f64f7b",
-    "h1:pKAwAcCGEwsKvVy5eIxdmb1gLhTTxB0xGVi8/jqj0uI=",
+    "zh:a179b165f3b9bb9a67ebbbf9d73157ded33f02d476b2f58906389dca03b653c9",
-    "h1:wS5VlGinhpnMCva0tKwLRPRQxmMUl80L05AueWshzNg=",
+    "zh:acae54a5d0616f22b3180ddd8e8aad39af664e604394fdacf1f7b337bca2d5b4",
-    "h1:yqZeKoJ+EZc3687/+ZBqBmtwzvBPLNwaEHW74+bSc6Y=",
+    "zh:da4406a2428a9a7e98272c032cb93431c3919253af2fe9934b532d26c0deab09",
-    "zh:061e5187853729e1d8ba20938402ad6e778b4097436925d0bef7741c8aa26ee1",
+    "zh:f63dbd8e579ab5268d01ffab4503b8a8e736b70d1a04e4f271559ba8dd133dcd",
-    "zh:69a2ac8ee0cb0c1581bdc9a1296d89abcd1808229ff0a2fa20678ba4f7472944",
+    "zh:f85c1d9e51a94ecde137435c9d6b0fb7be590437ea8a725334d1577eebbc550c",
-    "zh:8b02bf349191b4e7d9529d620da9e9265de5bd01d6983bb079589acdf80dda7a",
-    "zh:9620872ed1da1ff421e85dd4ba2a110c284f3f0d06369c36a9aa75d501155fad",
-    "zh:9ae7c932b7fb6f62ff20b863a15a7cd713415faa4c789472dc403062808366cb",
-    "zh:a369c3e271b49e085940e6181fe6c1086c2126eebf5c7ad2b1db8fc8792dd30c",
-    "zh:a45ad97d7192bea104b32521839dd705a330f13364cf1007dc912b6a0b6be3c8",
-    "zh:b69f2a13ff688ad4b79e14deb6ef6341187864f50960bc0fd9c682f6077b4318",
-    "zh:c20b467ff0ac76431a7bdb99662b9414b922ea603327509518c0179416cdfea3",
-    "zh:c22d45913bd1f00a33d1a4b80547e4a2854409a298a0868c1730124f03a210ad",
-    "zh:cf82bb14884fcbdcd57620cee248994b1633ea246fa49fd668d2f1739abb982d",
-    "zh:ddc1cb4417206dd46eb22c3b81204b3a5edda03c4436e6a5914d541fcfd4c27f",
-    "zh:e6b1983b8f1b9658448d0d09635619cc75dde314e6b4d7fd16d827f9e4bdb767",
   ]
 }

archive/1-coreos/2-install-coreos/vm-test-moons.tf

@@ -2,7 +2,7 @@ terraform {
   required_providers {
     libvirt = {
       source = "dmacvicar/libvirt"
-      version = "0.9.8"
+      version = "0.7.6"
     }
   }
 }

cicd-plan.md

@@ -188,8 +188,8 @@ Most jobs already have Consul health checks — these can use `health_check = "c
 | frigate    | ✅            | ✅ `single-node-writer` | ⚠️ same — rolling                                                                 |
 | glance     | ✅            | no                      | ✅ yes                                                                            |
 | transfer   | ✅            | ✅ `single-node-writer` | ⚠️ rolling                                                                        |
-| openreader | ✅ `/`        | ✅ `single-node-writer` | ⚠️ rolling                                                                        |
+| openreader | ❌            | ✅ `single-node-writer` | ⚠️ add check first, then rolling                                                  |
-| unifi      | ✅ script     | ✅ `single-node-writer` | ⚠️ rolling                                                                        |
+| unifi      | ❌            | ✅ `single-node-writer` | ⚠️ add check first, then rolling                                                  |
 | traefik    | (ingress)     | ✅                      | ⚠️ rolling — downtime risk, promote quickly                                       |
 | authelia   | (ingress)     | ✅                      | ✅ stateless config, canary fine                                                  |
 | renovate   | batch job     | n/a                     | n/a — no deployment model                                                         |
@@ -296,10 +296,10 @@ exit 1
 - [x] **Phase 1a**: Create `act-runner.nomad.hcl` + Terraform wrapper, register runner token in Gitea, get a hello-world workflow green
 - [x] **Phase 1b**: Add `terraform fmt` + `terraform validate -backend=false` workflow — no secrets needed
 - [x] **Phase 1c**: Add Nomad validate step — add `NOMAD_ADDR` + read-only `NOMAD_TOKEN` to Gitea secrets
-- [x] **Phase 2**: Add image pull validation step to the workflow
+- [ ] **Phase 2**: Add image pull validation step to the workflow
 - [ ] **Phase 3a**: Add `update` stanzas to ntfy and glance (simplest, no volume conflict)
-- [ ] **Phase 3b**: Add rolling `update` stanzas to remaining service jobs (jellyfin, sonarr, prowlarr, deluge, gitea, immich, transfer, frigate, openreader, unifi, authelia, traefik)
+- [ ] **Phase 3b**: Add rolling `update` stanzas to remaining service jobs (jellyfin, sonarr, etc.)
-- [x] **Phase 3c**: Add health checks to openreader and unifi before adding update stanzas
+- [ ] **Phase 3c**: Add health checks to openreader and unifi before adding update stanzas
 - [ ] **Phase 4a**: Add on-push workflow that runs `terraform apply -auto-approve` using full credential set
 - [ ] **Phase 4b**: Add deployment promotion/revert polling script
 - [ ] **Phase 4c**: Wire ntfy notifications for promote/revert outcomes