Add renovate.json

2-nomad-config/codeproject-ai.nomad.hcl

@@ -0,0 +1,97 @@
+job "codeproject-ai" {
+  # Pin to N150 LattePanda nodes for their Intel UHD iGPU (OpenVINO) and dedicated CPU headroom.
+  # The node_class is set via the node.tf/configuration.nix templates in 1-nixos-node.
+  constraint {
+    attribute = "${node.class}"
+    value     = "latte-panda-n150"
+  }
+
+  group "codeproject-ai" {
+    count = 1
+
+    network {
+      port "http" {
+        to = 32168
+      }
+    }
+
+    task "codeproject-ai" {
+      driver = "docker"
+
+      config {
+        image = "codeproject/ai-server:latest"
+        ports = ["http"]
+
+        # Pass the Intel iGPU render nodes so CPAI can accelerate inference
+        # via OpenVINO on the N150's Intel UHD Graphics.
+        # Requires hardware.graphics.enable = true in the NixOS node config
+        # (added automatically when node_class = "latte-panda-n150").
+        devices = [
+          {
+            host_path      = "/dev/dri"
+            container_path = "/dev/dri"
+          }
+        ]
+      }
+
+      service {
+        name = "codeproject-ai"
+        port = "http"
+
+        tags = [
+          "traefik.enable=true",
+          # Auth-gated user-facing UI at codeproject-ai.othrayte.one (generated by defaultRule).
+          "traefik.http.routers.codeproject-ai.middlewares=auth@file",
+          # No-auth bypass for external Frigate access until Frigate moves into the cluster
+          # and can reach the service via Consul DNS directly.
+          "traefik.http.routers.codeproject-ai-token.rule=Host(`c3ll7nbevl5j4j8rcnfxnr95q48fuayz-codeproject-ai.othrayte.one`)",
+        ]
+
+        check {
+          name     = "alive"
+          type     = "http"
+          path     = "/v1/server/status/ping"
+          method   = "GET"
+          port     = "http"
+          interval = "10s"
+          timeout  = "5s"
+        }
+      }
+
+      env {
+        TZ = "Australia/Melbourne"
+      }
+
+      # Persistent storage for downloaded AI modules and their models.
+      # On first start CPAI will download ~1-2 GB of YOLOv5/MobileNet weights
+      # into this volume; subsequent restarts reuse the cached models.
+      volume_mount {
+        volume      = "unraid_appdata_codeproject_ai"
+        destination = "/etc/codeproject/ai"
+        read_only   = false
+      }
+
+      resources {
+        # ~56% of the N150's 7200 MHz allocation - enough for concurrent
+        # object detection requests without starving other jobs on the node.
+        cpu = 4000
+        # YOLOv5-6.2 (default detection module) needs ~900 MB;
+        # leave headroom for a second module (e.g. face detection) and the
+        # CPAI process itself.
+        memory = 3072
+      }
+    }
+
+    volume "unraid_appdata_codeproject_ai" {
+      type            = "csi"
+      read_only       = false
+      source          = "unraid_appdata_codeproject_ai"
+      access_mode     = "single-node-writer"
+      attachment_mode = "file-system"
+
+      mount_options {
+        mount_flags = ["uid=1000", "gid=1000"]
+      }
+    }
+  }
+}

2-nomad-config/codeproject-ai.tf

@@ -0,0 +1,9 @@
+
+resource "nomad_job" "codeproject_ai" {
+  jobspec = file("codeproject-ai.nomad.hcl")
+}
+
+module "appdata_codeproject_ai" {
+  source = "./modules/appdata"
+  name   = "codeproject-ai"
+}

2-nomad-config/gitea.nomad.hcl

@@ -37,17 +37,6 @@ job "gitea" {
       }
     }
 
-    # Separate service for Consul Connect ingress (address_mode=alloc avoids hairpin NAT issue)
-    service {
-      name         = "code-connect"
-      port         = "http"
-      address_mode = "alloc"
-
-      connect {
-        sidecar_service {}
-      }
-    }
-
     task "gitea" {
       driver = "docker"
 

2-nomad-config/ntfy.nomad.hcl

@@ -1,100 +0,0 @@
-job "ntfy" {
-  group "ntfy" {
-    network {
-      mode = "bridge"
-      port "http" {
-        to = 80
-      }
-    }
-
-    # Consul Connect sidecar with upstream to postgres
-    service {
-      connect {
-        sidecar_service {
-          proxy {
-            upstreams {
-              destination_name = "postgres"
-              local_bind_port  = 5432
-            }
-          }
-        }
-      }
-    }
-
-    service {
-      name = "ntfy"
-      port = "http"
-
-      tags = [
-        "traefik.enable=true",
-        "traefik.http.routers.ntfy.middlewares=auth@file",
-        # Token subdomain bypasses Authelia — ntfy's own token auth is sufficient for API access
-        "traefik.http.routers.ntfy-token.rule=Host(`ntfy-2e30e5869ab6bfde4961012b48761a9b.othrayte.one`)",
-      ]
-
-      check {
-        type     = "http"
-        path     = "/healthz"
-        interval = "10s"
-        timeout  = "2s"
-      }
-    }
-
-    # Users and tokens are provisioned declaratively via auth-users / auth-tokens in server.yml.
-    # ntfy reads and applies them on every startup — no poststart task, no race conditions.
-    #
-    # Bcrypt hashes are not secrets and are hardcoded below (same as /etc/shadow — safe to commit).
-    # Generate with: docker run --rm -it binwiederhier/ntfy user hash
-    #            or: echo "mypassword" | docker run --rm -i binwiederhier/ntfy user hash
-    # For the diun account the plaintext is irrelevant (token-only auth); use a random password:
-    #            openssl rand -base64 32 | docker run --rm -i binwiederhier/ntfy user hash
-    #
-    # Required SOPS keys:
-    #   ntfy.database_pw  — postgres password for the ntfy role
-    #   diun.ntfy_token   — access token for Diun (actual secret — grants write access)
-    #                       Must start with "tk_" and be exactly 32 chars total.
-    #                       Generate: tok=$(openssl rand -hex 15); echo "tk_${tok:0:29}"
-    task "ntfy" {
-      driver = "docker"
-
-      config {
-        image   = "binwiederhier/ntfy:latest"
-        ports   = ["http"]
-        command = "serve"
-        volumes = [
-          "local/server.yml:/etc/ntfy/server.yml",
-        ]
-      }
-
-      env = {
-        TZ = "Australia/Melbourne"
-      }
-
-      template {
-        data        = <<EOF
-base-url: "https://ntfy.othrayte.one"
-listen-http: ":80"
-database-url: "postgres://ntfy:{{ with nomadVar "nomad/jobs/ntfy" }}{{ .database_pw }}{{ end }}@localhost:5432/ntfy"
-auth-default-access: "deny-all"
-behind-proxy: true
-enable-login: true
-auth-users:
-  - "admin:$2a$10$rLp4qagJnsA8Es5hQlISH.WrlzwMrXE2MBaEgz7zdd2lkAVu30lMy:admin"
-  - "diun:$2y$10$4wi1VG.Vp5p3Q2OEIXaTSOmwZm.G9dpNca9BqQRMdGGnk2yQqK3Gq:user"
-auth-tokens:
-  - "diun:{{with nomadVar "nomad/jobs/ntfy"}}{{.diun_token}}{{end}}:Diun"
-auth-access:
-  - "diun:diun:write-only"
-EOF
-        destination = "local/server.yml"
-      }
-
-      resources {
-        cpu        = 50
-        memory     = 64
-        memory_max = 128
-      }
-    }
-
-  }
-}

2-nomad-config/ntfy.tf

@@ -1,22 +0,0 @@
-resource "nomad_job" "ntfy" {
-  jobspec = file("ntfy.nomad.hcl")
-}
-
-resource "nomad_variable" "ntfy" {
-  path = "nomad/jobs/ntfy"
-  items = {
-    database_pw = data.sops_file.secrets.data["ntfy.database_pw"]
-    diun_token  = data.sops_file.secrets.data["diun.ntfy_token"]
-  }
-}
-
-resource "postgresql_role" "ntfy" {
-  name     = "ntfy"
-  password = data.sops_file.secrets.data["ntfy.database_pw"]
-  login    = true
-}
-
-resource "postgresql_database" "ntfy" {
-  name  = "ntfy"
-  owner = postgresql_role.ntfy.name
-}

2-nomad-config/openreader.nomad.hcl

@@ -1,116 +0,0 @@
-job "openreader" {
-  group "openreader" {
-    network {
-      mode = "bridge"
-      port "http" {
-        to = 3003
-      }
-    }
-
-    # Consul Connect sidecar with upstream to postgres
-    service {
-      connect {
-        sidecar_service {
-          proxy {
-            upstreams {
-              destination_name = "postgres"
-              local_bind_port  = 5432
-            }
-          }
-        }
-      }
-    }
-
-    service {
-      name = "openreader"
-      port = "http"
-
-      tags = [
-        "traefik.enable=true",
-        "traefik.http.routers.openreader.middlewares=auth@file",
-      ]
-
-      check {
-        type     = "http"
-        path     = "/"
-        interval = "10s"
-        timeout  = "2s"
-      }
-    }
-
-    service {
-      name         = "openreader-api"
-      port         = "http"
-      address_mode = "alloc" # Use allocation IP for Connect as the sidecar can't access the host's published port (hairpin/loopback NAT issue)
-
-      connect {
-        sidecar_service {}
-      }
-
-      check {
-        type     = "http"
-        path     = "/"
-        interval = "10s"
-        timeout  = "2s"
-      }
-    }
-
-    task "openreader" {
-      driver = "docker"
-
-      config {
-        image = "ghcr.io/richardr1126/openreader:v2.1.2"
-        ports = ["http"]
-      }
-
-      env = {
-        TZ = "Australia/Melbourne"
-
-        # Use embedded SeaweedFS for blob storage (data lives in /app/docstore/seaweedfs).
-        # Port 8333 is not exposed; browser uploads/downloads fall back through the app API.
-        USE_EMBEDDED_WEED_MINI = "true"
-        S3_ENDPOINT            = "http://localhost:8333"
-        S3_FORCE_PATH_STYLE    = "true"
-
-        # Auth is intentionally disabled (no BASE_URL / AUTH_SECRET set).
-        # Access is controlled by the Authelia middleware on the Traefik router above.
-
-        # To enable server-side library import from an Unraid share, add a second CSI volume
-        # mount for the share (e.g. unraid_media_books → /app/docstore/library:ro) and set:
-        #   IMPORT_LIBRARY_DIR = "/app/docstore/library"
-      }
-
-      template {
-        data        = <<EOF
-POSTGRES_URL=postgresql://openreader:{{ with nomadVar "nomad/jobs/openreader" }}{{ .database_pw }}{{ end }}@localhost:5432/openreader
-EOF
-        destination = "secrets/openreader.env"
-        env         = true
-      }
-
-      volume_mount {
-        volume      = "unraid_appdata_openreader"
-        destination = "/app/docstore"
-        read_only   = false
-      }
-
-      resources {
-        cpu        = 200
-        memory     = 750
-        memory_max = 1024
-      }
-    }
-
-    volume "unraid_appdata_openreader" {
-      type            = "csi"
-      read_only       = false
-      source          = "unraid_appdata_openreader"
-      access_mode     = "single-node-writer"
-      attachment_mode = "file-system"
-
-      mount_options {
-        mount_flags = ["uid=1000", "gid=1000"]
-      }
-    }
-  }
-}

2-nomad-config/openreader.tf

@@ -1,26 +0,0 @@
-resource "nomad_job" "openreader" {
-  jobspec = file("openreader.nomad.hcl")
-}
-
-resource "nomad_variable" "openreader" {
-  path = "nomad/jobs/openreader"
-  items = {
-    database_pw = data.sops_file.secrets.data["openreader.database_pw"]
-  }
-}
-
-resource "postgresql_role" "openreader" {
-  name     = "openreader"
-  password = data.sops_file.secrets.data["openreader.database_pw"]
-  login    = true
-}
-
-resource "postgresql_database" "openreader" {
-  name  = "openreader"
-  owner = postgresql_role.openreader.name
-}
-
-module "appdata_openreader" {
-  source = "./modules/appdata"
-  name   = "openreader"
-}

2-nomad-config/renovate.nomad.hcl

@@ -1,64 +0,0 @@
-job "renovate" {
-  type = "batch"
-
-  periodic {
-    cron             = "0 4 * * *" # Daily at 4am
-    prohibit_overlap = true
-  }
-
-  group "renovate" {
-    network {
-      mode = "bridge"
-    }
-
-    # Consul Connect sidecar with upstream to Gitea (service: code-connect, port 3000)
-    service {
-      name = "renovate"
-      connect {
-        sidecar_service {
-          proxy {
-            upstreams {
-              destination_name = "code-connect"
-              local_bind_port  = 3000
-            }
-          }
-        }
-      }
-    }
-
-    task "renovate" {
-      driver = "docker"
-
-      config {
-        image = "renovate/renovate:latest"
-      }
-
-      env = {
-        RENOVATE_PLATFORM     = "gitea"
-        RENOVATE_ENDPOINT     = "http://localhost:3000"
-        RENOVATE_GIT_URL      = "endpoint"
-        RENOVATE_REPOSITORIES = "othrayte/infra"
-        RENOVATE_GIT_AUTHOR   = "Renovate Bot <renovate@othrayte.one>"
-        LOG_LEVEL             = "debug"
-      }
-
-      # Required SOPS key:
-      #   renovate.gitea_token  — PAT for the renovate bot account in Gitea
-      #   Create a dedicated 'renovate' user in Gitea with these token scopes:
-      #     repo (read+write), user (read), issue (read+write), organization (read)
-      template {
-        data        = <<EOF
-RENOVATE_TOKEN={{ with nomadVar "nomad/jobs/renovate" }}{{ .gitea_token }}{{ end }}
-EOF
-        destination = "secrets/renovate.env"
-        env         = true
-      }
-
-      resources {
-        cpu        = 500
-        memory     = 512
-        memory_max = 1024
-      }
-    }
-  }
-}

2-nomad-config/renovate.tf

@@ -1,10 +0,0 @@
-resource "nomad_job" "renovate" {
-  jobspec = file("renovate.nomad.hcl")
-}
-
-resource "nomad_variable" "renovate" {
-  path = "nomad/jobs/renovate"
-  items = {
-    gitea_token = data.sops_file.secrets.data["renovate.gitea_token"]
-  }
-}

2-nomad-config/secrets/secrets.enc.json

@@ -46,15 +46,6 @@
 	"frigate": {
 		"rtsp_password": "ENC[AES256_GCM,data:8vq06/IkNOUgpHmf,iv:lj8buuIC0ub0YOUiOiaN6tokkIT2/+bBwFNz2QXmCd4=,tag:EMm/bIHdJSAtjYAlrNOCMw==,type:str]"
 	},
-	"openreader": {
-		"database_pw": "ENC[AES256_GCM,data:2Ey9Ypb2Ked/LP/ApJhCqhKWuzognxVK7ku60nERp7I=,iv:KdLFD+fuNpYmPEU5G96SvFcQeZB0XlnOh/6uf7OfFqI=,tag:h7DQlqx5fxhiHuWyFd7svQ==,type:str]"
-	},
-	"ntfy": {
-		"database_pw": "ENC[AES256_GCM,data:79c2KFs3tcbet1dSGnkSDlAeKLCZrh4aMYLXTROM8w==,iv:eZ4limyjl++nsvHUzPKy82hfLZEOc+XQYpO6Czo/8os=,tag:iX9SiEACQ5IM8f1jhZh5Qw==,type:str]"
-	},
-	"renovate": {
-		"gitea_token": "ENC[AES256_GCM,data:/J3CDMgWZLe20oQ+ENKBMi8fs/+jgsARV7xihMq0OLmRk8C8ae/IXg==,iv:e7WYOanSOCZ/LhN6SKrH0VrR3xLPTTppOKpGpSl+oAc=,tag:XBAilRdK3jL7WtM+92Fsmg==,type:str]"
-	},
 	"sops": {
 		"age": [
 			{
@@ -62,8 +53,8 @@
 				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSByUWM4ZDVVbGFrUGdMRHBX\nUFBmU3Nlc0RBSzhFK0tHNHpkQXUvUVdiZUZJCmpRN1lFdENpWW0rcThjVlVQNUl6\nWnlLU0RnQ3FZby81Ly8xTFBrek9nMncKLS0tIFQ4UTRNOC9CRmx4OFJWem1wckZz\nUDFTSzdWZldFK3FqcTNWTWRyNDhHQ2MKS811mR5xn7qiC/aVgPFYJ5c6Q3zxRfcr\nHcvxUvB01vNJKZpRg92vvKPkV6lQO3DXCT98OdfwiymlEOvYxg71Pg==\n-----END AGE ENCRYPTED FILE-----\n"
 			}
 		],
-		"lastmodified": "2026-04-18T06:07:22Z",
+		"lastmodified": "2026-03-28T02:45:25Z",
-		"mac": "ENC[AES256_GCM,data:4UJMEZNS8HXtn1vIJ+qCkBJL5oh3Jp7wbaGm5hMiSNPseNq3smTYmMgh+TNK4t/K7yxfukTuhEFTUsnMfi7rIxTrbCpcTdnqJSYm/iflkdA57Tx+mHpY9iG7wtRmObow18Ea0rj6foMu+1V8pVFomzhc/ipafinTCuqodKW1a2Y=,iv:Gu/Lh8mir36ltN++qJg122ry+eJA0GKSrfijulYM7q4=,tag:5tjBzrCZcQUvc76No+E9Ow==,type:str]",
+		"mac": "ENC[AES256_GCM,data:LOzPiZlrS5Rqcsub1jfQ2yfKfTzySA19RjA566MdEY3/h1NmWrodfysPU1bZ9ClOALTFmv6JfmBVxrJ3Mq8T3YBT1qoVjkg7aRO8x6WCMRt11Lba2/SwjLDNFkE/EItvMu10RhzxIYLzZTf+X3zHiLVuSQ4aS9vn9IGTa8yWQ0k=,iv:x7GSxq7G6JpVtHi0nGHM8FDx9gDZI4bR+jJQremxKpc=,tag:DsjEhCOt+XPs2WVznxvYCg==,type:str]",
 		"encrypted_regex": "^(.*)$",
 		"version": "3.10.2"
 	}

renovate.json

@@ -1,15 +1,3 @@
 {
-  "$schema": "https://docs.renovatebot.com/renovate-schema.json",
+  "$schema": "https://docs.renovatebot.com/renovate-schema.json"
-  "extends": ["config:recommended"],
-  "customManagers": [
-    {
-      "description": "Update Docker image tags in Nomad job files",
-      "customType": "regex",
-      "fileMatch": ["\\.nomad\\.hcl$"],
-      "matchStrings": [
-        "image\\s*=\\s*\"(?<depName>[^:\"]+):(?<currentValue>[^\"]+)\""
-      ],
-      "datasourceTemplate": "docker"
-    }
-  ]
 }