Update Terraform null to v3.3.0

2026-05-14 04:01:52 +00:00
17 changed files with 41 additions and 81 deletions
--- a/1-nixos-node/.terraform.lock.hcl
+++ b/1-nixos-node/.terraform.lock.hcl
@@ -2,22 +2,34 @@
 # Manual edits may be lost in future updates.

 provider "registry.terraform.io/hashicorp/null" {
-  version     = "3.2.1"
-  constraints = "3.2.1"
+  version     = "3.3.0"
+  constraints = "3.3.0"
  hashes = [
-    "h1:FbGfc+muBsC17Ohy5g806iuI1hQc4SIexpYCrQHQd8w=",
-    "zh:58ed64389620cc7b82f01332e27723856422820cfd302e304b5f6c3436fb9840",
-    "zh:62a5cc82c3b2ddef7ef3a6f2fedb7b9b3deff4ab7b414938b08e51d6e8be87cb",
-    "zh:63cff4de03af983175a7e37e52d4bd89d990be256b16b5c7f919aff5ad485aa5",
-    "zh:74cb22c6700e48486b7cabefa10b33b801dfcab56f1a6ac9b6624531f3d36ea3",
+    "h1:4Zyprgl18zvgQ/jhrUIaqp0/OS/7VsqFonbyKkriRAg=",
+    "h1:9EqpcVsMZvBdkGPH8/atDaMndAvEboc3hQ9pUngWtKA=",
+    "h1:FmGyAkEcy7SywlZSfMieDpt2M01a+mNglQa2C5SX5cg=",
+    "h1:Gq+xRK4yvwDpBJ2KFJkrmcNZikDiAEuFhAWeDtzanJc=",
+    "h1:J0wy2i0Bj2PSf7qs3cHfM+cioPmtJKeDQR4HHLTYy7E=",
+    "h1:TFDZkzTOusUXFYZq6UGPk2jpIwFpdNGrKqE0OzqCxzw=",
+    "h1:a14TKo7Xvg4W8+H1VA6p+oLZTLxVQnYUD8LOaOs14A8=",
+    "h1:guPnpcm8A04M+/oOdsBA//QWdmyhTvY7TzqYQdLvfwE=",
+    "h1:hntY8CxZwukx6VpUX9Bm00VSURuup9pL1Ss2M4NiUZA=",
+    "h1:kncZNn+Pz/CbjPNyvvFogaXuYNQre69RN8CnApzY3ac=",
+    "h1:l+dm3lhmu4ys7GbvIldfn544olSPH0DOiYruuFSfQkY=",
+    "h1:vIATsJo3I7W6bgsUEMUrs6dWPoHr8Eq6lkCQ3oOBdPI=",
+    "zh:021748b5ea3b5f6956f2e75c42c5cdc113b391fb98ac71364a4965d23b37000f",
+    "zh:3b27956f8541d46704fda234e0d535c2ae2a4b33411848b1ee262a1ec03568b0",
+    "zh:3de4ed47d6d0f4d8edba4a5092c7c9799950eda63989d8d0d2586e6afcb0aa20",
+    "zh:57ed8935c7d56dbc91cf2673534582cacfaab7a2f105f51d9f797e99df0c0c47",
+    "zh:58e176ba1d142827089e30e0711e007309a9f2726e8881986da5026e9778fdf4",
+    "zh:5949c4a3d4a93f841f155cdb7e991c087e637145c1630572e21948224f8f4923",
+    "zh:76d60f366b743003c1b085afa769b45b2198ee919927e45807d7d44fb42c067d",
    "zh:78d5eefdd9e494defcb3c68d282b8f96630502cac21d1ea161f53cfe9bb483b3",
-    "zh:79e553aff77f1cfa9012a2218b8238dd672ea5e1b2924775ac9ac24d2a75c238",
-    "zh:a1e06ddda0b5ac48f7e7c7d59e1ab5a4073bbcf876c73c0299e4610ed53859dc",
-    "zh:c37a97090f1a82222925d45d84483b2aa702ef7ab66532af6cbcfb567818b970",
-    "zh:e4453fbebf90c53ca3323a92e7ca0f9961427d2f0ce0d2b65523cc04d5d999c2",
-    "zh:e80a746921946d8b6761e77305b752ad188da60688cfd2059322875d363be5f5",
-    "zh:fbdb892d9822ed0e4cb60f2fedbdbb556e4da0d88d3b942ae963ed6ff091e48f",
-    "zh:fca01a623d90d0cad0843102f9b8b9fe0d3ff8244593bd817f126582b52dd694",
+    "zh:79cd1bab1261a07f84e917191d7ddc4340ac5f5524283767256f7ffd7f87caf0",
+    "zh:8ec9083038cf710b30e319eaa467c9df7fa52bbd9969b61053a35bc2cdd2e0a6",
+    "zh:a6e502cb579685ab7aeb886c2bb11ddd9cfed74b41008592d57cbc3351a9218b",
+    "zh:acb74d6b4f66ff6acfcda315df802a7432170ef3955c9b432cb4580767004006",
+    "zh:f0ce55d8d9ffdb33dab612b1246f9bab060a9d54fc32ce2b4a038646155660af",
  ]
 }

--- a/1-nixos-node/node.tf
+++ b/1-nixos-node/node.tf
@@ -2,7 +2,7 @@ terraform {
  required_providers {
    null = {
      source  = "hashicorp/null"
-      version = "3.2.1"
+      version = "3.3.0"
    }
    template = {
      source  = "hashicorp/template"
--- a/2-nomad-config/1-data/pgadmin.nomad.hcl
+++ b/2-nomad-config/1-data/pgadmin.nomad.hcl
@@ -58,10 +58,8 @@ job "pgadmin" {
        ]

        check {
-          name     = "alive"
          type     = "http"
          path     = "/"
-          port     = "http"
          interval = "10s"
          timeout  = "2s"
        }
--- a/2-nomad-config/1-data/postgres.nomad.hcl
+++ b/2-nomad-config/1-data/postgres.nomad.hcl
@@ -7,10 +7,6 @@ job "postgres" {
      connect {
        sidecar_service {}
      }
-
-      # Note: TCP checks are not valid for Connect-enabled services (runs through
-      # Envoy sidecar). Postgres is a single-writer DB that we never canary, so
-      # observable health via Consul is lower priority than other services.
    }

    task "postgres" {
--- a/2-nomad-config/2-ingress/authelia.nomad.hcl
+++ b/2-nomad-config/2-ingress/authelia.nomad.hcl
@@ -33,10 +33,8 @@ job "authelia" {
      }

      check {
-        name     = "alive"
        type     = "http"
        path     = "/health"
-        port     = "http"
        interval = "10s"
        timeout  = "2s"
      }
--- a/2-nomad-config/2-ingress/traefik.nomad.hcl
+++ b/2-nomad-config/2-ingress/traefik.nomad.hcl
@@ -35,8 +35,7 @@ job "traefik" {

      check {
        name     = "alive"
-        type     = "http"
-        path     = "/ping"
+        type     = "tcp"
        port     = "api"
        interval = "10s"
        timeout  = "2s"
@@ -86,9 +85,6 @@ api:
  dashboard: true
  insecure: true

-ping:
-  entryPoint: traefik
-
 providers:
  file:
    directory: "/etc/traefik/configs/"
--- a/2-nomad-config/deluge.nomad.hcl
+++ b/2-nomad-config/deluge.nomad.hcl
@@ -54,10 +54,8 @@ EOH
      ]

      check {
-        name     = "alive"
        type     = "http"
        path     = "/"
-        port     = "http"
        interval = "10s"
        timeout  = "2s"
      }
@@ -80,10 +78,8 @@ EOH
      }

      check {
-        name     = "alive"
        type     = "http"
        path     = "/"
-        port     = "http"
        interval = "10s"
        timeout  = "2s"
      }
--- a/2-nomad-config/gitea.nomad.hcl
+++ b/2-nomad-config/gitea.nomad.hcl
@@ -32,10 +32,8 @@ job "gitea" {
      ]

      check {
-        name     = "alive"
        type     = "http"
-        path     = "/api/healthz"
-        port     = "http"
+        path     = "/"
        interval = "10s"
        timeout  = "2s"
      }
--- a/2-nomad-config/glance.nomad.hcl
+++ b/2-nomad-config/glance.nomad.hcl
@@ -12,7 +12,7 @@ job "glance" {
      driver = "docker"

      config {
-        image = "glanceapp/glance:v0.7.8"
+        image = "glanceapp/glance:latest"
        ports = ["http"]
        volumes = [
          "local/glance.yml:/app/config/glance.yml",
@@ -30,8 +30,7 @@ job "glance" {

        check {
          name     = "alive"
-          type     = "http"
-          path     = "/"
+          type     = "tcp"
          port     = "http"
          interval = "10s"
          timeout  = "2s"
--- a/2-nomad-config/jellyfin.nomad.hcl
+++ b/2-nomad-config/jellyfin.nomad.hcl
@@ -28,11 +28,10 @@ job "jellyfin" {

        check {
          name     = "alive"
-          type     = "http"
-          path     = "/health"
+          type     = "tcp"
          port     = "http"
          interval = "10s"
-          timeout  = "5s"
+          timeout  = "2s"
        }
      }

--- a/2-nomad-config/ntfy.nomad.hcl
+++ b/2-nomad-config/ntfy.nomad.hcl
@@ -33,10 +33,8 @@ job "ntfy" {
      ]

      check {
-        name     = "alive"
        type     = "http"
        path     = "/healthz"
-        port     = "http"
        interval = "10s"
        timeout  = "2s"
      }
--- a/2-nomad-config/openreader.nomad.hcl
+++ b/2-nomad-config/openreader.nomad.hcl
@@ -31,10 +31,8 @@ job "openreader" {
      ]

      check {
-        name     = "alive"
        type     = "http"
        path     = "/"
-        port     = "http"
        interval = "10s"
        timeout  = "2s"
      }
@@ -50,10 +48,8 @@ job "openreader" {
      }

      check {
-        name     = "alive"
        type     = "http"
        path     = "/"
-        port     = "http"
        interval = "10s"
        timeout  = "2s"
      }
--- a/2-nomad-config/prowlarr.nomad.hcl
+++ b/2-nomad-config/prowlarr.nomad.hcl
@@ -34,9 +34,8 @@ job "prowlarr" {
      ]

      check {
-        name     = "alive"
        type     = "http"
-        path     = "/ping"
+        path     = "/"
        interval = "10s"
        timeout  = "2s"
      }
@@ -52,9 +51,8 @@ job "prowlarr" {
      }

      check {
-        name     = "alive"
        type     = "http"
-        path     = "/ping"
+        path     = "/"
        interval = "10s"
        timeout  = "2s"
      }
--- a/2-nomad-config/sonarr.nomad.hcl
+++ b/2-nomad-config/sonarr.nomad.hcl
@@ -37,9 +37,8 @@ job "sonarr" {
      ]

      check {
-        name     = "alive"
        type     = "http"
-        path     = "/ping"
+        path     = "/"
        interval = "10s"
        timeout  = "2s"
      }
@@ -55,9 +54,8 @@ job "sonarr" {
      }

      check {
-        name     = "alive"
        type     = "http"
-        path     = "/ping"
+        path     = "/"
        interval = "10s"
        timeout  = "2s"
      }
--- a/2-nomad-config/transfer.nomad.hcl
+++ b/2-nomad-config/transfer.nomad.hcl
@@ -16,10 +16,8 @@ job "transfer" {
      ]

      check {
-        name     = "alive"
        type     = "http"
        path     = "/"
-        port     = "http"
        interval = "10s"
        timeout  = "2s"
      }
--- a/2-nomad-config/unifi.nomad.hcl
+++ b/2-nomad-config/unifi.nomad.hcl
@@ -21,26 +21,6 @@ job "unifi-network" {
        UNIFI_STDOUT       = "true"
      }

-      # Register in Consul so Traefik and health checks can find it.
-      # address_mode=driver uses the macvlan IP (192.168.1.50) rather than the host IP.
-      service {
-        name         = "unifi-network"
-        port         = 8443
-        address_mode = "driver"
-
-        # TCP/HTTP checks from the Consul agent can't reach the macvlan IP (host↔macvlan
-        # isolation). Use a script check instead — it runs inside the container via
-        # docker exec and connects to localhost:8443 directly.
-        check {
-          name     = "alive"
-          type     = "script"
-          command  = "/usr/bin/curl"
-          args     = ["-sk", "--max-time", "5", "-o", "/dev/null", "https://localhost:8443"]
-          interval = "30s"
-          timeout  = "10s"
-        }
-      }
-
      volume_mount {
        volume      = "unraid_appdata_unifi_network"
        destination = "/unifi" # Expected root directory (contains data, log, cert subdirs)
--- a/cicd-plan.md
+++ b/cicd-plan.md
@@ -188,8 +188,8 @@ Most jobs already have Consul health checks — these can use `health_check = "c
 | frigate    | ✅            | ✅ `single-node-writer` | ⚠️ same — rolling                                                                 |
 | glance     | ✅            | no                      | ✅ yes                                                                            |
 | transfer   | ✅            | ✅ `single-node-writer` | ⚠️ rolling                                                                        |
-| openreader | ✅ `/`        | ✅ `single-node-writer` | ⚠️ rolling                                                                        |
-| unifi      | ✅ script     | ✅ `single-node-writer` | ⚠️ rolling                                                                        |
+| openreader | ❌            | ✅ `single-node-writer` | ⚠️ add check first, then rolling                                                  |
+| unifi      | ❌            | ✅ `single-node-writer` | ⚠️ add check first, then rolling                                                  |
 | traefik    | (ingress)     | ✅                      | ⚠️ rolling — downtime risk, promote quickly                                       |
 | authelia   | (ingress)     | ✅                      | ✅ stateless config, canary fine                                                  |
 | renovate   | batch job     | n/a                     | n/a — no deployment model                                                         |
@@ -298,8 +298,8 @@ exit 1
 - [x] **Phase 1c**: Add Nomad validate step — add `NOMAD_ADDR` + read-only `NOMAD_TOKEN` to Gitea secrets
 - [x] **Phase 2**: Add image pull validation step to the workflow
 - [ ] **Phase 3a**: Add `update` stanzas to ntfy and glance (simplest, no volume conflict)
- [ ] **Phase 3b**: Add rolling `update` stanzas to remaining service jobs (jellyfin, sonarr, prowlarr, deluge, gitea, immich, transfer, frigate, openreader, unifi, authelia, traefik)
- [x] **Phase 3c**: Add health checks to openreader and unifi before adding update stanzas
+- [ ] **Phase 3b**: Add rolling `update` stanzas to remaining service jobs (jellyfin, sonarr, etc.)
+- [ ] **Phase 3c**: Add health checks to openreader and unifi before adding update stanzas
 - [ ] **Phase 4a**: Add on-push workflow that runs `terraform apply -auto-approve` using full credential set
 - [ ] **Phase 4b**: Add deployment promotion/revert polling script
 - [ ] **Phase 4c**: Wire ntfy notifications for promote/revert outcomes