Update Terraform system to v0.5.0

2-nomad-config/1-data/pgadmin.nomad.hcl

@@ -58,10 +58,8 @@ job "pgadmin" {
         ]
 
         check {
-          name     = "alive"
           type     = "http"
           path     = "/"
-          port     = "http"
           interval = "10s"
           timeout  = "2s"
         }

2-nomad-config/1-data/postgres.nomad.hcl

@@ -7,10 +7,6 @@ job "postgres" {
       connect {
         sidecar_service {}
       }
-
-      # Note: TCP checks are not valid for Connect-enabled services (runs through
-      # Envoy sidecar). Postgres is a single-writer DB that we never canary, so
-      # observable health via Consul is lower priority than other services.
     }
 
     task "postgres" {

2-nomad-config/2-ingress/authelia.nomad.hcl

@@ -33,10 +33,8 @@ job "authelia" {
       }
 
       check {
-        name     = "alive"
         type     = "http"
         path     = "/health"
-        port     = "http"
         interval = "10s"
         timeout  = "2s"
       }

2-nomad-config/2-ingress/traefik.nomad.hcl

@@ -35,8 +35,7 @@ job "traefik" {
 
       check {
         name     = "alive"
-        type     = "http"
+        type     = "tcp"
-        path     = "/ping"
         port     = "api"
         interval = "10s"
         timeout  = "2s"
@@ -86,9 +85,6 @@ api:
   dashboard: true
   insecure: true
 
-ping:
-  entryPoint: traefik
-
 providers:
   file:
     directory: "/etc/traefik/configs/"

2-nomad-config/deluge.nomad.hcl

@@ -54,10 +54,8 @@ EOH
       ]
 
       check {
-        name     = "alive"
         type     = "http"
         path     = "/"
-        port     = "http"
         interval = "10s"
         timeout  = "2s"
       }
@@ -80,10 +78,8 @@ EOH
       }
 
       check {
-        name     = "alive"
         type     = "http"
         path     = "/"
-        port     = "http"
         interval = "10s"
         timeout  = "2s"
       }

2-nomad-config/frigate.nomad.hcl

@@ -101,7 +101,7 @@ EOH
       driver = "docker"
 
       config {
-        image      = "ghcr.io/blakeblackshear/frigate:0.17.2"
+        image      = "ghcr.io/blakeblackshear/frigate:0.17.1"
         ports      = ["http"]
         privileged = true
 

2-nomad-config/gitea.nomad.hcl

@@ -32,10 +32,8 @@ job "gitea" {
       ]
 
       check {
-        name     = "alive"
         type     = "http"
-        path     = "/api/healthz"
+        path     = "/"
-        port     = "http"
         interval = "10s"
         timeout  = "2s"
       }

2-nomad-config/glance.nomad.hcl

@@ -12,7 +12,7 @@ job "glance" {
       driver = "docker"
 
       config {
-        image = "glanceapp/glance:v0.7.8"
+        image = "glanceapp/glance:latest"
         ports = ["http"]
         volumes = [
           "local/glance.yml:/app/config/glance.yml",
@@ -30,8 +30,7 @@ job "glance" {
 
         check {
           name     = "alive"
-          type     = "http"
+          type     = "tcp"
-          path     = "/"
           port     = "http"
           interval = "10s"
           timeout  = "2s"

2-nomad-config/jellyfin.nomad.hcl

@@ -28,11 +28,10 @@ job "jellyfin" {
 
         check {
           name     = "alive"
-          type     = "http"
+          type     = "tcp"
-          path     = "/health"
           port     = "http"
           interval = "10s"
-          timeout  = "5s"
+          timeout  = "2s"
         }
       }
 

2-nomad-config/ntfy.nomad.hcl

@@ -33,10 +33,8 @@ job "ntfy" {
       ]
 
       check {
-        name     = "alive"
         type     = "http"
         path     = "/healthz"
-        port     = "http"
         interval = "10s"
         timeout  = "2s"
       }

2-nomad-config/openreader.nomad.hcl

@@ -31,10 +31,8 @@ job "openreader" {
       ]
 
       check {
-        name     = "alive"
         type     = "http"
         path     = "/"
-        port     = "http"
         interval = "10s"
         timeout  = "2s"
       }
@@ -50,10 +48,8 @@ job "openreader" {
       }
 
       check {
-        name     = "alive"
         type     = "http"
         path     = "/"
-        port     = "http"
         interval = "10s"
         timeout  = "2s"
       }

2-nomad-config/prowlarr.nomad.hcl

@@ -34,9 +34,8 @@ job "prowlarr" {
       ]
 
       check {
-        name     = "alive"
         type     = "http"
-        path     = "/ping"
+        path     = "/"
         interval = "10s"
         timeout  = "2s"
       }
@@ -52,9 +51,8 @@ job "prowlarr" {
       }
 
       check {
-        name     = "alive"
         type     = "http"
-        path     = "/ping"
+        path     = "/"
         interval = "10s"
         timeout  = "2s"
       }

2-nomad-config/sonarr.nomad.hcl

@@ -37,9 +37,8 @@ job "sonarr" {
       ]
 
       check {
-        name     = "alive"
         type     = "http"
-        path     = "/ping"
+        path     = "/"
         interval = "10s"
         timeout  = "2s"
       }
@@ -55,9 +54,8 @@ job "sonarr" {
       }
 
       check {
-        name     = "alive"
         type     = "http"
-        path     = "/ping"
+        path     = "/"
         interval = "10s"
         timeout  = "2s"
       }

2-nomad-config/transfer.nomad.hcl

@@ -16,10 +16,8 @@ job "transfer" {
       ]
 
       check {
-        name     = "alive"
         type     = "http"
         path     = "/"
-        port     = "http"
         interval = "10s"
         timeout  = "2s"
       }

2-nomad-config/unifi.nomad.hcl

@@ -21,26 +21,6 @@ job "unifi-network" {
         UNIFI_STDOUT       = "true"
       }
 
-      # Register in Consul so Traefik and health checks can find it.
-      # address_mode=driver uses the macvlan IP (192.168.1.50) rather than the host IP.
-      service {
-        name         = "unifi-network"
-        port         = 8443
-        address_mode = "driver"
-
-        # TCP/HTTP checks from the Consul agent can't reach the macvlan IP (host↔macvlan
-        # isolation). Use a script check instead — it runs inside the container via
-        # docker exec and connects to localhost:8443 directly.
-        check {
-          name     = "alive"
-          type     = "script"
-          command  = "/usr/bin/curl"
-          args     = ["-sk", "--max-time", "5", "-o", "/dev/null", "https://localhost:8443"]
-          interval = "30s"
-          timeout  = "10s"
-        }
-      }
-
       volume_mount {
         volume      = "unraid_appdata_unifi_network"
         destination = "/unifi" # Expected root directory (contains data, log, cert subdirs)

archive/1-coreos/3-configure-hashistack/.terraform.lock.hcl

@@ -2,24 +2,37 @@
 # Manual edits may be lost in future updates.
 
 provider "registry.terraform.io/neuspaces/system" {
-  version     = "0.4.0"
+  version     = "0.5.0"
-  constraints = "0.4.0"
+  constraints = "0.5.0"
   hashes = [
-    "h1:Vsp3ZoNGUnijGxcyKPJAnjzaifk2rcOaA6DtS4Wsdyk=",
+    "h1:+ATCBDOJs/ZlCiAZPo8sa2Uei8nTf1QQJT2670aIsTs=",
-    "zh:04862132feb60ff990e15f4b878e96fbcc296720bd31a39e7b0a8fe5788b5b33",
+    "h1:/z7Qu/4siDYM3e+q9Vl466Htl6tEgFZJI3Pc69EOWEg=",
-    "zh:1d8b6050274b5b915fbf241a66c63fe1b2088bc4720e0ef36a3d75a197a97d78",
+    "h1:0TxsJOXyC4J73IitbyKIR60bCA75M2lPD5Bd9wIcxyg=",
-    "zh:5263effc40349d48ed458ea5d418e7321db441d7987b35fabbdd3faa53ed114d",
+    "h1:4/GEbH8VSjgUrY6uMGUDDmSHOtQdo00cmluffNtAEFc=",
-    "zh:5b13d535084dacba3d511d5c815db4b5ae83e9c6226938bbf20a30c4e05116cb",
+    "h1:Cf4hCIbocqgmkXR/3Ia5J0/g7Q8cMhPngiqMG5lWDwI=",
-    "zh:69da944ea0c86ec4e64ae844f580d13910fd66f1d8a9ecc7890ff0ace29aef36",
+    "h1:D++0aOhVEdVxs5lNE9xsBoDYo2fgSzF4N+pgLihzDMM=",
+    "h1:H4dAi3KIdS1mQved99YQPvwEeSuL/UpUZfc4sGPckvc=",
+    "h1:O6M7A59jpW2S9z/vew+VIlMkRekLd9u0E1u85qJfgp0=",
+    "h1:X5YuaWMt+e0XS6uHE+nOCfhxJ3pDE1j+/9lcCAM+NeI=",
+    "h1:dcSBPD23eJv0GWfTL/OHnncA5TG2n3WihRdEDFvGGO4=",
+    "h1:iGC3jfF4K7nag5gUsxqlW8sJUvMZawe9ZnWhZFA8qco=",
+    "h1:oQbsFw8oGS64I7HYwJtE06YLeOckrIlebsBYyWCCNaY=",
+    "h1:rm8Z3YHvxeNxo/jwgEyiFEolmi748Nm7WjOUaWqGEzU=",
+    "h1:xYNyeBWkDZaOoBfJ9czGX8VC1xdil5EP1aw0xN2ZUi8=",
+    "zh:1c2800a4606b9b73405da6eb6be729b1c36bb1047f3ba99e2a263568aa724a76",
+    "zh:1e49e76a4805faac59bb656fc6d9be0befe6cb5307965db790493b81a023c9a6",
+    "zh:29741b13600995b58a9949ce3fcb24ec088e59b1911526b53a7b2c0224e34ea9",
+    "zh:30b0e123506c796b325da67fa3249f151e928043b969e65a9f9aa88ea02c2078",
+    "zh:311198cee4a83fde0b7e5a23e1ba4a797cc7583b90865339d5fa5e53b17520f0",
+    "zh:3b6897b9b85bba36f0cf7afcb06c9e680db1b151537f2e0cb0ddec480ad939c4",
+    "zh:4c35205a53093747707e9970a323f17b4f2eec26947cf2cc62fc50ce1ee4040c",
+    "zh:51fc16a1ae8ae9ee821f4e57243a23fb3a0cf54116efafd0dacff7a6f7f270b5",
+    "zh:5ba4908783fc3b04c574301ad6ba1d4c8f67fb24b7f61fc88c66a970ef7b805e",
+    "zh:5e0e4da6386e63a2a2876007a7cdb10bad8ce9e55533104739322a5425fd0aa8",
     "zh:78d5eefdd9e494defcb3c68d282b8f96630502cac21d1ea161f53cfe9bb483b3",
-    "zh:7fce212ccf0fd267a7f318c793e174605cbaa7814f9b30be16ed1d0526ab398f",
+    "zh:86c846c6e5bac31d19696f4a0a7b0470c98bae88a756e7c204912ed3c019f162",
-    "zh:97523ef340365bfaf759cc1eb4a202af7b27ac87e1cb5f0309a585d63e205bbd",
+    "zh:9e536df33fbee3672af9338992431bbad83efc53d4d38e8563eaaf1969d9fc4c",
-    "zh:9f3fefa30abc39a1073e66b88701b5437f4b04b0082091408c97f6a8e5b64bd3",
+    "zh:a0f11c8a9bcc524b1d7e8d727c598e5d1e065b580d5a50e2b6fd3264877e7b7b",
-    "zh:e16d43079cc894bfb0980ff211ea1787cdb913f24826461a8967ac91fd146ea8",
+    "zh:a15c2a47eaf9eb7dfb251a6096cf383f872787cd5fa583763fdb5aac5c862f77",
-    "zh:e4630f531b59e813fa405942c7648252c741313ccd49bc1be85f2ea964016ed3",
-    "zh:ebd2549e8b5b2894efb0ba70f2f6034ae5fb5821d1e2831ba5af8fa5e5870829",
-    "zh:ed601fdbf4813d041b3773781e2331c7ea074f8a5b505d2b105059a89b44301c",
-    "zh:f08f8e3d05759b72421de4c54f6938396d3e13fdfdbe7505877b1c64342dfa3a",
-    "zh:fea9e0172235a52343826d77e8331bcfeb785d514b4f5ee39f524d541b1a8749",
   ]
 }

archive/1-coreos/3-configure-hashistack/jaglan-beta.tf

@@ -2,7 +2,7 @@ terraform {
   required_providers {
     system = {
       source = "neuspaces/system"
-      version = "0.4.0"
+      version = "0.5.0"
     }
   }
 }

cicd-plan.md

@@ -188,8 +188,8 @@ Most jobs already have Consul health checks — these can use `health_check = "c
 | frigate    | ✅            | ✅ `single-node-writer` | ⚠️ same — rolling                                                                 |
 | glance     | ✅            | no                      | ✅ yes                                                                            |
 | transfer   | ✅            | ✅ `single-node-writer` | ⚠️ rolling                                                                        |
-| openreader | ✅ `/`        | ✅ `single-node-writer` | ⚠️ rolling                                                                        |
+| openreader | ❌            | ✅ `single-node-writer` | ⚠️ add check first, then rolling                                                  |
-| unifi      | ✅ script     | ✅ `single-node-writer` | ⚠️ rolling                                                                        |
+| unifi      | ❌            | ✅ `single-node-writer` | ⚠️ add check first, then rolling                                                  |
 | traefik    | (ingress)     | ✅                      | ⚠️ rolling — downtime risk, promote quickly                                       |
 | authelia   | (ingress)     | ✅                      | ✅ stateless config, canary fine                                                  |
 | renovate   | batch job     | n/a                     | n/a — no deployment model                                                         |
@@ -298,8 +298,8 @@ exit 1
 - [x] **Phase 1c**: Add Nomad validate step — add `NOMAD_ADDR` + read-only `NOMAD_TOKEN` to Gitea secrets
 - [x] **Phase 2**: Add image pull validation step to the workflow
 - [ ] **Phase 3a**: Add `update` stanzas to ntfy and glance (simplest, no volume conflict)
-- [ ] **Phase 3b**: Add rolling `update` stanzas to remaining service jobs (jellyfin, sonarr, prowlarr, deluge, gitea, immich, transfer, frigate, openreader, unifi, authelia, traefik)
+- [ ] **Phase 3b**: Add rolling `update` stanzas to remaining service jobs (jellyfin, sonarr, etc.)
-- [x] **Phase 3c**: Add health checks to openreader and unifi before adding update stanzas
+- [ ] **Phase 3c**: Add health checks to openreader and unifi before adding update stanzas
 - [ ] **Phase 4a**: Add on-push workflow that runs `terraform apply -auto-approve` using full credential set
 - [ ] **Phase 4b**: Add deployment promotion/revert polling script
 - [ ] **Phase 4c**: Wire ntfy notifications for promote/revert outcomes