Update Terraform libvirt to v0.9.7

2026-04-19 05:20:49 +00:00
21 changed files with 73 additions and 148 deletions
@@ -52,39 +52,3 @@ jobs:
            echo "==> $f"
            nomad job validate "$f"
          done
-
-  image-pull:
-    name: Docker image pull validation
-    runs-on: ubuntu-latest
-    # Only run on PRs that touch nomad job specs
-    if: github.event_name == 'pull_request'
-
-    steps:
-      - uses: actions/checkout@v4
-        with:
-          fetch-depth: 0
-
-      - name: Pull changed images
-        run: |
-          git fetch origin ${{ github.base_ref }}
-          IMAGES=$(git diff origin/${{ github.base_ref }}...HEAD -- '*.nomad.hcl' \
-            | grep '^+\s*image\s*=' \
-            | grep -oP '"[^"]+:[^"]+"' \
-            | tr -d '"' \
-            | sort -u || true)
-
-          if [ -z "$IMAGES" ]; then
-            echo "No image changes detected, skipping pull."
-            exit 0
-          fi
-
-          FAILED=0
-          while IFS= read -r image; do
-            echo "==> Pulling $image"
-            if ! docker pull "$image"; then
-              echo "ERROR: Failed to pull $image"
-              FAILED=1
-            fi
-          done <<< "$IMAGES"
-
-          exit $FAILED
@@ -2,34 +2,22 @@
 # Manual edits may be lost in future updates.

 provider "registry.terraform.io/hashicorp/null" {
-  version     = "3.3.1"
-  constraints = "3.3.1"
+  version     = "3.2.1"
+  constraints = "3.2.1"
  hashes = [
-    "h1:4pjRixNj9/nijyC0jrCr8tYOpZ8afFwZ2M86y81PMa0=",
-    "h1:6H++HbVhT9h31TNdGvlkW+2rjeWzgdjy98zqWpEJbgk=",
-    "h1:8fi/ACgBQzyw1gloPdzewHbGNeNCX1roaKHRYA1oJIM=",
-    "h1:EVks/Xyl9ffLEDraAp8RSsynzoVbTHOsof5n2niAsa0=",
-    "h1:GYp3g8OhJCT2nc0Nv5s8HPh9nsMydHbjyUh6P4sE+8w=",
-    "h1:KWpBuTftQiLorSdw8QDMivKf6IhvVV0RzrdWSN53Qzs=",
-    "h1:TuxJq10DVnRP7c5HBZPyyvQGcckNVfijyU1eXEu5e4M=",
-    "h1:VMDxsLCSHpRC04bNeQw0JTvm5HhShID64QCSPvi9DRc=",
-    "h1:c7EI8Sso93CiiAmD7P/53OOjAm5A7Q2+Z30aUTUFaEs=",
-    "h1:m5FqidbIgh+E9OigiZh8/xbkvpUQFSj3hZo/jqNLCLQ=",
-    "h1:mV9WSUbshqmqPnhbOg198pgnjJQNnYixjXlovJBbl54=",
-    "h1:oTK+zJCvllZur0nfzBZFGbflcZbvxnESJxepZprFRik=",
-    "zh:08c59776542ea16e5a8545752787b17ff412922182b4cfabe16139197be8ac44",
-    "zh:123109cc7e5ed6d515787fbc212f2a3fd5e75647bb24ab7c801ccd4d4ed42451",
-    "zh:14b3fa4372754b54844b41d5dbd4671a292d8d6828b90169061feb4d7b15dd05",
-    "zh:56a4daaa3212f57b764bf3d1f333141c6610c5f21abb240e0111221f7c7fa4d4",
+    "h1:FbGfc+muBsC17Ohy5g806iuI1hQc4SIexpYCrQHQd8w=",
+    "zh:58ed64389620cc7b82f01332e27723856422820cfd302e304b5f6c3436fb9840",
+    "zh:62a5cc82c3b2ddef7ef3a6f2fedb7b9b3deff4ab7b414938b08e51d6e8be87cb",
+    "zh:63cff4de03af983175a7e37e52d4bd89d990be256b16b5c7f919aff5ad485aa5",
+    "zh:74cb22c6700e48486b7cabefa10b33b801dfcab56f1a6ac9b6624531f3d36ea3",
    "zh:78d5eefdd9e494defcb3c68d282b8f96630502cac21d1ea161f53cfe9bb483b3",
-    "zh:7e888a026dbacd2474a42264227ae35f639780f0f0c613529d10a95cd61988b3",
-    "zh:85a53646267e87d600df7124e4767ffde9bba3b6356d45d961618bdd68131cc7",
-    "zh:8ffa0e9c7c39b2ab0905b472465d6e35ef0b776b3f6273bb34c150340b61bff1",
-    "zh:9846510a1841530d4403f4818e233f91e3b3bade7441047599fbf800742f65be",
-    "zh:afa98d44860875f037c6def0a7e6ff208e042712ba771f620482b143cd336891",
-    "zh:bdca130d9ef27488ae0b13bc8fd8019e8bbdd4f2ceff29da066bd333165d68c5",
-    "zh:cb3b94cbca88210dd0d1f11e2b8a89333f48c3857faf8f70f589072ce7c28610",
-    "zh:f0c0ba87925fe32f84b80f7513b1efb1b0866f51f899ba825e95ad59ff09b018",
+    "zh:79e553aff77f1cfa9012a2218b8238dd672ea5e1b2924775ac9ac24d2a75c238",
+    "zh:a1e06ddda0b5ac48f7e7c7d59e1ab5a4073bbcf876c73c0299e4610ed53859dc",
+    "zh:c37a97090f1a82222925d45d84483b2aa702ef7ab66532af6cbcfb567818b970",
+    "zh:e4453fbebf90c53ca3323a92e7ca0f9961427d2f0ce0d2b65523cc04d5d999c2",
+    "zh:e80a746921946d8b6761e77305b752ad188da60688cfd2059322875d363be5f5",
+    "zh:fbdb892d9822ed0e4cb60f2fedbdbb556e4da0d88d3b942ae963ed6ff091e48f",
+    "zh:fca01a623d90d0cad0843102f9b8b9fe0d3ff8244593bd817f126582b52dd694",
  ]
 }

@@ -2,7 +2,7 @@ terraform {
  required_providers {
    null = {
      source  = "hashicorp/null"
-      version = "3.3.1"
+      version = "3.2.1"
    }
    template = {
      source  = "hashicorp/template"
@@ -58,10 +58,8 @@ job "pgadmin" {
        ]

        check {
-          name     = "alive"
          type     = "http"
          path     = "/"
-          port     = "http"
          interval = "10s"
          timeout  = "2s"
        }
@@ -7,10 +7,6 @@ job "postgres" {
      connect {
        sidecar_service {}
      }
-
-      # Note: TCP checks are not valid for Connect-enabled services (runs through
-      # Envoy sidecar). Postgres is a single-writer DB that we never canary, so
-      # observable health via Consul is lower priority than other services.
    }

    task "postgres" {
@@ -33,10 +33,8 @@ job "authelia" {
      }

      check {
-        name     = "alive"
        type     = "http"
        path     = "/health"
-        port     = "http"
        interval = "10s"
        timeout  = "2s"
      }
@@ -35,8 +35,7 @@ job "traefik" {

      check {
        name     = "alive"
-        type     = "http"
-        path     = "/ping"
+        type     = "tcp"
        port     = "api"
        interval = "10s"
        timeout  = "2s"
@@ -86,9 +85,6 @@ api:
  dashboard: true
  insecure: true

-ping:
-  entryPoint: traefik
-
 providers:
  file:
    directory: "/etc/traefik/configs/"
@@ -29,6 +29,7 @@ job "act-runner" {

      env = {
        GITEA_INSTANCE_URL = "https://gitea-1ef0bea6b75a4fd3e9393a9f7f7e4b02.othrayte.one"
+        CONFIG_FILE        = "/secrets/runner-config.yml"
      }

      # Required SOPS key:
@@ -42,6 +43,19 @@ EOF
        env         = true
      }

+      # Limit which images/labels the runner will accept so it doesn't pick up
+      # unrelated workloads if more runners are added later.
+      template {
+        data        = <<EOF
+runner:
+  labels:
+    - "ubuntu-latest:docker://node:20-bookworm"
+    - "ubuntu-22.04:docker://node:20-bookworm"
+    - "ubuntu-24.04:docker://node:20-bookworm"
+EOF
+        destination = "secrets/runner-config.yml"
+      }
+
      resources {
        cpu        = 200
        memory     = 256
@@ -54,10 +54,8 @@ EOH
      ]

      check {
-        name     = "alive"
        type     = "http"
        path     = "/"
-        port     = "http"
        interval = "10s"
        timeout  = "2s"
      }
@@ -80,10 +78,8 @@ EOH
      }

      check {
-        name     = "alive"
        type     = "http"
        path     = "/"
-        port     = "http"
        interval = "10s"
        timeout  = "2s"
      }
@@ -32,10 +32,8 @@ job "gitea" {
      ]

      check {
-        name     = "alive"
        type     = "http"
-        path     = "/api/healthz"
-        port     = "http"
+        path     = "/"
        interval = "10s"
        timeout  = "2s"
      }
@@ -12,7 +12,7 @@ job "glance" {
      driver = "docker"

      config {
-        image = "glanceapp/glance:v0.7.8"
+        image = "glanceapp/glance:latest"
        ports = ["http"]
        volumes = [
          "local/glance.yml:/app/config/glance.yml",
@@ -30,8 +30,7 @@ job "glance" {

        check {
          name     = "alive"
-          type     = "http"
-          path     = "/"
+          type     = "tcp"
          port     = "http"
          interval = "10s"
          timeout  = "2s"
@@ -28,11 +28,10 @@ job "jellyfin" {

        check {
          name     = "alive"
-          type     = "http"
-          path     = "/health"
+          type     = "tcp"
          port     = "http"
          interval = "10s"
-          timeout  = "5s"
+          timeout  = "2s"
        }
      }

@@ -33,10 +33,8 @@ job "ntfy" {
      ]

      check {
-        name     = "alive"
        type     = "http"
        path     = "/healthz"
-        port     = "http"
        interval = "10s"
        timeout  = "2s"
      }
@@ -31,10 +31,8 @@ job "openreader" {
      ]

      check {
-        name     = "alive"
        type     = "http"
        path     = "/"
-        port     = "http"
        interval = "10s"
        timeout  = "2s"
      }
@@ -50,10 +48,8 @@ job "openreader" {
      }

      check {
-        name     = "alive"
        type     = "http"
        path     = "/"
-        port     = "http"
        interval = "10s"
        timeout  = "2s"
      }
@@ -34,9 +34,8 @@ job "prowlarr" {
      ]

      check {
-        name     = "alive"
        type     = "http"
-        path     = "/ping"
+        path     = "/"
        interval = "10s"
        timeout  = "2s"
      }
@@ -52,9 +51,8 @@ job "prowlarr" {
      }

      check {
-        name     = "alive"
        type     = "http"
-        path     = "/ping"
+        path     = "/"
        interval = "10s"
        timeout  = "2s"
      }
@@ -37,9 +37,8 @@ job "sonarr" {
      ]

      check {
-        name     = "alive"
        type     = "http"
-        path     = "/ping"
+        path     = "/"
        interval = "10s"
        timeout  = "2s"
      }
@@ -55,9 +54,8 @@ job "sonarr" {
      }

      check {
-        name     = "alive"
        type     = "http"
-        path     = "/ping"
+        path     = "/"
        interval = "10s"
        timeout  = "2s"
      }
@@ -16,10 +16,8 @@ job "transfer" {
      ]

      check {
-        name     = "alive"
        type     = "http"
        path     = "/"
-        port     = "http"
        interval = "10s"
        timeout  = "2s"
      }
@@ -21,26 +21,6 @@ job "unifi-network" {
        UNIFI_STDOUT       = "true"
      }

-      # Register in Consul so Traefik and health checks can find it.
-      # address_mode=driver uses the macvlan IP (192.168.1.50) rather than the host IP.
-      service {
-        name         = "unifi-network"
-        port         = 8443
-        address_mode = "driver"
-
-        # TCP/HTTP checks from the Consul agent can't reach the macvlan IP (host↔macvlan
-        # isolation). Use a script check instead — it runs inside the container via
-        # docker exec and connects to localhost:8443 directly.
-        check {
-          name     = "alive"
-          type     = "script"
-          command  = "/usr/bin/curl"
-          args     = ["-sk", "--max-time", "5", "-o", "/dev/null", "https://localhost:8443"]
-          interval = "30s"
-          timeout  = "10s"
-        }
-      }
-
      volume_mount {
        volume      = "unraid_appdata_unifi_network"
        destination = "/unifi" # Expected root directory (contains data, log, cert subdirs)
@@ -2,23 +2,34 @@
 # Manual edits may be lost in future updates.

 provider "registry.terraform.io/dmacvicar/libvirt" {
-  version     = "0.7.6"
-  constraints = "0.7.6"
+  version     = "0.9.7"
+  constraints = "0.9.7"
  hashes = [
-    "h1:mmbm4vTyC/DCGO4Ed/vbp5AKvy1gmVn/94fzB9VmR08=",
-    "zh:0bde54f6f658b20b620b875daf106b5b25b1bae4d15408d6c5f06d58360e254d",
-    "zh:0c97c6930015918b8a34b6d7a2b0c3d17a649c226fcd1874fcba5bbbc0f35972",
-    "zh:1bdd7aa0011c5f024a09a124836ee9bc8e71b05a6ece810c61824275fd3f695f",
-    "zh:2b0cc7c794e4caf395d84ffff0b380d17e4b3219a4696264271bfe5059450efe",
-    "zh:2f8633f7fe07f76c188836ed6f93321ec5fbf5c004bc7699e1741d9b21ed5f37",
-    "zh:5bf47eed286ce55ed10a5cf657de49a34ab21cc8677c56fef3aab69cdde41a27",
-    "zh:7dca790fc5fd1d42bc4bc7170be003a7093602026d0f95c8aab84ad551fdf2a4",
-    "zh:80476b68bc84e3d661d1390025f83879b88f9cdc836de9751af09bd5716089cb",
-    "zh:82f3e2f3f50176cd6041c8ba36e295cbda1b289ef52ab75b5eceb0f921f64f7b",
-    "zh:a179b165f3b9bb9a67ebbbf9d73157ded33f02d476b2f58906389dca03b653c9",
-    "zh:acae54a5d0616f22b3180ddd8e8aad39af664e604394fdacf1f7b337bca2d5b4",
-    "zh:da4406a2428a9a7e98272c032cb93431c3919253af2fe9934b532d26c0deab09",
-    "zh:f63dbd8e579ab5268d01ffab4503b8a8e736b70d1a04e4f271559ba8dd133dcd",
-    "zh:f85c1d9e51a94ecde137435c9d6b0fb7be590437ea8a725334d1577eebbc550c",
+    "h1:2UgC5zSaQlQ6YkFCgNqejAi29ILgLdECAZyTEf/5jGc=",
+    "h1:2v7BBcq3D+4X4z3rEyVG7RsO+6mBowOsdqgDMc7hUdo=",
+    "h1:3Ipfiie71ruKDALSpPZecG3+wLleuqDiUmVDx1raOcc=",
+    "h1:Cm89jub5fHuqba/fsNn/wztI9g9F72s2DHV2qGlLdZ0=",
+    "h1:IFXvQT9JqeiXlAbQRQlNHpZ6LHV1ZTYpAOUUajen8Fw=",
+    "h1:KQ6ygrhp6zZobRovn6T57ZCPJcBNStJ0LR+EHY3Dklo=",
+    "h1:PVdYUKN4ZrUzDVWrydJExt4Ry6xboAiXl2+lK7RGz44=",
+    "h1:Q5ZOIKPi8iASnC7HFDualeA08S6tg9r4V37WBW0YbUI=",
+    "h1:SD92jZbvN4HfRzvds0/Y+imu39y0c5NuwtPuIj64zPU=",
+    "h1:W0pqgeoCVxzdr/2aUMIG+TfLYZSfAYv84IPoUm/UYSk=",
+    "h1:aiOjaz5bsvczvEfc78PWZCsPDvQmwVMzIebVAzIuhGc=",
+    "h1:osjWHVgSitvr0ycgZQEVMVX9ly33lq5bMiMKAUh4JU0=",
+    "h1:vdMblF3sJkstxm2zXE1z/0Hije42plcpynyDmqqjuD4=",
+    "zh:0892a2581f460333a8c140cc53110a1675657200cbd2a49d9f4667bc238d0098",
+    "zh:17c06d5ca81bda6ff8bdcab401a45b8345bbcb7e6964af5f4aa3099880d9cb8e",
+    "zh:2a01ce583bae2fd412a49860ab13e2736255241f5710c5427d6fa274b8a11cf8",
+    "zh:2d333b5e5a8eaf9269d0844c08563a86b7941175c656b17bb36e0bdfaf974bd2",
+    "zh:3e0bc0f1852fc32bbebd506fef074123a49452cffb737de5795c1c3f8e6a4802",
+    "zh:4ca9364bd4f5f7183bb3aca41d0d99b70beb7a9e01b94cc940123882e96b7001",
+    "zh:a7eb62a7e5ac71ee72abe7a6d183dce88968969eecef710bbe2fb5da0c84ca23",
+    "zh:c5c6f41a7165da93eaffda938c3ed11999a6ffbf635897e38026e622d438e6ad",
+    "zh:d3b595c75d2237ab39b690550dd9d6fe21b8a9a716e7ff94348e988575aad5a1",
+    "zh:d5572d18c21f055f71783b2dbe998895007f4e0d6aab8540f11f6a012f3b32c2",
+    "zh:e78950fd984805cddad8432f2283451059445baab8014c3b165038ff0887328e",
+    "zh:e8157504e9324892fb9860912cf765b9d333d3f6ca9bc24faf411ce729b3cdd2",
+    "zh:f7f7d41de689de068891a608a2b1b4f312cc41171aeea783f193285ca15968ca",
  ]
 }
@@ -2,7 +2,7 @@ terraform {
  required_providers {
    libvirt = {
      source = "dmacvicar/libvirt"
-      version = "0.7.6"
+      version = "0.9.7"
    }
  }
 }
@@ -188,8 +188,8 @@ Most jobs already have Consul health checks — these can use `health_check = "c
 | frigate    | ✅            | ✅ `single-node-writer` | ⚠️ same — rolling                                                                 |
 | glance     | ✅            | no                      | ✅ yes                                                                            |
 | transfer   | ✅            | ✅ `single-node-writer` | ⚠️ rolling                                                                        |
-| openreader | ✅ `/`        | ✅ `single-node-writer` | ⚠️ rolling                                                                        |
-| unifi      | ✅ script     | ✅ `single-node-writer` | ⚠️ rolling                                                                        |
+| openreader | ❌            | ✅ `single-node-writer` | ⚠️ add check first, then rolling                                                  |
+| unifi      | ❌            | ✅ `single-node-writer` | ⚠️ add check first, then rolling                                                  |
 | traefik    | (ingress)     | ✅                      | ⚠️ rolling — downtime risk, promote quickly                                       |
 | authelia   | (ingress)     | ✅                      | ✅ stateless config, canary fine                                                  |
 | renovate   | batch job     | n/a                     | n/a — no deployment model                                                         |
@@ -296,10 +296,10 @@ exit 1
 - [x] **Phase 1a**: Create `act-runner.nomad.hcl` + Terraform wrapper, register runner token in Gitea, get a hello-world workflow green
 - [x] **Phase 1b**: Add `terraform fmt` + `terraform validate -backend=false` workflow — no secrets needed
 - [x] **Phase 1c**: Add Nomad validate step — add `NOMAD_ADDR` + read-only `NOMAD_TOKEN` to Gitea secrets
- [x] **Phase 2**: Add image pull validation step to the workflow
+- [ ] **Phase 2**: Add image pull validation step to the workflow
 - [ ] **Phase 3a**: Add `update` stanzas to ntfy and glance (simplest, no volume conflict)
- [ ] **Phase 3b**: Add rolling `update` stanzas to remaining service jobs (jellyfin, sonarr, prowlarr, deluge, gitea, immich, transfer, frigate, openreader, unifi, authelia, traefik)
- [x] **Phase 3c**: Add health checks to openreader and unifi before adding update stanzas
+- [ ] **Phase 3b**: Add rolling `update` stanzas to remaining service jobs (jellyfin, sonarr, etc.)
+- [ ] **Phase 3c**: Add health checks to openreader and unifi before adding update stanzas
 - [ ] **Phase 4a**: Add on-push workflow that runs `terraform apply -auto-approve` using full credential set
 - [ ] **Phase 4b**: Add deployment promotion/revert polling script
 - [ ] **Phase 4c**: Wire ntfy notifications for promote/revert outcomes