Update litestream/litestream Docker tag to v0.5.16

improve health checks across all nomad job specs
- traefik: TCP → HTTP check on /ping (enable ping entrypoint) - gitea: check path → /api/healthz - jellyfin: TCP → HTTP check on /health - glance: TCP → HTTP check on / - sonarr/prowlarr: check path / → /ping (×2 checks each) - ntfy/transfer/deluge/openreader/authelia/pgadmin: add name and port to existing checks - postgres: remove invalid TCP check (Connect-enabled service) - unifi: TCP → script check via curl (macvlan host isolation workaround)
2026-08-06 04:01:02 +00:00 · 2026-05-26 20:12:23 +10:00
18 changed files with 85 additions and 46 deletions
@@ -58,8 +58,10 @@ job "pgadmin" {
        ]

        check {
+          name     = "alive"
          type     = "http"
          path     = "/"
+          port     = "http"
          interval = "10s"
          timeout  = "2s"
        }
@@ -7,6 +7,10 @@ job "postgres" {
      connect {
        sidecar_service {}
      }
+
+      # Note: TCP checks are not valid for Connect-enabled services (runs through
+      # Envoy sidecar). Postgres is a single-writer DB that we never canary, so
+      # observable health via Consul is lower priority than other services.
    }

    task "postgres" {
@@ -33,8 +33,10 @@ job "authelia" {
      }

      check {
+        name     = "alive"
        type     = "http"
        path     = "/health"
+        port     = "http"
        interval = "10s"
        timeout  = "2s"
      }
@@ -35,7 +35,8 @@ job "traefik" {

      check {
        name     = "alive"
-        type     = "tcp"
+        type     = "http"
+        path     = "/ping"
        port     = "api"
        interval = "10s"
        timeout  = "2s"
@@ -85,6 +86,9 @@ api:
  dashboard: true
  insecure: true

+ping:
+  entryPoint: traefik
+
 providers:
  file:
    directory: "/etc/traefik/configs/"
@@ -54,8 +54,10 @@ EOH
      ]

      check {
+        name     = "alive"
        type     = "http"
        path     = "/"
+        port     = "http"
        interval = "10s"
        timeout  = "2s"
      }
@@ -78,8 +80,10 @@ EOH
      }

      check {
+        name     = "alive"
        type     = "http"
        path     = "/"
+        port     = "http"
        interval = "10s"
        timeout  = "2s"
      }
@@ -27,7 +27,7 @@ job "frigate" {
      driver = "docker"

      config {
-        image   = "litestream/litestream:0.5.9"
+        image   = "litestream/litestream:0.5.16"
        command = "restore"
        args    = ["-if-replica-exists", "-config", "/local/litestream.yml", "/alloc/data/frigate.db"]
      }
@@ -32,8 +32,10 @@ job "gitea" {
      ]

      check {
+        name     = "alive"
        type     = "http"
-        path     = "/"
+        path     = "/api/healthz"
+        port     = "http"
        interval = "10s"
        timeout  = "2s"
      }
@@ -12,7 +12,7 @@ job "glance" {
      driver = "docker"

      config {
-        image = "glanceapp/glance:latest"
+        image = "glanceapp/glance:v0.7.8"
        ports = ["http"]
        volumes = [
          "local/glance.yml:/app/config/glance.yml",
@@ -30,7 +30,8 @@ job "glance" {

        check {
          name     = "alive"
-          type     = "tcp"
+          type     = "http"
+          path     = "/"
          port     = "http"
          interval = "10s"
          timeout  = "2s"
@@ -28,10 +28,11 @@ job "jellyfin" {

        check {
          name     = "alive"
-          type     = "tcp"
+          type     = "http"
+          path     = "/health"
          port     = "http"
          interval = "10s"
-          timeout  = "2s"
+          timeout  = "5s"
        }
      }

@@ -33,8 +33,10 @@ job "ntfy" {
      ]

      check {
+        name     = "alive"
        type     = "http"
        path     = "/healthz"
+        port     = "http"
        interval = "10s"
        timeout  = "2s"
      }
@@ -31,8 +31,10 @@ job "openreader" {
      ]

      check {
+        name     = "alive"
        type     = "http"
        path     = "/"
+        port     = "http"
        interval = "10s"
        timeout  = "2s"
      }
@@ -48,8 +50,10 @@ job "openreader" {
      }

      check {
+        name     = "alive"
        type     = "http"
        path     = "/"
+        port     = "http"
        interval = "10s"
        timeout  = "2s"
      }
@@ -34,8 +34,9 @@ job "prowlarr" {
      ]

      check {
+        name     = "alive"
        type     = "http"
-        path     = "/"
+        path     = "/ping"
        interval = "10s"
        timeout  = "2s"
      }
@@ -51,8 +52,9 @@ job "prowlarr" {
      }

      check {
+        name     = "alive"
        type     = "http"
-        path     = "/"
+        path     = "/ping"
        interval = "10s"
        timeout  = "2s"
      }
@@ -37,8 +37,9 @@ job "sonarr" {
      ]

      check {
+        name     = "alive"
        type     = "http"
-        path     = "/"
+        path     = "/ping"
        interval = "10s"
        timeout  = "2s"
      }
@@ -54,8 +55,9 @@ job "sonarr" {
      }

      check {
+        name     = "alive"
        type     = "http"
-        path     = "/"
+        path     = "/ping"
        interval = "10s"
        timeout  = "2s"
      }
@@ -16,8 +16,10 @@ job "transfer" {
      ]

      check {
+        name     = "alive"
        type     = "http"
        path     = "/"
+        port     = "http"
        interval = "10s"
        timeout  = "2s"
      }
@@ -21,6 +21,26 @@ job "unifi-network" {
        UNIFI_STDOUT       = "true"
      }

+      # Register in Consul so Traefik and health checks can find it.
+      # address_mode=driver uses the macvlan IP (192.168.1.50) rather than the host IP.
+      service {
+        name         = "unifi-network"
+        port         = 8443
+        address_mode = "driver"
+
+        # TCP/HTTP checks from the Consul agent can't reach the macvlan IP (host↔macvlan
+        # isolation). Use a script check instead — it runs inside the container via
+        # docker exec and connects to localhost:8443 directly.
+        check {
+          name     = "alive"
+          type     = "script"
+          command  = "/usr/bin/curl"
+          args     = ["-sk", "--max-time", "5", "-o", "/dev/null", "https://localhost:8443"]
+          interval = "30s"
+          timeout  = "10s"
+        }
+      }
+
      volume_mount {
        volume      = "unraid_appdata_unifi_network"
        destination = "/unifi" # Expected root directory (contains data, log, cert subdirs)
@@ -2,37 +2,24 @@
 # Manual edits may be lost in future updates.

 provider "registry.terraform.io/neuspaces/system" {
-  version     = "0.5.0"
-  constraints = "0.5.0"
+  version     = "0.4.0"
+  constraints = "0.4.0"
  hashes = [
-    "h1:+ATCBDOJs/ZlCiAZPo8sa2Uei8nTf1QQJT2670aIsTs=",
-    "h1:/z7Qu/4siDYM3e+q9Vl466Htl6tEgFZJI3Pc69EOWEg=",
-    "h1:0TxsJOXyC4J73IitbyKIR60bCA75M2lPD5Bd9wIcxyg=",
-    "h1:4/GEbH8VSjgUrY6uMGUDDmSHOtQdo00cmluffNtAEFc=",
-    "h1:Cf4hCIbocqgmkXR/3Ia5J0/g7Q8cMhPngiqMG5lWDwI=",
-    "h1:D++0aOhVEdVxs5lNE9xsBoDYo2fgSzF4N+pgLihzDMM=",
-    "h1:H4dAi3KIdS1mQved99YQPvwEeSuL/UpUZfc4sGPckvc=",
-    "h1:O6M7A59jpW2S9z/vew+VIlMkRekLd9u0E1u85qJfgp0=",
-    "h1:X5YuaWMt+e0XS6uHE+nOCfhxJ3pDE1j+/9lcCAM+NeI=",
-    "h1:dcSBPD23eJv0GWfTL/OHnncA5TG2n3WihRdEDFvGGO4=",
-    "h1:iGC3jfF4K7nag5gUsxqlW8sJUvMZawe9ZnWhZFA8qco=",
-    "h1:oQbsFw8oGS64I7HYwJtE06YLeOckrIlebsBYyWCCNaY=",
-    "h1:rm8Z3YHvxeNxo/jwgEyiFEolmi748Nm7WjOUaWqGEzU=",
-    "h1:xYNyeBWkDZaOoBfJ9czGX8VC1xdil5EP1aw0xN2ZUi8=",
-    "zh:1c2800a4606b9b73405da6eb6be729b1c36bb1047f3ba99e2a263568aa724a76",
-    "zh:1e49e76a4805faac59bb656fc6d9be0befe6cb5307965db790493b81a023c9a6",
-    "zh:29741b13600995b58a9949ce3fcb24ec088e59b1911526b53a7b2c0224e34ea9",
-    "zh:30b0e123506c796b325da67fa3249f151e928043b969e65a9f9aa88ea02c2078",
-    "zh:311198cee4a83fde0b7e5a23e1ba4a797cc7583b90865339d5fa5e53b17520f0",
-    "zh:3b6897b9b85bba36f0cf7afcb06c9e680db1b151537f2e0cb0ddec480ad939c4",
-    "zh:4c35205a53093747707e9970a323f17b4f2eec26947cf2cc62fc50ce1ee4040c",
-    "zh:51fc16a1ae8ae9ee821f4e57243a23fb3a0cf54116efafd0dacff7a6f7f270b5",
-    "zh:5ba4908783fc3b04c574301ad6ba1d4c8f67fb24b7f61fc88c66a970ef7b805e",
-    "zh:5e0e4da6386e63a2a2876007a7cdb10bad8ce9e55533104739322a5425fd0aa8",
+    "h1:Vsp3ZoNGUnijGxcyKPJAnjzaifk2rcOaA6DtS4Wsdyk=",
+    "zh:04862132feb60ff990e15f4b878e96fbcc296720bd31a39e7b0a8fe5788b5b33",
+    "zh:1d8b6050274b5b915fbf241a66c63fe1b2088bc4720e0ef36a3d75a197a97d78",
+    "zh:5263effc40349d48ed458ea5d418e7321db441d7987b35fabbdd3faa53ed114d",
+    "zh:5b13d535084dacba3d511d5c815db4b5ae83e9c6226938bbf20a30c4e05116cb",
+    "zh:69da944ea0c86ec4e64ae844f580d13910fd66f1d8a9ecc7890ff0ace29aef36",
    "zh:78d5eefdd9e494defcb3c68d282b8f96630502cac21d1ea161f53cfe9bb483b3",
-    "zh:86c846c6e5bac31d19696f4a0a7b0470c98bae88a756e7c204912ed3c019f162",
-    "zh:9e536df33fbee3672af9338992431bbad83efc53d4d38e8563eaaf1969d9fc4c",
-    "zh:a0f11c8a9bcc524b1d7e8d727c598e5d1e065b580d5a50e2b6fd3264877e7b7b",
-    "zh:a15c2a47eaf9eb7dfb251a6096cf383f872787cd5fa583763fdb5aac5c862f77",
+    "zh:7fce212ccf0fd267a7f318c793e174605cbaa7814f9b30be16ed1d0526ab398f",
+    "zh:97523ef340365bfaf759cc1eb4a202af7b27ac87e1cb5f0309a585d63e205bbd",
+    "zh:9f3fefa30abc39a1073e66b88701b5437f4b04b0082091408c97f6a8e5b64bd3",
+    "zh:e16d43079cc894bfb0980ff211ea1787cdb913f24826461a8967ac91fd146ea8",
+    "zh:e4630f531b59e813fa405942c7648252c741313ccd49bc1be85f2ea964016ed3",
+    "zh:ebd2549e8b5b2894efb0ba70f2f6034ae5fb5821d1e2831ba5af8fa5e5870829",
+    "zh:ed601fdbf4813d041b3773781e2331c7ea074f8a5b505d2b105059a89b44301c",
+    "zh:f08f8e3d05759b72421de4c54f6938396d3e13fdfdbe7505877b1c64342dfa3a",
+    "zh:fea9e0172235a52343826d77e8331bcfeb785d514b4f5ee39f524d541b1a8749",
  ]
 }
@@ -2,7 +2,7 @@ terraform {
  required_providers {
    system = {
      source = "neuspaces/system"
-      version = "0.5.0"
+      version = "0.4.0"
    }
  }
 }
@@ -188,8 +188,8 @@ Most jobs already have Consul health checks — these can use `health_check = "c
 | frigate    | ✅            | ✅ `single-node-writer` | ⚠️ same — rolling                                                                 |
 | glance     | ✅            | no                      | ✅ yes                                                                            |
 | transfer   | ✅            | ✅ `single-node-writer` | ⚠️ rolling                                                                        |
-| openreader | ❌            | ✅ `single-node-writer` | ⚠️ add check first, then rolling                                                  |
-| unifi      | ❌            | ✅ `single-node-writer` | ⚠️ add check first, then rolling                                                  |
+| openreader | ✅ `/`        | ✅ `single-node-writer` | ⚠️ rolling                                                                        |
+| unifi      | ✅ script     | ✅ `single-node-writer` | ⚠️ rolling                                                                        |
 | traefik    | (ingress)     | ✅                      | ⚠️ rolling — downtime risk, promote quickly                                       |
 | authelia   | (ingress)     | ✅                      | ✅ stateless config, canary fine                                                  |
 | renovate   | batch job     | n/a                     | n/a — no deployment model                                                         |
@@ -298,8 +298,8 @@ exit 1
 - [x] **Phase 1c**: Add Nomad validate step — add `NOMAD_ADDR` + read-only `NOMAD_TOKEN` to Gitea secrets
 - [x] **Phase 2**: Add image pull validation step to the workflow
 - [ ] **Phase 3a**: Add `update` stanzas to ntfy and glance (simplest, no volume conflict)
- [ ] **Phase 3b**: Add rolling `update` stanzas to remaining service jobs (jellyfin, sonarr, etc.)
- [ ] **Phase 3c**: Add health checks to openreader and unifi before adding update stanzas
+- [ ] **Phase 3b**: Add rolling `update` stanzas to remaining service jobs (jellyfin, sonarr, prowlarr, deluge, gitea, immich, transfer, frigate, openreader, unifi, authelia, traefik)
+- [x] **Phase 3c**: Add health checks to openreader and unifi before adding update stanzas
 - [ ] **Phase 4a**: Add on-push workflow that runs `terraform apply -auto-approve` using full credential set
 - [ ] **Phase 4b**: Add deployment promotion/revert polling script
 - [ ] **Phase 4c**: Wire ntfy notifications for promote/revert outcomes
Author	SHA1	Message	Date
renovate	a09011119b	Update litestream/litestream Docker tag to v0.5.16 CI / Terraform fmt + validate (pull_request) Successful in 26s Details CI / Nomad job spec validate (pull_request) Successful in 24s Details CI / Docker image pull validation (pull_request) Successful in 17s Details	2026-08-06 04:01:02 +00:00
othrayte	e695485353	improve health checks across all nomad job specs CI / Terraform fmt + validate (pull_request) Successful in 27s Details CI / Nomad job spec validate (pull_request) Successful in 22s Details CI / Docker image pull validation (pull_request) Successful in 16s Details CI / Nomad job spec validate (push) Successful in 22s Details CI / Docker image pull validation (push) Has been skipped Details CI / Terraform fmt + validate (push) Successful in 23s Details - traefik: TCP → HTTP check on /ping (enable ping entrypoint) - gitea: check path → /api/healthz - jellyfin: TCP → HTTP check on /health - glance: TCP → HTTP check on / - sonarr/prowlarr: check path / → /ping (×2 checks each) - ntfy/transfer/deluge/openreader/authelia/pgadmin: add name and port to existing checks - postgres: remove invalid TCP check (Connect-enabled service) - unifi: TCP → script check via curl (macvlan host isolation workaround)	2026-05-26 20:12:23 +10:00