Update Terraform null to v3.3.1

- traefik: TCP → HTTP check on /ping (enable ping entrypoint)
- gitea: check path → /api/healthz
- jellyfin: TCP → HTTP check on /health
- glance: TCP → HTTP check on /
- sonarr/prowlarr: check path / → /ping (×2 checks each)
- ntfy/transfer/deluge/openreader/authelia/pgadmin: add name and port to existing checks
- postgres: remove invalid TCP check (Connect-enabled service)
- unifi: TCP → script check via curl (macvlan host isolation workaround)

1-nixos-node/.terraform.lock.hcl

@@ -2,22 +2,34 @@
 # Manual edits may be lost in future updates.
 
 provider "registry.terraform.io/hashicorp/null" {
-  version     = "3.2.1"
+  version     = "3.3.1"
-  constraints = "3.2.1"
+  constraints = "3.3.1"
   hashes = [
-    "h1:FbGfc+muBsC17Ohy5g806iuI1hQc4SIexpYCrQHQd8w=",
+    "h1:4pjRixNj9/nijyC0jrCr8tYOpZ8afFwZ2M86y81PMa0=",
-    "zh:58ed64389620cc7b82f01332e27723856422820cfd302e304b5f6c3436fb9840",
+    "h1:6H++HbVhT9h31TNdGvlkW+2rjeWzgdjy98zqWpEJbgk=",
-    "zh:62a5cc82c3b2ddef7ef3a6f2fedb7b9b3deff4ab7b414938b08e51d6e8be87cb",
+    "h1:8fi/ACgBQzyw1gloPdzewHbGNeNCX1roaKHRYA1oJIM=",
-    "zh:63cff4de03af983175a7e37e52d4bd89d990be256b16b5c7f919aff5ad485aa5",
+    "h1:EVks/Xyl9ffLEDraAp8RSsynzoVbTHOsof5n2niAsa0=",
-    "zh:74cb22c6700e48486b7cabefa10b33b801dfcab56f1a6ac9b6624531f3d36ea3",
+    "h1:GYp3g8OhJCT2nc0Nv5s8HPh9nsMydHbjyUh6P4sE+8w=",
+    "h1:KWpBuTftQiLorSdw8QDMivKf6IhvVV0RzrdWSN53Qzs=",
+    "h1:TuxJq10DVnRP7c5HBZPyyvQGcckNVfijyU1eXEu5e4M=",
+    "h1:VMDxsLCSHpRC04bNeQw0JTvm5HhShID64QCSPvi9DRc=",
+    "h1:c7EI8Sso93CiiAmD7P/53OOjAm5A7Q2+Z30aUTUFaEs=",
+    "h1:m5FqidbIgh+E9OigiZh8/xbkvpUQFSj3hZo/jqNLCLQ=",
+    "h1:mV9WSUbshqmqPnhbOg198pgnjJQNnYixjXlovJBbl54=",
+    "h1:oTK+zJCvllZur0nfzBZFGbflcZbvxnESJxepZprFRik=",
+    "zh:08c59776542ea16e5a8545752787b17ff412922182b4cfabe16139197be8ac44",
+    "zh:123109cc7e5ed6d515787fbc212f2a3fd5e75647bb24ab7c801ccd4d4ed42451",
+    "zh:14b3fa4372754b54844b41d5dbd4671a292d8d6828b90169061feb4d7b15dd05",
+    "zh:56a4daaa3212f57b764bf3d1f333141c6610c5f21abb240e0111221f7c7fa4d4",
     "zh:78d5eefdd9e494defcb3c68d282b8f96630502cac21d1ea161f53cfe9bb483b3",
-    "zh:79e553aff77f1cfa9012a2218b8238dd672ea5e1b2924775ac9ac24d2a75c238",
+    "zh:7e888a026dbacd2474a42264227ae35f639780f0f0c613529d10a95cd61988b3",
-    "zh:a1e06ddda0b5ac48f7e7c7d59e1ab5a4073bbcf876c73c0299e4610ed53859dc",
+    "zh:85a53646267e87d600df7124e4767ffde9bba3b6356d45d961618bdd68131cc7",
-    "zh:c37a97090f1a82222925d45d84483b2aa702ef7ab66532af6cbcfb567818b970",
+    "zh:8ffa0e9c7c39b2ab0905b472465d6e35ef0b776b3f6273bb34c150340b61bff1",
-    "zh:e4453fbebf90c53ca3323a92e7ca0f9961427d2f0ce0d2b65523cc04d5d999c2",
+    "zh:9846510a1841530d4403f4818e233f91e3b3bade7441047599fbf800742f65be",
-    "zh:e80a746921946d8b6761e77305b752ad188da60688cfd2059322875d363be5f5",
+    "zh:afa98d44860875f037c6def0a7e6ff208e042712ba771f620482b143cd336891",
-    "zh:fbdb892d9822ed0e4cb60f2fedbdbb556e4da0d88d3b942ae963ed6ff091e48f",
+    "zh:bdca130d9ef27488ae0b13bc8fd8019e8bbdd4f2ceff29da066bd333165d68c5",
-    "zh:fca01a623d90d0cad0843102f9b8b9fe0d3ff8244593bd817f126582b52dd694",
+    "zh:cb3b94cbca88210dd0d1f11e2b8a89333f48c3857faf8f70f589072ce7c28610",
+    "zh:f0c0ba87925fe32f84b80f7513b1efb1b0866f51f899ba825e95ad59ff09b018",
   ]
 }
 

1-nixos-node/node.tf

@@ -2,7 +2,7 @@ terraform {
   required_providers {
     null = {
       source  = "hashicorp/null"
-      version = "3.2.1"
+      version = "3.3.1"
     }
     template = {
       source  = "hashicorp/template"

2-nomad-config/1-data/pgadmin.nomad.hcl

@@ -58,8 +58,10 @@ job "pgadmin" {
         ]
 
         check {
+          name     = "alive"
           type     = "http"
           path     = "/"
+          port     = "http"
           interval = "10s"
           timeout  = "2s"
         }

2-nomad-config/1-data/postgres.nomad.hcl

@@ -7,6 +7,10 @@ job "postgres" {
       connect {
         sidecar_service {}
       }
+
+      # Note: TCP checks are not valid for Connect-enabled services (runs through
+      # Envoy sidecar). Postgres is a single-writer DB that we never canary, so
+      # observable health via Consul is lower priority than other services.
     }
 
     task "postgres" {

2-nomad-config/2-ingress/authelia.nomad.hcl

@@ -33,8 +33,10 @@ job "authelia" {
       }
 
       check {
+        name     = "alive"
         type     = "http"
         path     = "/health"
+        port     = "http"
         interval = "10s"
         timeout  = "2s"
       }

2-nomad-config/2-ingress/traefik.nomad.hcl

@@ -35,7 +35,8 @@ job "traefik" {
 
       check {
         name     = "alive"
-        type     = "tcp"
+        type     = "http"
+        path     = "/ping"
         port     = "api"
         interval = "10s"
         timeout  = "2s"
@@ -85,6 +86,9 @@ api:
   dashboard: true
   insecure: true
 
+ping:
+  entryPoint: traefik
+
 providers:
   file:
     directory: "/etc/traefik/configs/"

2-nomad-config/deluge.nomad.hcl

@@ -54,8 +54,10 @@ EOH
       ]
 
       check {
+        name     = "alive"
         type     = "http"
         path     = "/"
+        port     = "http"
         interval = "10s"
         timeout  = "2s"
       }
@@ -78,8 +80,10 @@ EOH
       }
 
       check {
+        name     = "alive"
         type     = "http"
         path     = "/"
+        port     = "http"
         interval = "10s"
         timeout  = "2s"
       }

2-nomad-config/gitea.nomad.hcl

@@ -32,8 +32,10 @@ job "gitea" {
       ]
 
       check {
+        name     = "alive"
         type     = "http"
-        path     = "/"
+        path     = "/api/healthz"
+        port     = "http"
         interval = "10s"
         timeout  = "2s"
       }

2-nomad-config/glance.nomad.hcl

@@ -12,7 +12,7 @@ job "glance" {
       driver = "docker"
 
       config {
-        image = "glanceapp/glance:latest"
+        image = "glanceapp/glance:v0.7.8"
         ports = ["http"]
         volumes = [
           "local/glance.yml:/app/config/glance.yml",
@@ -30,7 +30,8 @@ job "glance" {
 
         check {
           name     = "alive"
-          type     = "tcp"
+          type     = "http"
+          path     = "/"
           port     = "http"
           interval = "10s"
           timeout  = "2s"

2-nomad-config/jellyfin.nomad.hcl

@@ -28,10 +28,11 @@ job "jellyfin" {
 
         check {
           name     = "alive"
-          type     = "tcp"
+          type     = "http"
+          path     = "/health"
           port     = "http"
           interval = "10s"
-          timeout  = "2s"
+          timeout  = "5s"
         }
       }
 

2-nomad-config/ntfy.nomad.hcl

@@ -33,8 +33,10 @@ job "ntfy" {
       ]
 
       check {
+        name     = "alive"
         type     = "http"
         path     = "/healthz"
+        port     = "http"
         interval = "10s"
         timeout  = "2s"
       }

2-nomad-config/openreader.nomad.hcl

@@ -31,8 +31,10 @@ job "openreader" {
       ]
 
       check {
+        name     = "alive"
         type     = "http"
         path     = "/"
+        port     = "http"
         interval = "10s"
         timeout  = "2s"
       }
@@ -48,8 +50,10 @@ job "openreader" {
       }
 
       check {
+        name     = "alive"
         type     = "http"
         path     = "/"
+        port     = "http"
         interval = "10s"
         timeout  = "2s"
       }

2-nomad-config/prowlarr.nomad.hcl

@@ -34,8 +34,9 @@ job "prowlarr" {
       ]
 
       check {
+        name     = "alive"
         type     = "http"
-        path     = "/"
+        path     = "/ping"
         interval = "10s"
         timeout  = "2s"
       }
@@ -51,8 +52,9 @@ job "prowlarr" {
       }
 
       check {
+        name     = "alive"
         type     = "http"
-        path     = "/"
+        path     = "/ping"
         interval = "10s"
         timeout  = "2s"
       }

2-nomad-config/sonarr.nomad.hcl

@@ -37,8 +37,9 @@ job "sonarr" {
       ]
 
       check {
+        name     = "alive"
         type     = "http"
-        path     = "/"
+        path     = "/ping"
         interval = "10s"
         timeout  = "2s"
       }
@@ -54,8 +55,9 @@ job "sonarr" {
       }
 
       check {
+        name     = "alive"
         type     = "http"
-        path     = "/"
+        path     = "/ping"
         interval = "10s"
         timeout  = "2s"
       }

2-nomad-config/transfer.nomad.hcl

@@ -16,8 +16,10 @@ job "transfer" {
       ]
 
       check {
+        name     = "alive"
         type     = "http"
         path     = "/"
+        port     = "http"
         interval = "10s"
         timeout  = "2s"
       }

2-nomad-config/unifi.nomad.hcl

@@ -21,6 +21,26 @@ job "unifi-network" {
         UNIFI_STDOUT       = "true"
       }
 
+      # Register in Consul so Traefik and health checks can find it.
+      # address_mode=driver uses the macvlan IP (192.168.1.50) rather than the host IP.
+      service {
+        name         = "unifi-network"
+        port         = 8443
+        address_mode = "driver"
+
+        # TCP/HTTP checks from the Consul agent can't reach the macvlan IP (host↔macvlan
+        # isolation). Use a script check instead — it runs inside the container via
+        # docker exec and connects to localhost:8443 directly.
+        check {
+          name     = "alive"
+          type     = "script"
+          command  = "/usr/bin/curl"
+          args     = ["-sk", "--max-time", "5", "-o", "/dev/null", "https://localhost:8443"]
+          interval = "30s"
+          timeout  = "10s"
+        }
+      }
+
       volume_mount {
         volume      = "unraid_appdata_unifi_network"
         destination = "/unifi" # Expected root directory (contains data, log, cert subdirs)

archive/1-coreos/3-configure-hashistack/.terraform.lock.hcl

@@ -2,37 +2,24 @@
 # Manual edits may be lost in future updates.
 
 provider "registry.terraform.io/neuspaces/system" {
-  version     = "0.5.0"
+  version     = "0.4.0"
-  constraints = "0.5.0"
+  constraints = "0.4.0"
   hashes = [
-    "h1:+ATCBDOJs/ZlCiAZPo8sa2Uei8nTf1QQJT2670aIsTs=",
+    "h1:Vsp3ZoNGUnijGxcyKPJAnjzaifk2rcOaA6DtS4Wsdyk=",
-    "h1:/z7Qu/4siDYM3e+q9Vl466Htl6tEgFZJI3Pc69EOWEg=",
+    "zh:04862132feb60ff990e15f4b878e96fbcc296720bd31a39e7b0a8fe5788b5b33",
-    "h1:0TxsJOXyC4J73IitbyKIR60bCA75M2lPD5Bd9wIcxyg=",
+    "zh:1d8b6050274b5b915fbf241a66c63fe1b2088bc4720e0ef36a3d75a197a97d78",
-    "h1:4/GEbH8VSjgUrY6uMGUDDmSHOtQdo00cmluffNtAEFc=",
+    "zh:5263effc40349d48ed458ea5d418e7321db441d7987b35fabbdd3faa53ed114d",
-    "h1:Cf4hCIbocqgmkXR/3Ia5J0/g7Q8cMhPngiqMG5lWDwI=",
+    "zh:5b13d535084dacba3d511d5c815db4b5ae83e9c6226938bbf20a30c4e05116cb",
-    "h1:D++0aOhVEdVxs5lNE9xsBoDYo2fgSzF4N+pgLihzDMM=",
+    "zh:69da944ea0c86ec4e64ae844f580d13910fd66f1d8a9ecc7890ff0ace29aef36",
-    "h1:H4dAi3KIdS1mQved99YQPvwEeSuL/UpUZfc4sGPckvc=",
-    "h1:O6M7A59jpW2S9z/vew+VIlMkRekLd9u0E1u85qJfgp0=",
-    "h1:X5YuaWMt+e0XS6uHE+nOCfhxJ3pDE1j+/9lcCAM+NeI=",
-    "h1:dcSBPD23eJv0GWfTL/OHnncA5TG2n3WihRdEDFvGGO4=",
-    "h1:iGC3jfF4K7nag5gUsxqlW8sJUvMZawe9ZnWhZFA8qco=",
-    "h1:oQbsFw8oGS64I7HYwJtE06YLeOckrIlebsBYyWCCNaY=",
-    "h1:rm8Z3YHvxeNxo/jwgEyiFEolmi748Nm7WjOUaWqGEzU=",
-    "h1:xYNyeBWkDZaOoBfJ9czGX8VC1xdil5EP1aw0xN2ZUi8=",
-    "zh:1c2800a4606b9b73405da6eb6be729b1c36bb1047f3ba99e2a263568aa724a76",
-    "zh:1e49e76a4805faac59bb656fc6d9be0befe6cb5307965db790493b81a023c9a6",
-    "zh:29741b13600995b58a9949ce3fcb24ec088e59b1911526b53a7b2c0224e34ea9",
-    "zh:30b0e123506c796b325da67fa3249f151e928043b969e65a9f9aa88ea02c2078",
-    "zh:311198cee4a83fde0b7e5a23e1ba4a797cc7583b90865339d5fa5e53b17520f0",
-    "zh:3b6897b9b85bba36f0cf7afcb06c9e680db1b151537f2e0cb0ddec480ad939c4",
-    "zh:4c35205a53093747707e9970a323f17b4f2eec26947cf2cc62fc50ce1ee4040c",
-    "zh:51fc16a1ae8ae9ee821f4e57243a23fb3a0cf54116efafd0dacff7a6f7f270b5",
-    "zh:5ba4908783fc3b04c574301ad6ba1d4c8f67fb24b7f61fc88c66a970ef7b805e",
-    "zh:5e0e4da6386e63a2a2876007a7cdb10bad8ce9e55533104739322a5425fd0aa8",
     "zh:78d5eefdd9e494defcb3c68d282b8f96630502cac21d1ea161f53cfe9bb483b3",
-    "zh:86c846c6e5bac31d19696f4a0a7b0470c98bae88a756e7c204912ed3c019f162",
+    "zh:7fce212ccf0fd267a7f318c793e174605cbaa7814f9b30be16ed1d0526ab398f",
-    "zh:9e536df33fbee3672af9338992431bbad83efc53d4d38e8563eaaf1969d9fc4c",
+    "zh:97523ef340365bfaf759cc1eb4a202af7b27ac87e1cb5f0309a585d63e205bbd",
-    "zh:a0f11c8a9bcc524b1d7e8d727c598e5d1e065b580d5a50e2b6fd3264877e7b7b",
+    "zh:9f3fefa30abc39a1073e66b88701b5437f4b04b0082091408c97f6a8e5b64bd3",
-    "zh:a15c2a47eaf9eb7dfb251a6096cf383f872787cd5fa583763fdb5aac5c862f77",
+    "zh:e16d43079cc894bfb0980ff211ea1787cdb913f24826461a8967ac91fd146ea8",
+    "zh:e4630f531b59e813fa405942c7648252c741313ccd49bc1be85f2ea964016ed3",
+    "zh:ebd2549e8b5b2894efb0ba70f2f6034ae5fb5821d1e2831ba5af8fa5e5870829",
+    "zh:ed601fdbf4813d041b3773781e2331c7ea074f8a5b505d2b105059a89b44301c",
+    "zh:f08f8e3d05759b72421de4c54f6938396d3e13fdfdbe7505877b1c64342dfa3a",
+    "zh:fea9e0172235a52343826d77e8331bcfeb785d514b4f5ee39f524d541b1a8749",
   ]
 }

archive/1-coreos/3-configure-hashistack/jaglan-beta.tf

@@ -2,7 +2,7 @@ terraform {
   required_providers {
     system = {
       source = "neuspaces/system"
-      version = "0.5.0"
+      version = "0.4.0"
     }
   }
 }

cicd-plan.md

@@ -188,8 +188,8 @@ Most jobs already have Consul health checks — these can use `health_check = "c
 | frigate    | ✅            | ✅ `single-node-writer` | ⚠️ same — rolling                                                                 |
 | glance     | ✅            | no                      | ✅ yes                                                                            |
 | transfer   | ✅            | ✅ `single-node-writer` | ⚠️ rolling                                                                        |
-| openreader | ❌            | ✅ `single-node-writer` | ⚠️ add check first, then rolling                                                  |
+| openreader | ✅ `/`        | ✅ `single-node-writer` | ⚠️ rolling                                                                        |
-| unifi      | ❌            | ✅ `single-node-writer` | ⚠️ add check first, then rolling                                                  |
+| unifi      | ✅ script     | ✅ `single-node-writer` | ⚠️ rolling                                                                        |
 | traefik    | (ingress)     | ✅                      | ⚠️ rolling — downtime risk, promote quickly                                       |
 | authelia   | (ingress)     | ✅                      | ✅ stateless config, canary fine                                                  |
 | renovate   | batch job     | n/a                     | n/a — no deployment model                                                         |
@@ -298,8 +298,8 @@ exit 1
 - [x] **Phase 1c**: Add Nomad validate step — add `NOMAD_ADDR` + read-only `NOMAD_TOKEN` to Gitea secrets
 - [x] **Phase 2**: Add image pull validation step to the workflow
 - [ ] **Phase 3a**: Add `update` stanzas to ntfy and glance (simplest, no volume conflict)
-- [ ] **Phase 3b**: Add rolling `update` stanzas to remaining service jobs (jellyfin, sonarr, etc.)
+- [ ] **Phase 3b**: Add rolling `update` stanzas to remaining service jobs (jellyfin, sonarr, prowlarr, deluge, gitea, immich, transfer, frigate, openreader, unifi, authelia, traefik)
-- [ ] **Phase 3c**: Add health checks to openreader and unifi before adding update stanzas
+- [x] **Phase 3c**: Add health checks to openreader and unifi before adding update stanzas
 - [ ] **Phase 4a**: Add on-push workflow that runs `terraform apply -auto-approve` using full credential set
 - [ ] **Phase 4b**: Add deployment promotion/revert polling script
 - [ ] **Phase 4c**: Wire ntfy notifications for promote/revert outcomes