Update Terraform cloudflare to >= 5

.gitea/workflows/ci.yml

@@ -52,39 +52,3 @@ jobs:
             echo "==> $f"
             nomad job validate "$f"
           done
-
-  image-pull:
-    name: Docker image pull validation
-    runs-on: ubuntu-latest
-    # Only run on PRs that touch nomad job specs
-    if: github.event_name == 'pull_request'
-
-    steps:
-      - uses: actions/checkout@v4
-        with:
-          fetch-depth: 0
-
-      - name: Pull changed images
-        run: |
-          git fetch origin ${{ github.base_ref }}
-          IMAGES=$(git diff origin/${{ github.base_ref }}...HEAD -- '*.nomad.hcl' \
-            | grep '^+\s*image\s*=' \
-            | grep -oP '"[^"]+:[^"]+"' \
-            | tr -d '"' \
-            | sort -u || true)
-
-          if [ -z "$IMAGES" ]; then
-            echo "No image changes detected, skipping pull."
-            exit 0
-          fi
-
-          FAILED=0
-          while IFS= read -r image; do
-            echo "==> Pulling $image"
-            if ! docker pull "$image"; then
-              echo "ERROR: Failed to pull $image"
-              FAILED=1
-            fi
-          done <<< "$IMAGES"
-
-          exit $FAILED

2-nomad-config/.terraform.lock.hcl

@@ -17,18 +17,25 @@ provider "registry.terraform.io/carlpett/sops" {
 }
 
 provider "registry.terraform.io/cloudflare/cloudflare" {
-  version     = "5.5.0"
+  version     = "5.18.0"
-  constraints = "~> 5.0"
+  constraints = ">= 5.0.0"
   hashes = [
-    "h1:wZhU174xytOMZ1t6uDUQiLtR/XKpi2RH9OzMz0XqP9Q=",
+    "h1:2FKT5YVLuHLmv7BnFxDC3UtipD3hSSrb0iJ9Ei2C/ks=",
-    "zh:178f29dee2edac39252780819f34004b1841770c61ee7fb5a625afaece6495cd",
+    "h1:6FoKYTGqaCvKctMEm1Y1c06mmY3I04jhCBRXEYe6mcQ=",
-    "zh:6faf26203167ae20ca5c8ece4a8bb1c4187137505058fb7b1a4bd5095823e648",
+    "h1:AhWro37kF118sAjRjIZ27CuV6kFpg1d+XYDo/7diyjU=",
-    "zh:97c91a95819336b8c41618919786ddd2dca643d28219d52af1d80b88018c6eec",
+    "h1:B9eoAx4QKNVuKHDahNl8JzuSLCCeIGAJiS0MckJu5wQ=",
-    "zh:bbc53670fc2613e3fe81b5bf7b8674c5ad083a206fa8af34f0f055a8d06b2d01",
+    "h1:KfnaaT3RFoyWvPHsNVmsrCV7QEAGPLGNyHWT9IY+bxY=",
-    "zh:d305bcb01249ada21b80e5038e371f6ca0a60d95d7052df82456e4c4963f3bfc",
+    "h1:SPFFA6LxyFkjpEnpWbyQVyVJVXxzP8RLpehfUMRXDp4=",
-    "zh:e2f9db57ead7100676b790a3e4567d88443fae0e19127e66b3505210de93e4b5",
+    "h1:VMUOof+Cf2h4asIe2lin7Fvf15mGWQ9mQYiuGhYM1aw=",
-    "zh:eb8cef2e6cbf05237b8a2f229314ae12c792ed5f8f60fe180102bdf17dc30841",
+    "h1:ny17Q/ce8iuHxppA/yIuRpCkVDtqhE+LDynWtv9/qwI=",
-    "zh:f51a5bb0130d2f42772988ee56723f176aa230701184a0f5598dbb1c7b4c3906",
+    "zh:47e7bdfd8eddd2685f383269c0b6936ef62edd6d8383c8d7757b0cce0a689737",
+    "zh:aa23eb6aa128667883cabc449ceca4072d0181f574cd727e08ebd6d69a4bfd48",
+    "zh:c3da673e05d3bd933c82e2b6ba0f85aa23c5e24fadd3932f7c066314feeb65a3",
+    "zh:c59f07c017fc78b79e80554a0737c9db2a2e681c3e46ff637942d28d1f1a3924",
+    "zh:d559074612835a37fa684d8d7d0cf68911487b71f4067acc59069cb00bb8baf0",
+    "zh:e12290a4eda757c183a4258230245dd170f0def389c37eb771db144ce3b382dd",
+    "zh:ed47e484432ba1bbbb4802061f395ebd253ae8e20be9b72552d3d830fd2ca268",
+    "zh:f35e08d468408697b3e7c4a7f548b874141ac8f8d395ab8edded322201cc7047",
     "zh:f809ab383cca0a5f83072981c64208cbd7fa67e986a86ee02dd2c82333221e32",
   ]
 }

2-nomad-config/2-ingress/main.tf

@@ -6,7 +6,7 @@ terraform {
     }
     cloudflare = {
       source  = "cloudflare/cloudflare"
-      version = "~> 5"
+      version = ">= 5"
     }
     postgresql = {
       source = "cyrilgdn/postgresql"

2-nomad-config/act-runner.nomad.hcl

@@ -29,6 +29,7 @@ job "act-runner" {
 
       env = {
         GITEA_INSTANCE_URL = "https://gitea-1ef0bea6b75a4fd3e9393a9f7f7e4b02.othrayte.one"
+        CONFIG_FILE        = "/secrets/runner-config.yml"
       }
 
       # Required SOPS key:
@@ -42,6 +43,19 @@ EOF
         env         = true
       }
 
+      # Limit which images/labels the runner will accept so it doesn't pick up
+      # unrelated workloads if more runners are added later.
+      template {
+        data        = <<EOF
+runner:
+  labels:
+    - "ubuntu-latest:docker://node:20-bookworm"
+    - "ubuntu-22.04:docker://node:20-bookworm"
+    - "ubuntu-24.04:docker://node:20-bookworm"
+EOF
+        destination = "secrets/runner-config.yml"
+      }
+
       resources {
         cpu        = 200
         memory     = 256

2-nomad-config/main.tf

@@ -12,7 +12,7 @@ terraform {
     }
     cloudflare = {
       source  = "cloudflare/cloudflare"
-      version = "~> 5"
+      version = ">= 5"
     }
     postgresql = {
       source = "cyrilgdn/postgresql"

archive/1-coreos/3-configure-hashistack/.terraform.lock.hcl

@@ -2,37 +2,24 @@
 # Manual edits may be lost in future updates.
 
 provider "registry.terraform.io/neuspaces/system" {
-  version     = "0.5.0"
+  version     = "0.4.0"
-  constraints = "0.5.0"
+  constraints = "0.4.0"
   hashes = [
-    "h1:+ATCBDOJs/ZlCiAZPo8sa2Uei8nTf1QQJT2670aIsTs=",
+    "h1:Vsp3ZoNGUnijGxcyKPJAnjzaifk2rcOaA6DtS4Wsdyk=",
-    "h1:/z7Qu/4siDYM3e+q9Vl466Htl6tEgFZJI3Pc69EOWEg=",
+    "zh:04862132feb60ff990e15f4b878e96fbcc296720bd31a39e7b0a8fe5788b5b33",
-    "h1:0TxsJOXyC4J73IitbyKIR60bCA75M2lPD5Bd9wIcxyg=",
+    "zh:1d8b6050274b5b915fbf241a66c63fe1b2088bc4720e0ef36a3d75a197a97d78",
-    "h1:4/GEbH8VSjgUrY6uMGUDDmSHOtQdo00cmluffNtAEFc=",
+    "zh:5263effc40349d48ed458ea5d418e7321db441d7987b35fabbdd3faa53ed114d",
-    "h1:Cf4hCIbocqgmkXR/3Ia5J0/g7Q8cMhPngiqMG5lWDwI=",
+    "zh:5b13d535084dacba3d511d5c815db4b5ae83e9c6226938bbf20a30c4e05116cb",
-    "h1:D++0aOhVEdVxs5lNE9xsBoDYo2fgSzF4N+pgLihzDMM=",
+    "zh:69da944ea0c86ec4e64ae844f580d13910fd66f1d8a9ecc7890ff0ace29aef36",
-    "h1:H4dAi3KIdS1mQved99YQPvwEeSuL/UpUZfc4sGPckvc=",
-    "h1:O6M7A59jpW2S9z/vew+VIlMkRekLd9u0E1u85qJfgp0=",
-    "h1:X5YuaWMt+e0XS6uHE+nOCfhxJ3pDE1j+/9lcCAM+NeI=",
-    "h1:dcSBPD23eJv0GWfTL/OHnncA5TG2n3WihRdEDFvGGO4=",
-    "h1:iGC3jfF4K7nag5gUsxqlW8sJUvMZawe9ZnWhZFA8qco=",
-    "h1:oQbsFw8oGS64I7HYwJtE06YLeOckrIlebsBYyWCCNaY=",
-    "h1:rm8Z3YHvxeNxo/jwgEyiFEolmi748Nm7WjOUaWqGEzU=",
-    "h1:xYNyeBWkDZaOoBfJ9czGX8VC1xdil5EP1aw0xN2ZUi8=",
-    "zh:1c2800a4606b9b73405da6eb6be729b1c36bb1047f3ba99e2a263568aa724a76",
-    "zh:1e49e76a4805faac59bb656fc6d9be0befe6cb5307965db790493b81a023c9a6",
-    "zh:29741b13600995b58a9949ce3fcb24ec088e59b1911526b53a7b2c0224e34ea9",
-    "zh:30b0e123506c796b325da67fa3249f151e928043b969e65a9f9aa88ea02c2078",
-    "zh:311198cee4a83fde0b7e5a23e1ba4a797cc7583b90865339d5fa5e53b17520f0",
-    "zh:3b6897b9b85bba36f0cf7afcb06c9e680db1b151537f2e0cb0ddec480ad939c4",
-    "zh:4c35205a53093747707e9970a323f17b4f2eec26947cf2cc62fc50ce1ee4040c",
-    "zh:51fc16a1ae8ae9ee821f4e57243a23fb3a0cf54116efafd0dacff7a6f7f270b5",
-    "zh:5ba4908783fc3b04c574301ad6ba1d4c8f67fb24b7f61fc88c66a970ef7b805e",
-    "zh:5e0e4da6386e63a2a2876007a7cdb10bad8ce9e55533104739322a5425fd0aa8",
     "zh:78d5eefdd9e494defcb3c68d282b8f96630502cac21d1ea161f53cfe9bb483b3",
-    "zh:86c846c6e5bac31d19696f4a0a7b0470c98bae88a756e7c204912ed3c019f162",
+    "zh:7fce212ccf0fd267a7f318c793e174605cbaa7814f9b30be16ed1d0526ab398f",
-    "zh:9e536df33fbee3672af9338992431bbad83efc53d4d38e8563eaaf1969d9fc4c",
+    "zh:97523ef340365bfaf759cc1eb4a202af7b27ac87e1cb5f0309a585d63e205bbd",
-    "zh:a0f11c8a9bcc524b1d7e8d727c598e5d1e065b580d5a50e2b6fd3264877e7b7b",
+    "zh:9f3fefa30abc39a1073e66b88701b5437f4b04b0082091408c97f6a8e5b64bd3",
-    "zh:a15c2a47eaf9eb7dfb251a6096cf383f872787cd5fa583763fdb5aac5c862f77",
+    "zh:e16d43079cc894bfb0980ff211ea1787cdb913f24826461a8967ac91fd146ea8",
+    "zh:e4630f531b59e813fa405942c7648252c741313ccd49bc1be85f2ea964016ed3",
+    "zh:ebd2549e8b5b2894efb0ba70f2f6034ae5fb5821d1e2831ba5af8fa5e5870829",
+    "zh:ed601fdbf4813d041b3773781e2331c7ea074f8a5b505d2b105059a89b44301c",
+    "zh:f08f8e3d05759b72421de4c54f6938396d3e13fdfdbe7505877b1c64342dfa3a",
+    "zh:fea9e0172235a52343826d77e8331bcfeb785d514b4f5ee39f524d541b1a8749",
   ]
 }

archive/1-coreos/3-configure-hashistack/jaglan-beta.tf

@@ -2,7 +2,7 @@ terraform {
   required_providers {
     system = {
       source = "neuspaces/system"
-      version = "0.5.0"
+      version = "0.4.0"
     }
   }
 }

cicd-plan.md

@@ -296,7 +296,7 @@ exit 1
 - [x] **Phase 1a**: Create `act-runner.nomad.hcl` + Terraform wrapper, register runner token in Gitea, get a hello-world workflow green
 - [x] **Phase 1b**: Add `terraform fmt` + `terraform validate -backend=false` workflow — no secrets needed
 - [x] **Phase 1c**: Add Nomad validate step — add `NOMAD_ADDR` + read-only `NOMAD_TOKEN` to Gitea secrets
-- [x] **Phase 2**: Add image pull validation step to the workflow
+- [ ] **Phase 2**: Add image pull validation step to the workflow
 - [ ] **Phase 3a**: Add `update` stanzas to ntfy and glance (simplest, no volume conflict)
 - [ ] **Phase 3b**: Add rolling `update` stanzas to remaining service jobs (jellyfin, sonarr, etc.)
 - [ ] **Phase 3c**: Add health checks to openreader and unifi before adding update stanzas