viktor/infra
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

feat: pin ~28 images to specific versions, enable DIUN monitoring, add app-stacks pipeline

Browse source 
Pin third-party images from :latest to current stable versions:
- Platform: cloudflared, technitium, snmp-exporter, pve-exporter,
  headscale, shadowsocks, xray
- Apps: paperless-ngx, linkwarden, wealthfolio, speedtest, synapse,
  n8n, prowlarr, qbittorrent, lidarr, rybbit, ollama, immichframe,
  cyberchef, networking-toolbox, echo, coturn, shlink, affine

Enable DIUN annotations on all pinned deployments with per-image
tag patterns. Add Woodpecker app-stacks pipeline for selective
terragrunt apply on changed app stacks.
This commit is contained in:
Viktor Barzin 2026-04-06 14:27:13 +03:00
parent a81f7df2a0
commit 09b4bad958
30 changed files with 233 additions and 46 deletions
Download patch file Download diff file Expand all files Collapse all files

122
.woodpecker/app-stacks.yml Normal file
View file

@ -0,0 +1,122 @@
when:
event: push
branch: master
# Only trigger when application stack files change
path:
include:
- 'stacks/**'
exclude:
- '.woodpecker/**'
clone:
git:
image: woodpeckerci/plugin-git
settings:
attempts: 5
backoff: 10s
steps:
- name: detect-changes
image: alpine
commands:
- apk add --no-cache git
# Detect which stacks changed in the latest commit
- |
CHANGED=$(git diff --name-only HEAD~1 HEAD 2>/dev/null | grep '^stacks/' | cut -d/ -f2 | sort -u || true)
if [ -z "$CHANGED" ]; then
echo "No stack changes detected"
echo "" > .stacks_to_apply
exit 0
fi
# Exclude platform stacks (handled by default.yml)
PLATFORM="dbaas authentik crowdsec monitoring nvidia mailserver cloudflared kyverno metallb redis traefik technitium headscale rbac k8s-portal vaultwarden reverse-proxy metrics-server vpa nfs-csi iscsi-csi cnpg sealed-secrets uptime-kuma wireguard xray infra-maintenance platform vault reloader descheduler external-secrets"
APPLY=""
for stack in $CHANGED; do
if echo "$PLATFORM" | grep -qw "$stack"; then
echo "Skipping platform stack: $stack"
continue
fi
if [ ! -f "stacks/$stack/terragrunt.hcl" ]; then
echo "Skipping $stack (no terragrunt.hcl)"
continue
fi
APPLY="$APPLY $stack"
done
echo "$APPLY" > .stacks_to_apply
echo "Stacks to apply:$APPLY"
- name: prepare
image: alpine
commands:
- "apk update && apk add jq curl git git-crypt"
- |
curl -k https://10.0.20.100:6443/api/v1/namespaces/woodpecker/configmaps/git-crypt-key -H "Authorization:Bearer $(cat /var/run/secrets/kubernetes.io/serviceaccount/token)" | jq -r .data.key | base64 -d > /tmp/key
- "git-crypt unlock /tmp/key && rm /tmp/key"
- |
SA_TOKEN=$(cat /var/run/secrets/kubernetes.io/serviceaccount/token)
VAULT_TOKEN=$(curl -s -X POST http://vault-active.vault.svc.cluster.local:8200/v1/auth/kubernetes/login \
-d "{\"role\":\"ci\",\"jwt\":\"$SA_TOKEN\"}" | jq -r .auth.client_token)
echo "export VAULT_TOKEN=$VAULT_TOKEN" > .vault-env
echo "export VAULT_ADDR=http://vault-active.vault.svc.cluster.local:8200" >> .vault-env
when:
evaluate: 'CI_COMMIT_MESSAGE != "" && !contains(CI_COMMIT_MESSAGE, "[CI SKIP]")'
- name: terragrunt-apply
image: alpine
backend_options:
kubernetes:
resources:
requests:
memory: 2Gi
limits:
memory: 4Gi
commands:
- "apk update && apk add curl unzip git openssh-client"
- "wget -qO /tmp/terraform.zip https://releases.hashicorp.com/terraform/1.5.7/terraform_1.5.7_linux_amd64.zip"
- "unzip -o /tmp/terraform.zip -d /usr/local/bin/ && chmod 755 /usr/local/bin/terraform"
- "wget -qO /usr/local/bin/terragrunt https://github.com/gruntwork-io/terragrunt/releases/download/v0.99.4/terragrunt_linux_amd64"
- "chmod 755 /usr/local/bin/terragrunt"
- "source .vault-env"
- |
STACKS=$(cat .stacks_to_apply)
if [ -z "$STACKS" ]; then
echo "No app stacks to apply"
exit 0
fi
FAILED=""
for stack in $STACKS; do
echo "=== Applying: $stack ==="
(cd stacks/$stack && terragrunt apply --non-interactive -auto-approve) &
done
wait
when:
evaluate: 'CI_COMMIT_MESSAGE != "" && !contains(CI_COMMIT_MESSAGE, "[CI SKIP]")'
- name: cleanup-and-push
image: alpine
commands:
- "rm -f .vault-env"
- "apk update && apk add openssh-client git git-crypt"
- "mkdir -p ~/.ssh && ssh-keyscan -H github.com >> ~/.ssh/known_hosts"
- "chmod 400 secrets/deploy_key"
- "git add stacks/ state/ .woodpecker/ || true"
- "git remote set-url origin git@github.com:ViktorBarzin/infra.git"
- "git commit -m 'Woodpecker CI app-stacks deploy commit [CI SKIP]' || echo 'No changes'"
- "GIT_SSH_COMMAND='ssh -i ./secrets/deploy_key -o IdentitiesOnly=yes' git pull --rebase origin master || true"
- "GIT_SSH_COMMAND='ssh -i ./secrets/deploy_key -o IdentitiesOnly=yes' git push origin master"
when:
status: [success, failure]
- name: slack
image: curlimages/curl
commands:
- |
STACKS=$(cat .stacks_to_apply 2>/dev/null || echo "none")
curl -s -X POST -H 'Content-type: application/json' \
--data "{\"channel\":\"general\",\"text\":\"Woodpecker CI: app-stacks pipeline ${CI_PIPELINE_STATUS} (stacks:${STACKS})\"}" \
"$SLACK_WEBHOOK" || true
environment:
SLACK_WEBHOOK:
from_secret: slack_webhook
when:
status: [success, failure]

6
stacks/affine/main.tf
View file

@ -203,6 +203,8 @@ resource "kubernetes_deployment" "affine" {
app = "affine"
}
annotations = {
"diun.enable" = "true"
"diun.include_tags" = "^\\d+\\.\\d+\\.\\d+$"
"dependency.kyverno.io/wait-for" = "postgresql.dbaas:5432,redis.redis:6379"
}
}
@ -210,7 +212,7 @@ resource "kubernetes_deployment" "affine" {
# Init container to run database migrations
init_container {
name = "migration"
image = "ghcr.io/toeverything/affine:stable"
image = "ghcr.io/toeverything/affine:0.20.7"
command = ["sh", "-c", "npx prisma migrate deploy && SERVER_FLAVOR=script node ./dist/main.js run"]
dynamic "env" {
@ -253,7 +255,7 @@ resource "kubernetes_deployment" "affine" {
container {
name = "affine"
image = "ghcr.io/toeverything/affine:stable"
image = "ghcr.io/toeverything/affine:0.20.7"
port {
container_port = 3010

6
stacks/coturn/main.tf
View file

@ -139,12 +139,16 @@ resource "kubernetes_deployment" "coturn" {
labels = {
app = "coturn"
}
annotations = {
"diun.enable" = "true"
"diun.include_tags" = "^\\d+\\.\\d+\\.\\d+-r\\d+$"
}
}
spec {
container {
name = "coturn"
image = "coturn/coturn:latest"
image = "coturn/coturn:4.6.3-r1"
args = ["-c", "/etc/turnserver/turnserver.conf"]
# STUN/TURN signaling port

6
stacks/cyberchef/main.tf
View file

@ -46,10 +46,14 @@ resource "kubernetes_deployment" "cyberchef" {
labels = {
app = "cyberchef"
}
annotations = {
"diun.enable" = "true"
"diun.include_tags" = "^v\\d+\\.\\d+\\.\\d+$"
}
}
spec {
container {
image = "mpepping/cyberchef:latest"
image = "mpepping/cyberchef:v10.24.0"
name = "cyberchef"
port {

4
stacks/dawarich/main.tf
View file

@ -82,8 +82,8 @@ resource "kubernetes_deployment" "dawarich" {
app = "dawarich"
}
annotations = {
# "diun.enable" = "true"
# "diun.include_tags" = "latest"
"diun.enable" = "true"
"diun.include_tags" = "^v?\\d+\\.\\d+\\.\\d+$"
"dependency.kyverno.io/wait-for" = "postgresql.dbaas:5432,redis.redis:6379"
}
}

6
stacks/echo/main.tf
View file

@ -41,10 +41,14 @@ resource "kubernetes_deployment" "echo" {
labels = {
app = "echo"
}
annotations = {
"diun.enable" = "true"
"diun.include_tags" = "^\\d+$"
}
}
spec {
container {
image = "mendhak/http-https-echo"
image = "mendhak/http-https-echo:36"
name = "echo"
port {
container_port = 8080

2
stacks/immich/frame.tf
View file

@ -64,7 +64,7 @@ resource "kubernetes_deployment" "immich-frame" {
}
spec {
container {
image = "ghcr.io/immichframe/immichframe:latest"
image = "ghcr.io/immichframe/immichframe:1.7.4"
name = "immich-frame"
resources {
requests = {

6
stacks/linkwarden/main.tf
View file

@ -128,14 +128,14 @@ resource "kubernetes_deployment" "linkwarden" {
app = "linkwarden"
}
annotations = {
"diun.enable" = "false"
"diun.include_tags" = "latest"
"diun.enable" = "true"
"diun.include_tags" = "^v?\\d+\\.\\d+\\.\\d+$"
"dependency.kyverno.io/wait-for" = "postgresql.dbaas:5432"
}
}
spec {
container {
image = "ghcr.io/linkwarden/linkwarden:latest"
image = "ghcr.io/linkwarden/linkwarden:v2.9.1"
name = "linkwarden"
port {

6
stacks/matrix/main.tf
View file

@ -111,13 +111,15 @@ resource "kubernetes_deployment" "matrix" {
app = "matrix"
}
annotations = {
"diun.enable" = "true"
"diun.include_tags" = "^v\\d+\\.\\d+\\.\\d+$"
"dependency.kyverno.io/wait-for" = "pg-cluster-rw.dbaas:5432"
}
}
spec {
init_container {
name = "install-psycopg2"
image = "matrixdotorg/synapse:latest"
image = "matrixdotorg/synapse:v1.125.0"
command = ["/bin/sh", "-c", "pip install --target=/extra-packages psycopg2-binary 2>/dev/null"]
volume_mount {
name = "extra-packages"
@ -150,7 +152,7 @@ resource "kubernetes_deployment" "matrix" {
}
}
container {
image = "matrixdotorg/synapse:latest"
image = "matrixdotorg/synapse:v1.125.0"
name = "matrix"
port {
container_port = 8008

4
stacks/n8n/main.tf
View file

@ -148,6 +148,8 @@ resource "kubernetes_deployment" "n8n" {
app = "n8n"
}
annotations = {
"diun.enable" = "true"
"diun.include_tags" = "^\\d+\\.\\d+\\.\\d+$"
"dependency.kyverno.io/wait-for" = "postgresql.dbaas:5432"
}
}
@ -155,7 +157,7 @@ resource "kubernetes_deployment" "n8n" {
service_account_name = kubernetes_service_account.n8n.metadata[0].name
container {
name = "n8n"
image = "docker.n8n.io/n8nio/n8n"
image = "docker.n8n.io/n8nio/n8n:1.80.0"
env {
name = "DB_TYPE"
value = "postgresdb"

6
stacks/networking-toolbox/main.tf
View file

@ -41,10 +41,14 @@ resource "kubernetes_deployment" "networking-toolbox" {
labels = {
app = "networking-toolbox"
}
annotations = {
"diun.enable" = "true"
"diun.include_tags" = "^\\d+\\.\\d+\\.\\d+$"
}
}
spec {
container {
image = "lissy93/networking-toolbox"
image = "lissy93/networking-toolbox:1.1.1"
name = "networking-toolbox"
port {
container_port = 3000

6
stacks/ollama/main.tf
View file

@ -132,6 +132,10 @@ resource "kubernetes_deployment" "ollama" {
labels = {
app = "ollama"
}
annotations = {
"diun.enable" = "true"
"diun.include_tags" = "^\\d+\\.\\d+\\.\\d+$"
}
}
spec {
node_selector = {
@ -143,7 +147,7 @@ resource "kubernetes_deployment" "ollama" {
effect = "NoSchedule"
}
container {
image = "ollama/ollama:latest"
image = "ollama/ollama:0.6.10"
name = "ollama"
env {
name = "OLLAMA_HOST"

4
stacks/paperless-ngx/main.tf
View file

@ -119,14 +119,14 @@ resource "kubernetes_deployment" "paperless-ngx" {
app = "paperless-ngx"
}
annotations = {
"diun.enable" = "false"
"diun.enable" = "true"
"diun.include_tags" = "^\\d+(?:\\.\\d+)?(?:\\.\\d+)?$"
"dependency.kyverno.io/wait-for" = "mysql.dbaas:3306,redis.redis:6379"
}
}
spec {
container {
image = "ghcr.io/paperless-ngx/paperless-ngx:latest"
image = "ghcr.io/paperless-ngx/paperless-ngx:2.16.4"
name = "paperless-ngx"
env {
name = "PAPERLESS_REDIS"

6
stacks/platform/modules/cloudflared/main.tf
View file

@ -45,6 +45,10 @@ resource "kubernetes_deployment" "cloudflared" {
labels = {
app = "cloudflared"
}
annotations = {
"diun.enable" = "true"
"diun.include_tags" = "^\\d{4}\\.\\d+\\.\\d+$"
}
}
spec {
topology_spread_constraint {
@ -59,7 +63,7 @@ resource "kubernetes_deployment" "cloudflared" {
}
container {
# image = "wisdomsky/cloudflared-web:latest"
image = "cloudflare/cloudflared"
image = "cloudflare/cloudflared:2026.3.0"
name = "cloudflared"
command = ["cloudflared", "tunnel", "run"]
env {

7
stacks/platform/modules/headscale/main.tf
View file

@ -64,15 +64,14 @@ resource "kubernetes_deployment" "headscale" {
app = "headscale"
}
annotations = {
# "diun.enable" = "true"
"diun.enable" = "false"
"diun.enable" = "true"
"diun.include_tags" = "^\\d+(?:\\.\\d+)?(?:\\.\\d+)?$"
}
}
spec {
container {
image = "headscale/headscale:0.23.0"
# image = "headscale/headscale:0.23.0-debug" # -debug is for debug images
image = "headscale/headscale:0.28.0"
# image = "headscale/headscale:0.28.0-debug" # -debug is for debug images
name = "headscale"
command = ["headscale", "serve"]

6
stacks/platform/modules/monitoring/pve_exporter.tf
View file

@ -38,12 +38,16 @@ resource "kubernetes_deployment" "pve_exporter" {
labels = {
app = "proxmox-exporter"
}
annotations = {
"diun.enable" = "true"
"diun.include_tags" = "^\\d+\\.\\d+\\.\\d+$"
}
}
spec {
container {
name = "proxmox-exporter"
image = "prompve/prometheus-pve-exporter:latest"
image = "prompve/prometheus-pve-exporter:3.8.2"
port {
container_port = 9221

6
stacks/platform/modules/monitoring/snmp_exporter.tf
View file

@ -48,10 +48,14 @@ resource "kubernetes_deployment" "snmp-exporter" {
labels = {
app = "snmp-exporter"
}
annotations = {
"diun.enable" = "true"
"diun.include_tags" = "^v\\d+\\.\\d+\\.\\d+$"
}
}
spec {
container {
image = "prom/snmp-exporter"
image = "prom/snmp-exporter:v0.30.1"
name = "snmp-exporter"
# command = ["/usr/local/bin/redfish_exporter", "--config.file", "/app/config.yml"]

2
stacks/platform/modules/technitium/ha.tf
View file

@ -93,7 +93,7 @@ resource "kubernetes_deployment" "technitium_secondary" {
}
}
container {
image = "technitium/dns-server:latest"
image = "technitium/dns-server:14.3.0"
name = "technitium"
env {
name = "DNS_SERVER_ADMIN_PASSWORD"

7
stacks/platform/modules/technitium/main.tf
View file

@ -119,9 +119,8 @@ resource "kubernetes_deployment" "technitium" {
template {
metadata {
annotations = {
"diun.enable" = "false"
# "diun.include_tags" = "^\\d+(?:\\.\\d+)?(?:\\.\\d+)?$"
"diun.include_tags" = "latest"
"diun.enable" = "true"
"diun.include_tags" = "^\\d+\\.\\d+\\.\\d+$"
}
labels = {
app = "technitium"
@ -161,7 +160,7 @@ resource "kubernetes_deployment" "technitium" {
}
}
container {
image = "technitium/dns-server:latest"
image = "technitium/dns-server:14.3.0"
name = "technitium"
resources {
requests = {

6
stacks/platform/modules/xray/main.tf
View file

@ -80,10 +80,14 @@ resource "kubernetes_deployment" "xray" {
labels = {
app = "xray"
}
annotations = {
"diun.enable" = "true"
"diun.include_tags" = "^\\d+\\.\\d+\\.\\d+$"
}
}
spec {
container {
image = "teddysun/xray"
image = "teddysun/xray:26.3.27"
name = "xray"
image_pull_policy = "IfNotPresent"
port {

6
stacks/rybbit/main.tf
View file

@ -316,12 +316,14 @@ resource "kubernetes_deployment" "rybbit" {
app = "rybbit"
}
annotations = {
"diun.enable" = "true"
"diun.include_tags" = "^v?\\d+\\.\\d+\\.\\d+$"
"dependency.kyverno.io/wait-for" = "postgresql.dbaas:5432,clickhouse.rybbit:8123"
}
}
spec {
container {
image = "ghcr.io/rybbit-io/rybbit-backend:latest"
image = "ghcr.io/rybbit-io/rybbit-backend:v1.0.21"
name = "rybbit"
env {
@ -477,7 +479,7 @@ resource "kubernetes_deployment" "rybbit-client" {
spec {
container {
name = "rybbit-client"
image = "ghcr.io/rybbit-io/rybbit-client:latest"
image = "ghcr.io/rybbit-io/rybbit-client:v1.0.20"
env {
name = "NODE_ENV"
value = "production"

6
stacks/servarr/lidarr/main.tf
View file

@ -43,10 +43,14 @@ resource "kubernetes_deployment" "lidarr" {
labels = {
app = "lidarr"
}
annotations = {
"diun.enable" = "true"
"diun.include_tags" = "^\\d+\\.\\d+\\.\\d+$"
}
}
spec {
container {
image = "lscr.io/linuxserver/lidarr:latest"
image = "lscr.io/linuxserver/lidarr:2.9.4"
# image = "youegraillot/lidarr-on-steroids"
name = "lidarr"

6
stacks/servarr/prowlarr/main.tf
View file

@ -72,10 +72,14 @@ resource "kubernetes_deployment" "prowlarr" {
labels = {
app = "prowlarr"
}
annotations = {
"diun.enable" = "true"
"diun.include_tags" = "^\\d+\\.\\d+\\.\\d+$"
}
}
spec {
container {
image = "lscr.io/linuxserver/prowlarr:latest"
image = "lscr.io/linuxserver/prowlarr:1.31.1"
name = "prowlarr"
resources {

6
stacks/servarr/qbittorrent/main.tf
View file

@ -80,10 +80,14 @@ resource "kubernetes_deployment" "qbittorrent" {
labels = {
app = "qbittorrent"
}
annotations = {
"diun.enable" = "true"
"diun.include_tags" = "^\\d+\\.\\d+\\.\\d+$"
}
}
spec {
container {
image = "lscr.io/linuxserver/qbittorrent:latest"
image = "lscr.io/linuxserver/qbittorrent:5.0.4"
name = "qbittorrent"
port {

6
stacks/shadowsocks/main.tf
View file

@ -66,11 +66,15 @@ resource "kubernetes_deployment" "shadowsocks" {
labels = {
"app" = "shadowsocks"
}
annotations = {
"diun.enable" = "true"
"diun.include_tags" = "^v\\d+\\.\\d+\\.\\d+$"
}
}
spec {
container {
name = "shadowsocks"
image = "shadowsocks/shadowsocks-libev"
image = "shadowsocks/shadowsocks-libev:v3.3.5"
image_pull_policy = "IfNotPresent"
env {
name = "METHOD"

4
stacks/speedtest/main.tf
View file

@ -111,12 +111,14 @@ resource "kubernetes_deployment" "speedtest" {
app = "speedtest"
}
annotations = {
"diun.enable" = "true"
"diun.include_tags" = "^\\d+\\.\\d+\\.\\d+$"
"dependency.kyverno.io/wait-for" = "mysql.dbaas:3306"
}
}
spec {
container {
image = "lscr.io/linuxserver/speedtest-tracker:latest"
image = "lscr.io/linuxserver/speedtest-tracker:0.24.1"
name = "speedtest"
port {
container_port = 80

4
stacks/technitium/modules/technitium/ha.tf
View file

@ -111,7 +111,7 @@ resource "kubernetes_deployment" "technitium_secondary" {
}
}
container {
image = "technitium/dns-server:latest"
image = "technitium/dns-server:14.3.0"
name = "technitium"
env {
name = "DNS_SERVER_ADMIN_PASSWORD"
@ -262,7 +262,7 @@ resource "kubernetes_deployment" "technitium_tertiary" {
}
}
container {
image = "technitium/dns-server:latest"
image = "technitium/dns-server:14.3.0"
name = "technitium"
env {
name = "DNS_SERVER_ADMIN_PASSWORD"

7
stacks/technitium/modules/technitium/main.tf
View file

@ -114,9 +114,8 @@ resource "kubernetes_deployment" "technitium" {
template {
metadata {
annotations = {
"diun.enable" = "false"
# "diun.include_tags" = "^\\d+(?:\\.\\d+)?(?:\\.\\d+)?$"
"diun.include_tags" = "latest"
"diun.enable" = "true"
"diun.include_tags" = "^\\d+\\.\\d+\\.\\d+$"
}
labels = {
app = "technitium"
@ -140,7 +139,7 @@ resource "kubernetes_deployment" "technitium" {
}
}
container {
image = "technitium/dns-server:latest"
image = "technitium/dns-server:14.3.0"
name = "technitium"
resources {
requests = {

4
stacks/url/main.tf
View file

@ -171,12 +171,14 @@ resource "kubernetes_deployment" "shlink" {
run = "shlink"
}
annotations = {
"diun.enable" = "true"
"diun.include_tags" = "^\\d+\\.\\d+\\.\\d+$"
"dependency.kyverno.io/wait-for" = "mysql.dbaas:3306"
}
}
spec {
container {
image = "shlinkio/shlink:stable"
image = "shlinkio/shlink:4.3.4"
name = "shlink"
env {
name = "DEFAULT_DOMAIN"

6
stacks/wealthfolio/main.tf
View file

@ -112,10 +112,14 @@ resource "kubernetes_deployment" "wealthfolio" {
labels = {
app = "wealthfolio"
}
annotations = {
"diun.enable" = "true"
"diun.include_tags" = "^v?\\d+\\.\\d+\\.\\d+$"
}
}
spec {
container {
image = "afadil/wealthfolio:latest"
image = "afadil/wealthfolio:v1.1.0"
name = "wealthfolio"
port {
container_port = 8080