viktor/infra
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

feat: pin ~28 images to specific versions, enable DIUN monitoring, add app-stacks pipeline

Browse source 
Pin third-party images from :latest to current stable versions:
- Platform: cloudflared, technitium, snmp-exporter, pve-exporter,
  headscale, shadowsocks, xray
- Apps: paperless-ngx, linkwarden, wealthfolio, speedtest, synapse,
  n8n, prowlarr, qbittorrent, lidarr, rybbit, ollama, immichframe,
  cyberchef, networking-toolbox, echo, coturn, shlink, affine

Enable DIUN annotations on all pinned deployments with per-image
tag patterns. Add Woodpecker app-stacks pipeline for selective
terragrunt apply on changed app stacks.
This commit is contained in:
Viktor Barzin 2026-04-06 14:27:13 +03:00
parent a81f7df2a0
commit 09b4bad958
30 changed files with 233 additions and 46 deletions
Download patch file Download diff file Expand all files Collapse all files

6
stacks/affine/main.tf
View file

@ -203,6 +203,8 @@ resource "kubernetes_deployment" "affine" {
app = "affine"
}
annotations = {
"diun.enable" = "true"
"diun.include_tags" = "^\\d+\\.\\d+\\.\\d+$"
"dependency.kyverno.io/wait-for" = "postgresql.dbaas:5432,redis.redis:6379"
}
}
@ -210,7 +212,7 @@ resource "kubernetes_deployment" "affine" {
# Init container to run database migrations
init_container {
name = "migration"
image = "ghcr.io/toeverything/affine:stable"
image = "ghcr.io/toeverything/affine:0.20.7"
command = ["sh", "-c", "npx prisma migrate deploy && SERVER_FLAVOR=script node ./dist/main.js run"]
dynamic "env" {
@ -253,7 +255,7 @@ resource "kubernetes_deployment" "affine" {
container {
name = "affine"
image = "ghcr.io/toeverything/affine:stable"
image = "ghcr.io/toeverything/affine:0.20.7"
port {
container_port = 3010

6
stacks/coturn/main.tf
View file

@ -139,12 +139,16 @@ resource "kubernetes_deployment" "coturn" {
labels = {
app = "coturn"
}
annotations = {
"diun.enable" = "true"
"diun.include_tags" = "^\\d+\\.\\d+\\.\\d+-r\\d+$"
}
}
spec {
container {
name = "coturn"
image = "coturn/coturn:latest"
image = "coturn/coturn:4.6.3-r1"
args = ["-c", "/etc/turnserver/turnserver.conf"]
# STUN/TURN signaling port

6
stacks/cyberchef/main.tf
View file

@ -46,10 +46,14 @@ resource "kubernetes_deployment" "cyberchef" {
labels = {
app = "cyberchef"
}
annotations = {
"diun.enable" = "true"
"diun.include_tags" = "^v\\d+\\.\\d+\\.\\d+$"
}
}
spec {
container {
image = "mpepping/cyberchef:latest"
image = "mpepping/cyberchef:v10.24.0"
name = "cyberchef"
port {

4
stacks/dawarich/main.tf
View file

@ -82,8 +82,8 @@ resource "kubernetes_deployment" "dawarich" {
app = "dawarich"
}
annotations = {
# "diun.enable" = "true"
# "diun.include_tags" = "latest"
"diun.enable" = "true"
"diun.include_tags" = "^v?\\d+\\.\\d+\\.\\d+$"
"dependency.kyverno.io/wait-for" = "postgresql.dbaas:5432,redis.redis:6379"
}
}

6
stacks/echo/main.tf
View file

@ -41,10 +41,14 @@ resource "kubernetes_deployment" "echo" {
labels = {
app = "echo"
}
annotations = {
"diun.enable" = "true"
"diun.include_tags" = "^\\d+$"
}
}
spec {
container {
image = "mendhak/http-https-echo"
image = "mendhak/http-https-echo:36"
name = "echo"
port {
container_port = 8080

2
stacks/immich/frame.tf
View file

@ -64,7 +64,7 @@ resource "kubernetes_deployment" "immich-frame" {
}
spec {
container {
image = "ghcr.io/immichframe/immichframe:latest"
image = "ghcr.io/immichframe/immichframe:1.7.4"
name = "immich-frame"
resources {
requests = {

6
stacks/linkwarden/main.tf
View file

@ -128,14 +128,14 @@ resource "kubernetes_deployment" "linkwarden" {
app = "linkwarden"
}
annotations = {
"diun.enable" = "false"
"diun.include_tags" = "latest"
"diun.enable" = "true"
"diun.include_tags" = "^v?\\d+\\.\\d+\\.\\d+$"
"dependency.kyverno.io/wait-for" = "postgresql.dbaas:5432"
}
}
spec {
container {
image = "ghcr.io/linkwarden/linkwarden:latest"
image = "ghcr.io/linkwarden/linkwarden:v2.9.1"
name = "linkwarden"
port {

6
stacks/matrix/main.tf
View file

@ -111,13 +111,15 @@ resource "kubernetes_deployment" "matrix" {
app = "matrix"
}
annotations = {
"diun.enable" = "true"
"diun.include_tags" = "^v\\d+\\.\\d+\\.\\d+$"
"dependency.kyverno.io/wait-for" = "pg-cluster-rw.dbaas:5432"
}
}
spec {
init_container {
name = "install-psycopg2"
image = "matrixdotorg/synapse:latest"
image = "matrixdotorg/synapse:v1.125.0"
command = ["/bin/sh", "-c", "pip install --target=/extra-packages psycopg2-binary 2>/dev/null"]
volume_mount {
name = "extra-packages"
@ -150,7 +152,7 @@ resource "kubernetes_deployment" "matrix" {
}
}
container {
image = "matrixdotorg/synapse:latest"
image = "matrixdotorg/synapse:v1.125.0"
name = "matrix"
port {
container_port = 8008

4
stacks/n8n/main.tf
View file

@ -148,6 +148,8 @@ resource "kubernetes_deployment" "n8n" {
app = "n8n"
}
annotations = {
"diun.enable" = "true"
"diun.include_tags" = "^\\d+\\.\\d+\\.\\d+$"
"dependency.kyverno.io/wait-for" = "postgresql.dbaas:5432"
}
}
@ -155,7 +157,7 @@ resource "kubernetes_deployment" "n8n" {
service_account_name = kubernetes_service_account.n8n.metadata[0].name
container {
name = "n8n"
image = "docker.n8n.io/n8nio/n8n"
image = "docker.n8n.io/n8nio/n8n:1.80.0"
env {
name = "DB_TYPE"
value = "postgresdb"

6
stacks/networking-toolbox/main.tf
View file

@ -41,10 +41,14 @@ resource "kubernetes_deployment" "networking-toolbox" {
labels = {
app = "networking-toolbox"
}
annotations = {
"diun.enable" = "true"
"diun.include_tags" = "^\\d+\\.\\d+\\.\\d+$"
}
}
spec {
container {
image = "lissy93/networking-toolbox"
image = "lissy93/networking-toolbox:1.1.1"
name = "networking-toolbox"
port {
container_port = 3000

6
stacks/ollama/main.tf
View file

@ -132,6 +132,10 @@ resource "kubernetes_deployment" "ollama" {
labels = {
app = "ollama"
}
annotations = {
"diun.enable" = "true"
"diun.include_tags" = "^\\d+\\.\\d+\\.\\d+$"
}
}
spec {
node_selector = {
@ -143,7 +147,7 @@ resource "kubernetes_deployment" "ollama" {
effect = "NoSchedule"
}
container {
image = "ollama/ollama:latest"
image = "ollama/ollama:0.6.10"
name = "ollama"
env {
name = "OLLAMA_HOST"

4
stacks/paperless-ngx/main.tf
View file

@ -119,14 +119,14 @@ resource "kubernetes_deployment" "paperless-ngx" {
app = "paperless-ngx"
}
annotations = {
"diun.enable" = "false"
"diun.enable" = "true"
"diun.include_tags" = "^\\d+(?:\\.\\d+)?(?:\\.\\d+)?$"
"dependency.kyverno.io/wait-for" = "mysql.dbaas:3306,redis.redis:6379"
}
}
spec {
container {
image = "ghcr.io/paperless-ngx/paperless-ngx:latest"
image = "ghcr.io/paperless-ngx/paperless-ngx:2.16.4"
name = "paperless-ngx"
env {
name = "PAPERLESS_REDIS"

6
stacks/platform/modules/cloudflared/main.tf
View file

@ -45,6 +45,10 @@ resource "kubernetes_deployment" "cloudflared" {
labels = {
app = "cloudflared"
}
annotations = {
"diun.enable" = "true"
"diun.include_tags" = "^\\d{4}\\.\\d+\\.\\d+$"
}
}
spec {
topology_spread_constraint {
@ -59,7 +63,7 @@ resource "kubernetes_deployment" "cloudflared" {
}
container {
# image = "wisdomsky/cloudflared-web:latest"
image = "cloudflare/cloudflared"
image = "cloudflare/cloudflared:2026.3.0"
name = "cloudflared"
command = ["cloudflared", "tunnel", "run"]
env {

7
stacks/platform/modules/headscale/main.tf
View file

@ -64,15 +64,14 @@ resource "kubernetes_deployment" "headscale" {
app = "headscale"
}
annotations = {
# "diun.enable" = "true"
"diun.enable" = "false"
"diun.enable" = "true"
"diun.include_tags" = "^\\d+(?:\\.\\d+)?(?:\\.\\d+)?$"
}
}
spec {
container {
image = "headscale/headscale:0.23.0"
# image = "headscale/headscale:0.23.0-debug" # -debug is for debug images
image = "headscale/headscale:0.28.0"
# image = "headscale/headscale:0.28.0-debug" # -debug is for debug images
name = "headscale"
command = ["headscale", "serve"]

6
stacks/platform/modules/monitoring/pve_exporter.tf
View file

@ -38,12 +38,16 @@ resource "kubernetes_deployment" "pve_exporter" {
labels = {
app = "proxmox-exporter"
}
annotations = {
"diun.enable" = "true"
"diun.include_tags" = "^\\d+\\.\\d+\\.\\d+$"
}
}
spec {
container {
name = "proxmox-exporter"
image = "prompve/prometheus-pve-exporter:latest"
image = "prompve/prometheus-pve-exporter:3.8.2"
port {
container_port = 9221

6
stacks/platform/modules/monitoring/snmp_exporter.tf
View file

@ -48,10 +48,14 @@ resource "kubernetes_deployment" "snmp-exporter" {
labels = {
app = "snmp-exporter"
}
annotations = {
"diun.enable" = "true"
"diun.include_tags" = "^v\\d+\\.\\d+\\.\\d+$"
}
}
spec {
container {
image = "prom/snmp-exporter"
image = "prom/snmp-exporter:v0.30.1"
name = "snmp-exporter"
# command = ["/usr/local/bin/redfish_exporter", "--config.file", "/app/config.yml"]

2
stacks/platform/modules/technitium/ha.tf
View file

@ -93,7 +93,7 @@ resource "kubernetes_deployment" "technitium_secondary" {
}
}
container {
image = "technitium/dns-server:latest"
image = "technitium/dns-server:14.3.0"
name = "technitium"
env {
name = "DNS_SERVER_ADMIN_PASSWORD"

7
stacks/platform/modules/technitium/main.tf
View file

@ -119,9 +119,8 @@ resource "kubernetes_deployment" "technitium" {
template {
metadata {
annotations = {
"diun.enable" = "false"
# "diun.include_tags" = "^\\d+(?:\\.\\d+)?(?:\\.\\d+)?$"
"diun.include_tags" = "latest"
"diun.enable" = "true"
"diun.include_tags" = "^\\d+\\.\\d+\\.\\d+$"
}
labels = {
app = "technitium"
@ -161,7 +160,7 @@ resource "kubernetes_deployment" "technitium" {
}
}
container {
image = "technitium/dns-server:latest"
image = "technitium/dns-server:14.3.0"
name = "technitium"
resources {
requests = {

6
stacks/platform/modules/xray/main.tf
View file

@ -80,10 +80,14 @@ resource "kubernetes_deployment" "xray" {
labels = {
app = "xray"
}
annotations = {
"diun.enable" = "true"
"diun.include_tags" = "^\\d+\\.\\d+\\.\\d+$"
}
}
spec {
container {
image = "teddysun/xray"
image = "teddysun/xray:26.3.27"
name = "xray"
image_pull_policy = "IfNotPresent"
port {

6
stacks/rybbit/main.tf
View file

@ -316,12 +316,14 @@ resource "kubernetes_deployment" "rybbit" {
app = "rybbit"
}
annotations = {
"diun.enable" = "true"
"diun.include_tags" = "^v?\\d+\\.\\d+\\.\\d+$"
"dependency.kyverno.io/wait-for" = "postgresql.dbaas:5432,clickhouse.rybbit:8123"
}
}
spec {
container {
image = "ghcr.io/rybbit-io/rybbit-backend:latest"
image = "ghcr.io/rybbit-io/rybbit-backend:v1.0.21"
name = "rybbit"
env {
@ -477,7 +479,7 @@ resource "kubernetes_deployment" "rybbit-client" {
spec {
container {
name = "rybbit-client"
image = "ghcr.io/rybbit-io/rybbit-client:latest"
image = "ghcr.io/rybbit-io/rybbit-client:v1.0.20"
env {
name = "NODE_ENV"
value = "production"

6
stacks/servarr/lidarr/main.tf
View file

@ -43,10 +43,14 @@ resource "kubernetes_deployment" "lidarr" {
labels = {
app = "lidarr"
}
annotations = {
"diun.enable" = "true"
"diun.include_tags" = "^\\d+\\.\\d+\\.\\d+$"
}
}
spec {
container {
image = "lscr.io/linuxserver/lidarr:latest"
image = "lscr.io/linuxserver/lidarr:2.9.4"
# image = "youegraillot/lidarr-on-steroids"
name = "lidarr"

6
stacks/servarr/prowlarr/main.tf
View file

@ -72,10 +72,14 @@ resource "kubernetes_deployment" "prowlarr" {
labels = {
app = "prowlarr"
}
annotations = {
"diun.enable" = "true"
"diun.include_tags" = "^\\d+\\.\\d+\\.\\d+$"
}
}
spec {
container {
image = "lscr.io/linuxserver/prowlarr:latest"
image = "lscr.io/linuxserver/prowlarr:1.31.1"
name = "prowlarr"
resources {

6
stacks/servarr/qbittorrent/main.tf
View file

@ -80,10 +80,14 @@ resource "kubernetes_deployment" "qbittorrent" {
labels = {
app = "qbittorrent"
}
annotations = {
"diun.enable" = "true"
"diun.include_tags" = "^\\d+\\.\\d+\\.\\d+$"
}
}
spec {
container {
image = "lscr.io/linuxserver/qbittorrent:latest"
image = "lscr.io/linuxserver/qbittorrent:5.0.4"
name = "qbittorrent"
port {

6
stacks/shadowsocks/main.tf
View file

@ -66,11 +66,15 @@ resource "kubernetes_deployment" "shadowsocks" {
labels = {
"app" = "shadowsocks"
}
annotations = {
"diun.enable" = "true"
"diun.include_tags" = "^v\\d+\\.\\d+\\.\\d+$"
}
}
spec {
container {
name = "shadowsocks"
image = "shadowsocks/shadowsocks-libev"
image = "shadowsocks/shadowsocks-libev:v3.3.5"
image_pull_policy = "IfNotPresent"
env {
name = "METHOD"

4
stacks/speedtest/main.tf
View file

@ -111,12 +111,14 @@ resource "kubernetes_deployment" "speedtest" {
app = "speedtest"
}
annotations = {
"diun.enable" = "true"
"diun.include_tags" = "^\\d+\\.\\d+\\.\\d+$"
"dependency.kyverno.io/wait-for" = "mysql.dbaas:3306"
}
}
spec {
container {
image = "lscr.io/linuxserver/speedtest-tracker:latest"
image = "lscr.io/linuxserver/speedtest-tracker:0.24.1"
name = "speedtest"
port {
container_port = 80

4
stacks/technitium/modules/technitium/ha.tf
View file

@ -111,7 +111,7 @@ resource "kubernetes_deployment" "technitium_secondary" {
}
}
container {
image = "technitium/dns-server:latest"
image = "technitium/dns-server:14.3.0"
name = "technitium"
env {
name = "DNS_SERVER_ADMIN_PASSWORD"
@ -262,7 +262,7 @@ resource "kubernetes_deployment" "technitium_tertiary" {
}
}
container {
image = "technitium/dns-server:latest"
image = "technitium/dns-server:14.3.0"
name = "technitium"
env {
name = "DNS_SERVER_ADMIN_PASSWORD"

7
stacks/technitium/modules/technitium/main.tf
View file

@ -114,9 +114,8 @@ resource "kubernetes_deployment" "technitium" {
template {
metadata {
annotations = {
"diun.enable" = "false"
# "diun.include_tags" = "^\\d+(?:\\.\\d+)?(?:\\.\\d+)?$"
"diun.include_tags" = "latest"
"diun.enable" = "true"
"diun.include_tags" = "^\\d+\\.\\d+\\.\\d+$"
}
labels = {
app = "technitium"
@ -140,7 +139,7 @@ resource "kubernetes_deployment" "technitium" {
}
}
container {
image = "technitium/dns-server:latest"
image = "technitium/dns-server:14.3.0"
name = "technitium"
resources {
requests = {

4
stacks/url/main.tf
View file

@ -171,12 +171,14 @@ resource "kubernetes_deployment" "shlink" {
run = "shlink"
}
annotations = {
"diun.enable" = "true"
"diun.include_tags" = "^\\d+\\.\\d+\\.\\d+$"
"dependency.kyverno.io/wait-for" = "mysql.dbaas:3306"
}
}
spec {
container {
image = "shlinkio/shlink:stable"
image = "shlinkio/shlink:4.3.4"
name = "shlink"
env {
name = "DEFAULT_DOMAIN"

6
stacks/wealthfolio/main.tf
View file

@ -112,10 +112,14 @@ resource "kubernetes_deployment" "wealthfolio" {
labels = {
app = "wealthfolio"
}
annotations = {
"diun.enable" = "true"
"diun.include_tags" = "^v?\\d+\\.\\d+\\.\\d+$"
}
}
spec {
container {
image = "afadil/wealthfolio:latest"
image = "afadil/wealthfolio:v1.1.0"
name = "wealthfolio"
port {
container_port = 8080