viktor/infra
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

feat: pin ~28 images to specific versions, enable DIUN monitoring, add app-stacks pipeline

Browse source 
Pin third-party images from :latest to current stable versions:
- Platform: cloudflared, technitium, snmp-exporter, pve-exporter,
  headscale, shadowsocks, xray
- Apps: paperless-ngx, linkwarden, wealthfolio, speedtest, synapse,
  n8n, prowlarr, qbittorrent, lidarr, rybbit, ollama, immichframe,
  cyberchef, networking-toolbox, echo, coturn, shlink, affine

Enable DIUN annotations on all pinned deployments with per-image
tag patterns. Add Woodpecker app-stacks pipeline for selective
terragrunt apply on changed app stacks.
This commit is contained in:
Viktor Barzin 2026-04-06 14:27:13 +03:00
parent a81f7df2a0
commit 09b4bad958
30 changed files with 233 additions and 46 deletions
Download patch file Download diff file Expand all files Collapse all files

6
stacks/platform/modules/cloudflared/main.tf
View file

@ -45,6 +45,10 @@ resource "kubernetes_deployment" "cloudflared" {
labels = {
app = "cloudflared"
}
annotations = {
"diun.enable" = "true"
"diun.include_tags" = "^\\d{4}\\.\\d+\\.\\d+$"
}
}
spec {
topology_spread_constraint {
@ -59,7 +63,7 @@ resource "kubernetes_deployment" "cloudflared" {
}
container {
# image = "wisdomsky/cloudflared-web:latest"
image = "cloudflare/cloudflared"
image = "cloudflare/cloudflared:2026.3.0"
name = "cloudflared"
command = ["cloudflared", "tunnel", "run"]
env {

7
stacks/platform/modules/headscale/main.tf
View file

@ -64,15 +64,14 @@ resource "kubernetes_deployment" "headscale" {
app = "headscale"
}
annotations = {
# "diun.enable" = "true"
"diun.enable" = "false"
"diun.enable" = "true"
"diun.include_tags" = "^\\d+(?:\\.\\d+)?(?:\\.\\d+)?$"
}
}
spec {
container {
image = "headscale/headscale:0.23.0"
# image = "headscale/headscale:0.23.0-debug" # -debug is for debug images
image = "headscale/headscale:0.28.0"
# image = "headscale/headscale:0.28.0-debug" # -debug is for debug images
name = "headscale"
command = ["headscale", "serve"]

6
stacks/platform/modules/monitoring/pve_exporter.tf
View file

@ -38,12 +38,16 @@ resource "kubernetes_deployment" "pve_exporter" {
labels = {
app = "proxmox-exporter"
}
annotations = {
"diun.enable" = "true"
"diun.include_tags" = "^\\d+\\.\\d+\\.\\d+$"
}
}
spec {
container {
name = "proxmox-exporter"
image = "prompve/prometheus-pve-exporter:latest"
image = "prompve/prometheus-pve-exporter:3.8.2"
port {
container_port = 9221

6
stacks/platform/modules/monitoring/snmp_exporter.tf
View file

@ -48,10 +48,14 @@ resource "kubernetes_deployment" "snmp-exporter" {
labels = {
app = "snmp-exporter"
}
annotations = {
"diun.enable" = "true"
"diun.include_tags" = "^v\\d+\\.\\d+\\.\\d+$"
}
}
spec {
container {
image = "prom/snmp-exporter"
image = "prom/snmp-exporter:v0.30.1"
name = "snmp-exporter"
# command = ["/usr/local/bin/redfish_exporter", "--config.file", "/app/config.yml"]

2
stacks/platform/modules/technitium/ha.tf
View file

@ -93,7 +93,7 @@ resource "kubernetes_deployment" "technitium_secondary" {
}
}
container {
image = "technitium/dns-server:latest"
image = "technitium/dns-server:14.3.0"
name = "technitium"
env {
name = "DNS_SERVER_ADMIN_PASSWORD"

7
stacks/platform/modules/technitium/main.tf
View file

@ -119,9 +119,8 @@ resource "kubernetes_deployment" "technitium" {
template {
metadata {
annotations = {
"diun.enable" = "false"
# "diun.include_tags" = "^\\d+(?:\\.\\d+)?(?:\\.\\d+)?$"
"diun.include_tags" = "latest"
"diun.enable" = "true"
"diun.include_tags" = "^\\d+\\.\\d+\\.\\d+$"
}
labels = {
app = "technitium"
@ -161,7 +160,7 @@ resource "kubernetes_deployment" "technitium" {
}
}
container {
image = "technitium/dns-server:latest"
image = "technitium/dns-server:14.3.0"
name = "technitium"
resources {
requests = {

6
stacks/platform/modules/xray/main.tf
View file

@ -80,10 +80,14 @@ resource "kubernetes_deployment" "xray" {
labels = {
app = "xray"
}
annotations = {
"diun.enable" = "true"
"diun.include_tags" = "^\\d+\\.\\d+\\.\\d+$"
}
}
spec {
container {
image = "teddysun/xray"
image = "teddysun/xray:26.3.27"
name = "xray"
image_pull_policy = "IfNotPresent"
port {