From d1e90a1789f379e0f354bdf1ab3393ce2cbd5512 Mon Sep 17 00:00:00 2001 From: Drew Haven Date: Sun, 6 Sep 2026 12:06:12 -0700 Subject: [PATCH] [containers] Update a bunch of containers. --- secrets/mcp.yaml | 8 +++-- system/features/web-containers.nix | 15 +++++--- system/hosts/mcp/containers.nix | 2 ++ .../mcp/containers/blazestar.net/uptime.nix | 2 +- system/hosts/mcp/containers/collabora.nix | 6 ++-- system/hosts/mcp/containers/gitea.nix | 1 + system/hosts/mcp/containers/lib.nix | 2 +- system/hosts/mcp/containers/media-system.nix | 34 +++++-------------- system/hosts/mcp/containers/pocket-id.nix | 32 +++++++++++++---- 9 files changed, 58 insertions(+), 44 deletions(-) diff --git a/secrets/mcp.yaml b/secrets/mcp.yaml index ca616fa..9b6453c 100644 --- a/secrets/mcp.yaml +++ b/secrets/mcp.yaml @@ -34,6 +34,8 @@ wargame-vods: password: ENC[AES256_GCM,data:4Vl2Jd80bu3gVKDN7gINo8rbui6x3zxPvYEHf6GBiJDQdmRt8od/5yw4S/8=,iv:ZLdp3j0+8vLluNssXlV52XIJMczhai+6zcHsRwDwGPM=,tag:rjbp9cFbj3EFxnUZQO/QYg==,type:str] admin-token: ENC[AES256_GCM,data:xxec5YDtWW7VpV+POtfhfhHG45ebCdNuD6PyHExyp0H9Ef/edTCgJtnPYWM=,iv:bLidEo0L1vP8IRtcdZ4Bcw4chHErCUHH31xQS7cFk3g=,tag:AJ9fb6xo8w41FOWu2fHHgQ==,type:str] youtube-api-key: ENC[AES256_GCM,data:9W6+QK52mlTPh55ZqHXq020IpPbwbr9+Qzqhi6u96NrnRJEEVr+Z,iv:s3g2kGg2xPWD6/BuQxJ7Eqbm5HpatQbkF6PxuKufxro=,tag:1vvC8STNTX3+e5hLQTJglQ==,type:str] +pocket-id: + encryption_key: ENC[AES256_GCM,data:zwfKjZRDi14/sKDVVpBa0cWSb7S0YnUQOmH0bJF7+jxpiIKzU/mSqIry7eI=,iv:whBV1ZaJ+ygaiwYqjbTyKfKWRwxpx8CdqC/pwM3fGUU=,tag:2VacYAW3l61SgGPjIfQO5A==,type:str] sops: age: - enc: | @@ -63,7 +65,7 @@ sops: dvKJPDYvGb/8JXSkZNkLlWvHEVnsAJ1mJFb1idenYzeQvJlsX07rYA== -----END AGE ENCRYPTED FILE----- recipient: age1jrk4h7x4qzhr6z5m4d099mlfyjc4n5n9s52r4gfsdz0slnqlqa9sss735v - lastmodified: "2026-08-17T01:55:47Z" - mac: ENC[AES256_GCM,data:uR1BHCZi0O0KQUwVauev4CmUwAvj7xABsnQR+3FRfTJK3mcnm2TR+GabQ9F8YyTDo86fK8pYLl4iki766LUy78QJBFMXCKmB7shx5kWIDKWcSU2xlkrPbXSZmQr0Hh5x46YaZbd9UO8xabUdy3p3Vu282V192HWFXsGBQ3T1mvY=,iv:lp2ca+4vd7lIjibaTBBxy/3NmdWenaZrE2dWZzrfrBM=,tag:cJWZT7BgdVJXjwJh/4USuw==,type:str] + lastmodified: "2026-09-06T18:47:12Z" + mac: ENC[AES256_GCM,data:Y/I0EDZsjYYEJisPiEa/gS8d+vc9ksmwH87fAPn1bDzJq+reIiwg+ESkGik8VYcQL8NO6YF3ZU8nyuqIT62ZnWDUU1RZaYwoSkCpEylWmH4xq4ShJTm2Fkqj9f0wtkrCw6uOW5wlio+BlWp6gkYuC9Zp2u29ms73Z0HLU5LPTIg=,iv:h6i4UqFqA3Q3agCP4YWltMe+59VU+tuxG13jw7NO+yI=,tag:BP+7JhgYFoeOuNeUUeLOLg==,type:str] unencrypted_suffix: _unencrypted - version: 3.13.2 + version: 3.13.3 diff --git a/system/features/web-containers.nix b/system/features/web-containers.nix index d64b4d6..fd7c605 100644 --- a/system/features/web-containers.nix +++ b/system/features/web-containers.nix @@ -12,7 +12,11 @@ let strOpt = mkOption { type = str; }; intOpt = mkOption { type = int; }; - boolOpt = mkOption { + boolOptTrue = mkOption { + type = bool; + default = true; + }; + boolOptFalse = mkOption { type = bool; default = false; }; @@ -35,13 +39,14 @@ volumes = strList; environment = attrOpt; environmentFiles = strList; - public = boolOpt; + public = boolOptFalse; user = mkOption { type = nullOr str; default = null; }; extraOptions = strList; - oauthProxy = boolOpt; + oauthProxy = boolOptFalse; + alwaysPull = boolOptTrue; extraLabels = attrOpt; }; }); @@ -76,6 +81,7 @@ extraOptions, oauthProxy, extraLabels, + alwaysPull, }: let fqn = "${hostname}.${domain}"; @@ -97,6 +103,7 @@ { "traefik.http.routers.${serviceName}.middlewares" = "oidc-auth@file"; } else { }; + options = if alwaysPull then extraOptions ++ [ "--pull=always" ] else options; in { inherit @@ -106,7 +113,6 @@ environment environmentFiles user - extraOptions ; autoStart = true; labels = { @@ -119,6 +125,7 @@ // oauthLabels // homepageLabels // extraLabels; + extraOptions = options; }; in builtins.mapAttrs mkContainer config.virtualisation.web-containers.containers diff --git a/system/hosts/mcp/containers.nix b/system/hosts/mcp/containers.nix index ef80dd3..4719a44 100644 --- a/system/hosts/mcp/containers.nix +++ b/system/hosts/mcp/containers.nix @@ -133,6 +133,7 @@ image = "ghcr.io/gethomepage/homepage:latest"; autoStart = true; extraOptions = [ + "--pull=always" "-l=traefik.enable=true" "-l=traefik.http.routers.homepage.rule=${localHostRuleHavenisms "start"}" "-l=traefik.http.services.homepage.loadbalancer.server.port=3000" @@ -157,6 +158,7 @@ image = "ghcr.io/analogj/scrutiny:master-omnibus"; autoStart = true; extraOptions = [ + "--pull=always" "-l=traefik.enable=true" "-l=traefik.http.routers.scrutiny.rule=${localHostRuleHavenisms "scrutiny"}" "-l=traefik.http.services.scrutiny.loadbalancer.server.port=8080" diff --git a/system/hosts/mcp/containers/blazestar.net/uptime.nix b/system/hosts/mcp/containers/blazestar.net/uptime.nix index 1ccb4e2..1efd0ac 100644 --- a/system/hosts/mcp/containers/blazestar.net/uptime.nix +++ b/system/hosts/mcp/containers/blazestar.net/uptime.nix @@ -4,7 +4,7 @@ let in { virtualisation.web-containers.containers.uptime = { - image = "louislam/uptime-kuma:1"; + image = "louislam/uptime-kuma:1"; # TODO: Why not version 2? hostname = "uptime"; domain = blazestar; port = 3001; diff --git a/system/hosts/mcp/containers/collabora.nix b/system/hosts/mcp/containers/collabora.nix index 75b4c06..85594e2 100644 --- a/system/hosts/mcp/containers/collabora.nix +++ b/system/hosts/mcp/containers/collabora.nix @@ -1,5 +1,4 @@ -{ config, pkgs, ... }: -let inherit (import ./lib.nix config) mkContainer; in +{ ... }: { virtualisation.oci-containers.containers.collabora = { image = "collabora/code"; @@ -10,5 +9,6 @@ let inherit (import ./lib.nix config) mkContainer; in DONT_GEN_SSL_CERT = "true"; }; autoStart = true; + extraOptions = [ "--pull=always" ]; }; -} \ No newline at end of file +} diff --git a/system/hosts/mcp/containers/gitea.nix b/system/hosts/mcp/containers/gitea.nix index 0caecfa..e15ec4f 100644 --- a/system/hosts/mcp/containers/gitea.nix +++ b/system/hosts/mcp/containers/gitea.nix @@ -68,5 +68,6 @@ in # The runner will spawn new containers to run the actions "${config.local.container-socket}:/var/run/docker.sock:ro" ]; + extraOptions = [ "--pull=always" ]; }; } diff --git a/system/hosts/mcp/containers/lib.nix b/system/hosts/mcp/containers/lib.nix index 2537c40..9c91210 100644 --- a/system/hosts/mcp/containers/lib.nix +++ b/system/hosts/mcp/containers/lib.nix @@ -67,7 +67,6 @@ in environmentFiles ports user - extraOptions ; autoStart = true; labels = { @@ -78,6 +77,7 @@ in // oauthLabels // homepageLabels // extraLabels; + extraOptions = extraOptions ++ [ "--pull=always" ]; }; # Creates a MariaDB container for a specific app. It should be safe to give diff --git a/system/hosts/mcp/containers/media-system.nix b/system/hosts/mcp/containers/media-system.nix index d464a45..f859c0c 100644 --- a/system/hosts/mcp/containers/media-system.nix +++ b/system/hosts/mcp/containers/media-system.nix @@ -44,9 +44,10 @@ in virtualisation.oci-containers.containers = { jellyfin = { - image = "lscr.io/linuxserver/jellyfin:10.11.6"; + image = "lscr.io/linuxserver/jellyfin:latest"; autoStart = true; extraOptions = [ + "--pull=always" "--device=/dev/dri:/dev/dri" "-l=traefik.enable=true" "-l=traefik.http.routers.jellyfin.rule=${hostRuleHavenisms "jellyfin"}" @@ -79,6 +80,7 @@ in "gluetun" ]; extraOptions = [ + "--pull=always" "--network=container:gluetun" "-l=homepage.group=Arr" "-l=homepage.name=Deluge" @@ -101,6 +103,7 @@ in "gluetun" ]; extraOptions = [ + "--pull=always" "--network=container:gluetun" "-l=homepage.group=Arr" "-l=homepage.name=qBitTorrent" @@ -124,6 +127,7 @@ in image = "qmcgaw/gluetun:latest"; autoStart = true; extraOptions = [ + "--pull=always" # add network admin capability. "--cap-add=NET_ADMIN" "--device=/dev/net/tun:/dev/net/tun" @@ -150,6 +154,7 @@ in image = "lscr.io/linuxserver/prowlarr"; autoStart = true; extraOptions = [ + "--pull=always" "-l=traefik.enable=true" "-l=traefik.http.routers.prowlarr.rule=${localHostRuleHavenisms "prowlarr"}" "-l=traefik.http.services.prowlarr.loadbalancer.server.port=9696" @@ -188,6 +193,7 @@ in image = "lscr.io/linuxserver/radarr"; autoStart = true; extraOptions = [ + "--pull=always" "-l=traefik.enable=true" "-l=traefik.http.routers.radarr.rule=${localHostRuleHavenisms "radarr"}" "-l=traefik.http.services.radarr.loadbalancer.server.port=7878" @@ -212,6 +218,7 @@ in image = "lscr.io/linuxserver/sonarr"; autoStart = true; extraOptions = [ + "--pull=always" "-l=traefik.enable=true" "-l=traefik.http.routers.sonarr.rule=${localHostRuleHavenisms "sonarr"}" "-l=traefik.http.services.sonarr.loadbalancer.server.port=8989" @@ -232,31 +239,6 @@ in UMASK = "002"; }; }; - readarr = { - # The Linuxserver version of this image doesn't have a latest tag. Odd. - image = "lscr.io/linuxserver/readarr:develop"; - autoStart = true; - extraOptions = [ - "-l=traefik.enable=true" - "-l=traefik.http.routers.readarr.rule=${localHostRuleHavenisms "readarr"}" - "-l=traefik.http.services.readarr.loadbalancer.server.port=8787" - "-l=homepage.group=Arr" - "-l=homepage.name=Readarr" - "-l=homepage.icon=readarr.svg" - "-l=homepage.href=https://readarr.${havenisms}" - "-l=homepage.description=E-book acquisition" - "-l=homepage.widget.type=readarr" - "-l=homepage.widget.url=http://readarr.havenisms.com:8787" - "-l=homepage.widget.key={{HOMEPAGE_FILE_READARR_KEY}}" - ]; - volumes = [ - "/tank/media:/data" - "/tank/config/readarr:/config" - ]; - environment = { - UMASK = "002"; - }; - }; bazarr = mkContainer { # The Linuxserver version of this image doesn't have a latest tag. Odd. image = "lscr.io/linuxserver/bazarr:latest"; diff --git a/system/hosts/mcp/containers/pocket-id.nix b/system/hosts/mcp/containers/pocket-id.nix index a31f3aa..b6d6b80 100644 --- a/system/hosts/mcp/containers/pocket-id.nix +++ b/system/hosts/mcp/containers/pocket-id.nix @@ -1,5 +1,5 @@ { config, ... }: -let +let inherit (import ./lib.nix config) mkContainer blazestar; # The default is to run on port 80, which the pocket-id user cannot bind to. # We need a different port to be able to serve traffic. @@ -8,11 +8,28 @@ let # - 3000: Web UI # - 2019: Admin endpoint port = 8888; + encryption_key = "pocket-id/encryption_key"; in { + + sops.secrets = { + "${encryption_key}" = { + restartUnits = [ "${config.local.container-backend}-pocket-id.service" ]; + mode = "0400"; + owner = "pocket-id"; + }; + }; + + sops.templates."pocket-id.env" = { + content = '' + ENCRYPTION_KEY=${config.sops.placeholder."${encryption_key}"} + ''; + owner = "pocket-id"; + }; + virtualisation.oci-containers.containers.pocket-id = mkContainer { image = "ghcr.io/pocket-id/pocket-id"; - dependsOn = []; + dependsOn = [ ]; hostName = "auth"; port = port; public = false; @@ -24,17 +41,20 @@ in description = "Pocket ID Auth Server"; }; volumes = [ - "/tank/pocket-id/data:/app/backend/data" + "/tank/pocket-id/data:/app/data" ]; environment = { - PUBLIC_APP_URL = "https://auth.${blazestar}"; + APP_URL = "https://auth.${blazestar}"; # Whether the app is behind a reverse proxy. - TRUST_PROXY = "false"; - CADDY_PORT = toString port; + TRUST_PROXY = "true"; + PORT = toString port; # PORT = "3000"; # Frontend port # BACKEND_PORT = "8080"; # Backend port PUID = toString config.users.users."pocket-id".uid; PGID = toString config.users.groups."pocket-id".gid; }; + environmentFiles = [ + config.sops.templates."pocket-id.env".path + ]; }; }