[containers] Update a bunch of containers.

system/hosts/mcp/containers.nix

@@ -133,6 +133,7 @@
           image = "ghcr.io/gethomepage/homepage:latest";
           autoStart = true;
           extraOptions = [
+            "--pull=always"
             "-l=traefik.enable=true"
             "-l=traefik.http.routers.homepage.rule=${localHostRuleHavenisms "start"}"
             "-l=traefik.http.services.homepage.loadbalancer.server.port=3000"
@@ -157,6 +158,7 @@
           image = "ghcr.io/analogj/scrutiny:master-omnibus";
           autoStart = true;
           extraOptions = [
+            "--pull=always"
             "-l=traefik.enable=true"
             "-l=traefik.http.routers.scrutiny.rule=${localHostRuleHavenisms "scrutiny"}"
             "-l=traefik.http.services.scrutiny.loadbalancer.server.port=8080"

system/hosts/mcp/containers/blazestar.net/uptime.nix

@@ -4,7 +4,7 @@ let
 in
 {
   virtualisation.web-containers.containers.uptime = {
-    image = "louislam/uptime-kuma:1";
+    image = "louislam/uptime-kuma:1"; # TODO: Why not version 2?
     hostname = "uptime";
     domain = blazestar;
     port = 3001;

system/hosts/mcp/containers/collabora.nix

@@ -1,5 +1,4 @@
-{ config, pkgs, ... }:
-let inherit (import ./lib.nix config) mkContainer; in
+{ ... }:
 {
   virtualisation.oci-containers.containers.collabora = {
     image = "collabora/code";
@@ -10,5 +9,6 @@ let inherit (import ./lib.nix config) mkContainer; in
       DONT_GEN_SSL_CERT = "true";
     };
     autoStart = true;
+    extraOptions = [ "--pull=always" ];
   };
-}
+}

system/hosts/mcp/containers/gitea.nix

@@ -68,5 +68,6 @@ in
       # The runner will spawn new containers to run the actions
       "${config.local.container-socket}:/var/run/docker.sock:ro"
     ];
+    extraOptions = [ "--pull=always" ];
   };
 }

system/hosts/mcp/containers/lib.nix

@@ -67,7 +67,6 @@ in
         environmentFiles
         ports
         user
-        extraOptions
         ;
       autoStart = true;
       labels = {
@@ -78,6 +77,7 @@ in
       // oauthLabels
       // homepageLabels
       // extraLabels;
+      extraOptions = extraOptions ++ [ "--pull=always" ];
     };
 
   # Creates a MariaDB container for a specific app. It should be safe to give

system/hosts/mcp/containers/media-system.nix

@@ -44,9 +44,10 @@ in
 
   virtualisation.oci-containers.containers = {
     jellyfin = {
-      image = "lscr.io/linuxserver/jellyfin:10.11.6";
+      image = "lscr.io/linuxserver/jellyfin:latest";
       autoStart = true;
       extraOptions = [
+        "--pull=always"
         "--device=/dev/dri:/dev/dri"
         "-l=traefik.enable=true"
         "-l=traefik.http.routers.jellyfin.rule=${hostRuleHavenisms "jellyfin"}"
@@ -79,6 +80,7 @@ in
         "gluetun"
       ];
       extraOptions = [
+        "--pull=always"
         "--network=container:gluetun"
         "-l=homepage.group=Arr"
         "-l=homepage.name=Deluge"
@@ -101,6 +103,7 @@ in
         "gluetun"
       ];
       extraOptions = [
+        "--pull=always"
         "--network=container:gluetun"
         "-l=homepage.group=Arr"
         "-l=homepage.name=qBitTorrent"
@@ -124,6 +127,7 @@ in
       image = "qmcgaw/gluetun:latest";
       autoStart = true;
       extraOptions = [
+        "--pull=always"
         # add network admin capability.
         "--cap-add=NET_ADMIN"
         "--device=/dev/net/tun:/dev/net/tun"
@@ -150,6 +154,7 @@ in
       image = "lscr.io/linuxserver/prowlarr";
       autoStart = true;
       extraOptions = [
+        "--pull=always"
         "-l=traefik.enable=true"
         "-l=traefik.http.routers.prowlarr.rule=${localHostRuleHavenisms "prowlarr"}"
         "-l=traefik.http.services.prowlarr.loadbalancer.server.port=9696"
@@ -188,6 +193,7 @@ in
       image = "lscr.io/linuxserver/radarr";
       autoStart = true;
       extraOptions = [
+        "--pull=always"
         "-l=traefik.enable=true"
         "-l=traefik.http.routers.radarr.rule=${localHostRuleHavenisms "radarr"}"
         "-l=traefik.http.services.radarr.loadbalancer.server.port=7878"
@@ -212,6 +218,7 @@ in
       image = "lscr.io/linuxserver/sonarr";
       autoStart = true;
       extraOptions = [
+        "--pull=always"
         "-l=traefik.enable=true"
         "-l=traefik.http.routers.sonarr.rule=${localHostRuleHavenisms "sonarr"}"
         "-l=traefik.http.services.sonarr.loadbalancer.server.port=8989"
@@ -232,31 +239,6 @@ in
         UMASK = "002";
       };
     };
-    readarr = {
-      # The Linuxserver version of this image doesn't have a latest tag. Odd.
-      image = "lscr.io/linuxserver/readarr:develop";
-      autoStart = true;
-      extraOptions = [
-        "-l=traefik.enable=true"
-        "-l=traefik.http.routers.readarr.rule=${localHostRuleHavenisms "readarr"}"
-        "-l=traefik.http.services.readarr.loadbalancer.server.port=8787"
-        "-l=homepage.group=Arr"
-        "-l=homepage.name=Readarr"
-        "-l=homepage.icon=readarr.svg"
-        "-l=homepage.href=https://readarr.${havenisms}"
-        "-l=homepage.description=E-book acquisition"
-        "-l=homepage.widget.type=readarr"
-        "-l=homepage.widget.url=http://readarr.havenisms.com:8787"
-        "-l=homepage.widget.key={{HOMEPAGE_FILE_READARR_KEY}}"
-      ];
-      volumes = [
-        "/tank/media:/data"
-        "/tank/config/readarr:/config"
-      ];
-      environment = {
-        UMASK = "002";
-      };
-    };
     bazarr = mkContainer {
       # The Linuxserver version of this image doesn't have a latest tag. Odd.
       image = "lscr.io/linuxserver/bazarr:latest";

system/hosts/mcp/containers/pocket-id.nix

@@ -1,5 +1,5 @@
 { config, ... }:
-let 
+let
   inherit (import ./lib.nix config) mkContainer blazestar;
   # The default is to run on port 80, which the pocket-id user cannot bind to.
   # We need a different port to be able to serve traffic.
@@ -8,11 +8,28 @@ let
   # - 3000: Web UI
   # - 2019: Admin endpoint
   port = 8888;
+  encryption_key = "pocket-id/encryption_key";
 in
 {
+
+  sops.secrets = {
+    "${encryption_key}" = {
+      restartUnits = [ "${config.local.container-backend}-pocket-id.service" ];
+      mode = "0400";
+      owner = "pocket-id";
+    };
+  };
+
+  sops.templates."pocket-id.env" = {
+    content = ''
+      ENCRYPTION_KEY=${config.sops.placeholder."${encryption_key}"}
+    '';
+    owner = "pocket-id";
+  };
+
   virtualisation.oci-containers.containers.pocket-id = mkContainer {
     image = "ghcr.io/pocket-id/pocket-id";
-    dependsOn = [];
+    dependsOn = [ ];
     hostName = "auth";
     port = port;
     public = false;
@@ -24,17 +41,20 @@ in
       description = "Pocket ID Auth Server";
     };
     volumes = [
-      "/tank/pocket-id/data:/app/backend/data"
+      "/tank/pocket-id/data:/app/data"
     ];
     environment = {
-      PUBLIC_APP_URL = "https://auth.${blazestar}";
+      APP_URL = "https://auth.${blazestar}";
       # Whether the app is behind a reverse proxy.
-      TRUST_PROXY = "false";
-      CADDY_PORT = toString port;
+      TRUST_PROXY = "true";
+      PORT = toString port;
       # PORT = "3000"; # Frontend port
       # BACKEND_PORT = "8080"; # Backend port
       PUID = toString config.users.users."pocket-id".uid;
       PGID = toString config.users.groups."pocket-id".gid;
     };
+    environmentFiles = [
+      config.sops.templates."pocket-id.env".path
+    ];
   };
 }