jeremy/hobbs-iac
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

infra: 2026-10-26 version audit, upgrades, UniFi re-removal

Browse Source 
- Synapse v1.163.2, MAS 1.27.1, Traefik v3.7, node-exporter v1.12.1 (all
  nodes), cadvisor -> ghcr.io v0.60.6, alertmanager-receiver 2026.9.23,
  Gitea 1.26.4, Jellyfin 12.3, Seerr v3.5.1
- Watchtower -> nickfedor/watchtower fork, twice daily (04:00/16:00)
- Monitoring legacy node-exporter gated behind a compose profile
- unifi-os-server on .100 removed again; compose file renamed so it
  cannot be revived
- CLAUDE.md: Known Issues #40-43, service tree updates

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01NQhgEUqcaV4WM2S4hfXgHD
This commit is contained in:
jeremy
2026-10-26 16:27:43 -05:00
parent f2374506b4
commit 122ea392d1
14 changed files with 185 additions and 86 deletions
Download Patch File Download Diff File Expand all files Collapse all files
compose/bart/media/docker-compose.yml
+14 -10
View File
@@ -1,11 +1,10 @@
services:
jellyfin:
# PINNED to the 12.0.0 unstable build that migrated the DB to the v12
# schema (DropExtraIdsColumn) — :latest is still 10.11.x and CANNOT read
# this DB ("no such column: b.ExtraIds"). Do not unpin until official
# stable >= 12 ships. (2026-07-14: a :latest deploy downgraded it and
# broke Resume/home sections; repinned.)
image: jellyfin/jellyfin:2026060106
# Pinned to official stable 12.2. History: ran the 2026060106 unstable
# build from 2026-07-14 because the DB had been migrated to the v12 schema
# and 10.11.x could not read it. Stable 12 shipped 2026-09; moved to
# 12.2 on 2026-10-17, 12.3 on 2026-10-26. Never go back below 12.
image: jellyfin/jellyfin:12.3.20261023-013714
container_name: jellyfin
restart: unless-stopped
environment:
@@ -145,14 +144,19 @@ services:
max-size: "50m"
max-file: "3"
jellyseerr:
image: fallenbagel/jellyseerr:latest
container_name: jellyseerr
seerr:
# Seerr = merged successor of Jellyseerr/Overseerr (fallenbagel/jellyseerr
# is deprecated). Migrated 2026-10-17; DB auto-migrated on first start.
# Runs as node (UID 1000), needs init. LOCAL disk (SQLite). Old config left
# at /mnt/docker-data/configs/jellyseerr for rollback.
image: seerr/seerr:v3.5.1
init: true
container_name: seerr
restart: unless-stopped
environment:
- TZ=America/Chicago
volumes:
- /mnt/docker-data/configs/jellyseerr:/app/config
- /var/lib/seerr:/app/config
ports:
- "5055:5055"
mem_limit: 512M
compose/bart/node-exporter/docker-compose.yml
+8 -8
View File
@@ -1,6 +1,6 @@
services:
node-exporter:
image: prom/node-exporter:v1.7.0
image: prom/node-exporter:v1.12.1
container_name: node-exporter
hostname: bart
network_mode: host
@@ -11,14 +11,14 @@ services:
- /sys:/host/sys:ro
- /:/rootfs:ro
command:
- '--path.procfs=/host/proc'
- '--path.rootfs=/rootfs'
- '--path.sysfs=/host/sys'
- '--collector.filesystem.mount-points-exclude=^/(sys|proc|dev|host|etc)($$|/)'
- "--path.procfs=/host/proc"
- "--path.rootfs=/rootfs"
- "--path.sysfs=/host/sys"
- "--collector.filesystem.mount-points-exclude=^/(sys|proc|dev|host|etc)($$|/)"
logging:
driver: "json-file"
driver: json-file
options:
max-size: "50m"
max-size: 50m
max-file: "3"
labels:
- "com.centurylinklabs.watchtower.enable=false"
- com.centurylinklabs.watchtower.enable=false
compose/bart/watchtower/docker-compose.yml
+2 -2
View File
@@ -1,6 +1,6 @@
services:
watchtower:
image: containrrr/watchtower:latest
image: nickfedor/watchtower:latest # containrrr/watchtower is archived upstream (2026-10-26)
container_name: watchtower
restart: unless-stopped
volumes:
@@ -8,7 +8,7 @@ services:
environment:
- WATCHTOWER_CLEANUP=true
- WATCHTOWER_INCLUDE_RESTARTING=true
- WATCHTOWER_POLL_INTERVAL=86400
- WATCHTOWER_SCHEDULE=0 0 4,16 * * * # twice daily, 04:00 + 16:00 local
- WATCHTOWER_MONITOR_ONLY=false
- TZ=America/Chicago
- DOCKER_API_VERSION=1.44
compose/hf-pdocker-01/mas/docker-compose.yml
+1 -1
View File
@@ -32,7 +32,7 @@ services:
# NOTE: MAS tags are NOT v-prefixed (1.23.0), unlike Synapse (v1.159.0).
# Distroless image - no shell, so no container healthcheck is possible.
# Liveness is covered by the blackbox probe of https://auth.hobbs.farm/health.
image: ghcr.io/element-hq/matrix-authentication-service:1.23.0
image: ghcr.io/element-hq/matrix-authentication-service:1.27.1
container_name: mas
restart: unless-stopped
command: ["server", "--config", "/config/config.yaml"]
compose/hf-pdocker-01/matrix/docker-compose.yml
+1 -1
View File
@@ -2,7 +2,7 @@ services:
synapse:
# 2026-08-20: matrixdotorg repo is abandoned (froze at 1.148.0); upstream is now element-hq.
# Pinned deliberately so the running version is visible in the file - bump manually.
image: ghcr.io/element-hq/synapse:v1.159.0
image: ghcr.io/element-hq/synapse:v1.163.2
container_name: synapse
restart: unless-stopped
environment:
compose/hf-pdocker-01/monitoring/docker-compose.yml
+120 -37
View File
@@ -1,21 +1,12 @@
networks:
monitoring-net:
name: monitoring-net
services:
grafana:
image: grafana/grafana:latest
container_name: grafana
restart: unless-stopped
user: "104"
networks:
- monitoring-net
ports:
- "3001:3000"
volumes:
- /mnt/docker-data/configs/grafana:/var/lib/grafana
mem_limit: 512M
memswap_limit: 512M
healthcheck:
test: ["CMD-SHELL", "wget -q --spider http://localhost:3000/api/health || exit 1"]
interval: 30s
@@ -27,13 +18,19 @@ services:
options:
max-size: "50m"
max-file: "3"
deploy:
mode: replicated
replicas: 1
placement:
constraints:
- node.hostname == hf-pdocker-01
resources:
limits:
memory: 512M
prometheus:
image: prom/prometheus:latest
container_name: prometheus
restart: unless-stopped
networks:
- monitoring-net
ports:
- "9095:9090"
command:
@@ -44,8 +41,6 @@ services:
- '--web.enable-lifecycle'
volumes:
- /mnt/docker-data/configs/prometheus:/etc/prometheus
mem_limit: 512M
memswap_limit: 512M
healthcheck:
test: ["CMD-SHELL", "wget -q --spider http://localhost:9090/-/healthy || exit 1"]
interval: 30s
@@ -57,13 +52,19 @@ services:
options:
max-size: "50m"
max-file: "3"
deploy:
mode: replicated
replicas: 1
placement:
constraints:
- node.hostname == hf-pdocker-01
resources:
limits:
memory: 512M
alertmanager:
image: prom/alertmanager:latest
container_name: alertmanager
restart: unless-stopped
networks:
- monitoring-net
ports:
- "9093:9093"
command:
@@ -72,8 +73,6 @@ services:
volumes:
- /mnt/docker-data/configs/alertmanager:/etc/alertmanager
- alertmanager-data:/alertmanager
mem_limit: 256M
memswap_limit: 256M
healthcheck:
test: ["CMD-SHELL", "wget -q --spider http://localhost:9093/-/healthy || exit 1"]
interval: 30s
@@ -85,19 +84,49 @@ services:
options:
max-size: "50m"
max-file: "3"
deploy:
mode: replicated
replicas: 1
placement:
constraints:
- node.hostname == hf-pdocker-01
resources:
limits:
memory: 256M
node-exporter:
# DISABLED 2026-10-26: node-exporter runs STANDALONE (compose/<node>/node-exporter, pid:host).
# This legacy copy would collide on :9100 if started; gated behind a profile so a
# bare `docker compose up -d` here never starts it.
profiles: ["legacy-node-exporter"]
image: prom/node-exporter:latest
restart: unless-stopped
ports:
- "9100:9100"
volumes:
- /proc:/host/proc:ro
- /sys:/host/sys:ro
- /:/rootfs:ro
command:
- '--path.procfs=/host/proc'
- '--path.rootfs=/rootfs'
- '--path.sysfs=/host/sys'
logging:
driver: "json-file"
options:
max-size: "50m"
max-file: "3"
deploy:
mode: global
resources:
limits:
memory: 128M
influxdb:
image: influxdb:1.8-alpine
container_name: influxdb
restart: unless-stopped
networks:
- monitoring-net
ports:
- "8086:8086"
volumes:
- /mnt/docker-data/configs/influxdb:/var/lib/influxdb
mem_limit: 1G
memswap_limit: 1G
healthcheck:
test: ["CMD-SHELL", "wget -q --spider http://localhost:8086/ping || exit 1"]
interval: 30s
@@ -109,45 +138,99 @@ services:
options:
max-size: "50m"
max-file: "3"
deploy:
mode: replicated
replicas: 1
placement:
constraints:
- node.hostname == hf-pdocker-01
resources:
limits:
memory: 1G
matrix-alertmanager-receiver:
image: metio/matrix-alertmanager-receiver:2026.2.25
container_name: matrix-alertmanager-receiver
image: metio/matrix-alertmanager-receiver:2026.9.23
restart: unless-stopped
networks:
- monitoring-net
ports:
- "9094:9094"
volumes:
- /mnt/docker-data/configs/alertmanager/matrix-receiver-config.yml:/config/config.yml:ro
command: ["--config-path", "/config/config.yml"]
mem_limit: 128M
memswap_limit: 128M
# NOTE: No healthcheck - this image is distroless (no shell), so CMD-SHELL healthchecks fail.
# The service is verified healthy by Alertmanager successfully POSTing to it.
logging:
driver: "json-file"
options:
max-size: "50m"
max-file: "3"
deploy:
mode: replicated
replicas: 1
placement:
constraints:
- node.hostname == hf-pdocker-01
resources:
limits:
memory: 128M
cadvisor:
image: ghcr.io/google/cadvisor:v0.60.6 # moved off gcr.io (no releases there after v0.55)
restart: unless-stopped
privileged: true
command:
- '--docker_only=true'
- '--disable_metrics=advtcp,cpu_topology,cpuset,hugetlb,memory_numa,process,referenced_memory,resctrl,sched,tcp,udp,disk,diskIO,percpu'
- '--housekeeping_interval=30s'
- '--store_container_labels=false'
ports:
- "8081:8080"
volumes:
- /:/rootfs:ro
- /var/run:/var/run:ro
- /sys:/sys:ro
- /var/lib/docker/:/var/lib/docker:ro
- /dev/disk/:/dev/disk:ro
- /sys/fs/cgroup:/sys/fs/cgroup:ro
devices:
- /dev/kmsg
logging:
driver: "json-file"
options:
max-size: "50m"
max-file: "3"
deploy:
mode: replicated
replicas: 1
placement:
constraints:
- node.hostname == hf-pdocker-01
resources:
limits:
memory: 256M
blackbox-exporter:
image: prom/blackbox-exporter:latest
container_name: blackbox-exporter
restart: unless-stopped
networks:
- monitoring-net
ports:
- "9115:9115"
command:
- '--config.file=/config/blackbox.yml'
volumes:
- /mnt/docker-data/configs/blackbox:/config:ro
mem_limit: 128M
memswap_limit: 128M
logging:
driver: "json-file"
options:
max-size: "50m"
max-file: "3"
deploy:
mode: replicated
replicas: 1
placement:
constraints:
- node.hostname == hf-pdocker-01
resources:
limits:
memory: 128M
volumes:
alertmanager-data:
compose/hf-pdocker-01/node-exporter/docker-compose.yml
+1 -1
View File
@@ -1,6 +1,6 @@
services:
node-exporter:
image: prom/node-exporter:v1.7.0
image: prom/node-exporter:v1.12.1
container_name: node-exporter
hostname: hf-pdocker-01
network_mode: host
compose/hf-pdocker-01/traefik/docker-compose.yml
+1 -1
View File
@@ -1,6 +1,6 @@
services:
traefik:
image: traefik:v3.6
image: traefik:v3.7
container_name: traefik
restart: unless-stopped
command:
compose/hf-pdocker-02/gitea/docker-compose.yml
+1 -1
View File
@@ -1,6 +1,6 @@
services:
gitea:
image: gitea/gitea:1.26.1
image: gitea/gitea:1.26.4
container_name: gitea
restart: unless-stopped
labels:
compose/hf-pdocker-02/node-exporter/docker-compose.yml
+8 -8
View File
@@ -1,6 +1,6 @@
services:
node-exporter:
image: prom/node-exporter:v1.7.0
image: prom/node-exporter:v1.12.1
container_name: node-exporter
hostname: hf-pdocker-02
network_mode: host
@@ -11,14 +11,14 @@ services:
- /sys:/host/sys:ro
- /:/rootfs:ro
command:
- '--path.procfs=/host/proc'
- '--path.rootfs=/rootfs'
- '--path.sysfs=/host/sys'
- '--collector.filesystem.mount-points-exclude=^/(sys|proc|dev|host|etc)($$|/)'
- "--path.procfs=/host/proc"
- "--path.rootfs=/rootfs"
- "--path.sysfs=/host/sys"
- "--collector.filesystem.mount-points-exclude=^/(sys|proc|dev|host|etc)($$|/)"
logging:
driver: "json-file"
driver: json-file
options:
max-size: "50m"
max-size: 50m
max-file: "3"
labels:
- "com.centurylinklabs.watchtower.enable=false"
- com.centurylinklabs.watchtower.enable=false
compose/hf-pdocker-02/unifi/DECOMMISSIONED.txt
+3
View File
@@ -0,0 +1,3 @@
Decommissioned 2026-10-05 and again 2026-10-26 (it had been revived and was running).
Duplicate controller; the real UniFi controller is the Podman UniFi OS Server on .150.
Do NOT compose up. Data kept in /var/lib/unifi-os (.100) + /mnt/docker-data/configs/unifi-os/persistent.
compose/hf-pdocker-02/unifi/docker-compose.yml → compose/hf-pdocker-02/unifi/docker-compose.yml.decommissioned-20261026
View File
compose/hf-pdocker-02/watchtower/docker-compose.yml
+2 -3
View File
@@ -1,6 +1,6 @@
services:
watchtower:
image: containrrr/watchtower:latest
image: nickfedor/watchtower:latest # containrrr/watchtower is archived upstream (2026-10-26)
container_name: watchtower
restart: unless-stopped
volumes:
@@ -8,12 +8,11 @@ services:
environment:
- WATCHTOWER_CLEANUP=true
- WATCHTOWER_INCLUDE_RESTARTING=true
- WATCHTOWER_POLL_INTERVAL=86400
- WATCHTOWER_SCHEDULE=0 0 4,16 * * * # twice daily, 04:00 + 16:00 local
- WATCHTOWER_MONITOR_ONLY=false
- TZ=America/Chicago
- DOCKER_API_VERSION=1.44
mem_limit: 256M
memswap_limit: 256M
logging:
driver: "json-file"
options: