From 0b1ea2efb330fb6c7e74c0ae6751b83771479bae Mon Sep 17 00:00:00 2001 From: Frank Date: Fri, 25 Sep 2026 17:11:20 -0700 Subject: [PATCH] Bump pinned images to latest: authentik 2026.8.3, tautulli ls245, calibre-web ls402, plex 1.43.4 - authentik 2026.8.0 -> 2026.8.3 (server, worker, outpost quadlets) - tautulli v2.18.1-ls242 -> v2.18.1-ls245 - calibre-web 0.6.27-ls397 -> 0.6.27-ls402 - plex 1.43.3.10896-ls322 -> 1.43.4.10903-ls325 - seerr already at v3.4.1 (latest, no bump) - sync docs + the dead compose.yaml plex entry anubis is already at the latest stable (v1.27.0); only pre-releases exist beyond it, so no stable bump. Local-build images (caddy, alloy, loki, comfyui, hermes) are refreshed by forced --no-cache rebuilds, not pins. --- dankclaw/authentik/quadlet/authentik-outpost.container | 2 +- dankclaw/authentik/quadlet/authentik-server.container | 2 +- dankclaw/authentik/quadlet/authentik-worker.container | 2 +- dankserver/calibre-web/quadlet/calibre-web.container | 2 +- dankserver/compose.yaml | 2 +- dankserver/plex/quadlet/plex.container | 2 +- dankserver/tautulli/quadlet/tautulli.container | 2 +- serverAppConfigs-docs/Dankserver/Calibre-Web.md | 6 +++--- serverAppConfigs-docs/Dankserver/Plex.md | 2 +- serverAppConfigs-docs/Dankserver/Tautulli.md | 2 +- serverAppConfigs-docs/Infrastructure/Authentik.md | 6 +++--- serverAppConfigs-docs/Infrastructure/authentik-server.md | 2 +- serverAppConfigs-docs/Infrastructure/authentik-worker.md | 2 +- serverAppConfigs-docs/index.md | 2 +- 14 files changed, 18 insertions(+), 18 deletions(-) diff --git a/dankclaw/authentik/quadlet/authentik-outpost.container b/dankclaw/authentik/quadlet/authentik-outpost.container index d9206f8..ddd99cd 100644 --- a/dankclaw/authentik/quadlet/authentik-outpost.container +++ b/dankclaw/authentik/quadlet/authentik-outpost.container @@ -20,7 +20,7 @@ Wants=authentik-server.service [Container] ContainerName=authentik-outpost -Image=ghcr.io/goauthentik/server:2026.8.0 +Image=ghcr.io/goauthentik/server:2026.8.3 Exec=worker Network=dankclaw_default EnvironmentFile=/home/dank/serverAppConfigs/dankclaw/.env diff --git a/dankclaw/authentik/quadlet/authentik-server.container b/dankclaw/authentik/quadlet/authentik-server.container index 1e53480..156bcf7 100644 --- a/dankclaw/authentik/quadlet/authentik-server.container +++ b/dankclaw/authentik/quadlet/authentik-server.container @@ -19,7 +19,7 @@ Wants=authentik-postgres.service [Container] ContainerName=authentik-server -Image=ghcr.io/goauthentik/server:2026.8.0 +Image=ghcr.io/goauthentik/server:2026.8.3 Exec=server Network=dankclaw_default EnvironmentFile=/home/dank/serverAppConfigs/dankclaw/.env diff --git a/dankclaw/authentik/quadlet/authentik-worker.container b/dankclaw/authentik/quadlet/authentik-worker.container index e3422a4..2e4b8ed 100644 --- a/dankclaw/authentik/quadlet/authentik-worker.container +++ b/dankclaw/authentik/quadlet/authentik-worker.container @@ -16,7 +16,7 @@ Wants=authentik-server.service [Container] ContainerName=authentik-worker -Image=ghcr.io/goauthentik/server:2026.8.0 +Image=ghcr.io/goauthentik/server:2026.8.3 Exec=worker Network=dankclaw_default EnvironmentFile=/home/dank/serverAppConfigs/dankclaw/.env diff --git a/dankserver/calibre-web/quadlet/calibre-web.container b/dankserver/calibre-web/quadlet/calibre-web.container index 94c18aa..25e76b9 100644 --- a/dankserver/calibre-web/quadlet/calibre-web.container +++ b/dankserver/calibre-web/quadlet/calibre-web.container @@ -16,7 +16,7 @@ After=network.target [Container] ContainerName=calibre-web -Image=lscr.io/linuxserver/calibre-web:0.6.27-ls397 +Image=lscr.io/linuxserver/calibre-web:0.6.27-ls402 Network=pasta Environment=DOCKER_MODS=linuxserver/mods:universal-calibre Environment=LANG=en_US.UTF-8 diff --git a/dankserver/compose.yaml b/dankserver/compose.yaml index ec654dc..5dd3dfe 100644 --- a/dankserver/compose.yaml +++ b/dankserver/compose.yaml @@ -127,7 +127,7 @@ services: # Calibre-Web — e-book web frontend # ═══════════════════════════════════════════════ calibre-web: - image: lscr.io/linuxserver/calibre-web:0.6.27-ls397 + image: lscr.io/linuxserver/calibre-web:0.6.27-ls402 container_name: calibre-web restart: unless-stopped environment: diff --git a/dankserver/plex/quadlet/plex.container b/dankserver/plex/quadlet/plex.container index 1e70b1b..df32450 100644 --- a/dankserver/plex/quadlet/plex.container +++ b/dankserver/plex/quadlet/plex.container @@ -4,7 +4,7 @@ After=network-online.target Wants=network-online.target [Container] -Image=lscr.io/linuxserver/plex:1.43.3.10896-cb3ebc72d-ls322 +Image=lscr.io/linuxserver/plex:1.43.4.10903-e5521bd8c-ls325 ContainerName=plex Network=dankserver_appnet:alias=plex Environment=PUID=0 diff --git a/dankserver/tautulli/quadlet/tautulli.container b/dankserver/tautulli/quadlet/tautulli.container index 19c1a80..41348c1 100644 --- a/dankserver/tautulli/quadlet/tautulli.container +++ b/dankserver/tautulli/quadlet/tautulli.container @@ -4,7 +4,7 @@ After=network-online.target Wants=network-online.target [Container] -Image=lscr.io/linuxserver/tautulli:v2.18.1-ls242 +Image=lscr.io/linuxserver/tautulli:v2.18.1-ls245 ContainerName=tautulli Network=dankserver_appnet:alias=tautulli Environment=PUID=0 diff --git a/serverAppConfigs-docs/Dankserver/Calibre-Web.md b/serverAppConfigs-docs/Dankserver/Calibre-Web.md index 61660f8..035bde7 100644 --- a/serverAppConfigs-docs/Dankserver/Calibre-Web.md +++ b/serverAppConfigs-docs/Dankserver/Calibre-Web.md @@ -19,7 +19,7 @@ vhost — Calibre-Web serves its own login; direct proxy to | Item | Value | |------|-------| -| Running image | `lscr.io/linuxserver/calibre-web:0.6.27-ls397` — **pinned** (verified from the live quadlet unit; the pin was chosen so the cutover changed zero bits of application code) | +| Running image | `lscr.io/linuxserver/calibre-web:0.6.27-ls402` — **pinned** (verified from the live quadlet unit; the pin was chosen so the cutover changed zero bits of application code) | | Network | `pasta` (the default rootless-podman userslide network); only 8083 is host-published | | Base OS | Ubuntu Noble (24.04 LTS, since 2024-12-05) | | Port | 8083 (host) → 8083 (container) | @@ -69,7 +69,7 @@ Deployment since 2026-09-01 is a quadlet unit (`dankserver/calibre-web/quadlet/calibre-web.container` → `calibre-web.service`, deploy with `./scripts/deploy.sh dankserver --service calibre-web`), image pinned to -`0.6.27-ls397`, healthcheck on `/`, `PublishPort=8083:8083`. This service was +`0.6.27-ls402`, healthcheck on `/`, `PublishPort=8083:8083`. This service was already on the Containers data-root layout before the standardization, so the cutover was a bare-container retire + unit start with no data movement. @@ -78,7 +78,7 @@ cutover was a bare-container retire + unit start with no data movement. ```yaml services: calibre-web: - image: lscr.io/linuxserver/calibre-web:0.6.27-ls397 + image: lscr.io/linuxserver/calibre-web:0.6.27-ls402 container_name: calibre-web restart: unless-stopped environment: diff --git a/serverAppConfigs-docs/Dankserver/Plex.md b/serverAppConfigs-docs/Dankserver/Plex.md index 0da4af9..374ca2f 100644 --- a/serverAppConfigs-docs/Dankserver/Plex.md +++ b/serverAppConfigs-docs/Dankserver/Plex.md @@ -24,7 +24,7 @@ public traffic can be fronted by Caddy like every other vhost. | Item | Value | |------|-------| | Runtime | podman quadlet, `plex.service` (user manager) — migrated from the native `plexmediaserver.service` OS-package unit (2026-09) | -| Image | `lscr.io/linuxserver/plex:1.43.3.10896-cb3ebc72d-ls322` (pinned; verified == the ghcr `latest` manifest digest at pin time) | +| Image | `lscr.io/linuxserver/plex:1.43.4.10903-e5521bd8c-ls325` (pinned; verified == the ghcr `latest` manifest digest at pin time) | | Data root | `/var/lib/plexmediaserver` bind-mounted **in place** as `/config` (RW) — the migration moved zero bytes | | Media | `/mnt/entropy` mounted at the same absolute path **read-only** — every library path in the PMS database stayed valid, zero re-scan | | Identity | fleet rootless model — container root maps to the `dank` user (1000:1000); the deployer chowns the data root on first cutover | diff --git a/serverAppConfigs-docs/Dankserver/Tautulli.md b/serverAppConfigs-docs/Dankserver/Tautulli.md index 209f78a..4ed2738 100644 --- a/serverAppConfigs-docs/Dankserver/Tautulli.md +++ b/serverAppConfigs-docs/Dankserver/Tautulli.md @@ -23,7 +23,7 @@ it; it talks to PMS over the appnet at `http://plex:32400`). | Item | Value | |------|-------| | Runtime | podman quadlet, `tautulli.service` (user manager) — migrated from snap `snap.tautulli.tautulli.service` | -| Image | `lscr.io/linuxserver/tautulli:v2.18.1-ls242` (pinned; verified == the ghcr `latest` manifest digest at pin time) | +| Image | `lscr.io/linuxserver/tautulli:v2.18.1-ls245` (pinned; verified == the ghcr `latest` manifest digest at pin time) | | Data root | `/home/dank/Containers/tautulli` bind-mounted as `/config` (fresh at cutover — the snap's `/var/snap/tautulli/common` was empty) | | Identity | fleet rootless model — container root maps to the `dank` user (1000:1000) | | Port | `8181/tcp` published on `0.0.0.0` | diff --git a/serverAppConfigs-docs/Infrastructure/Authentik.md b/serverAppConfigs-docs/Infrastructure/Authentik.md index 92182d6..df38b5d 100644 --- a/serverAppConfigs-docs/Infrastructure/Authentik.md +++ b/serverAppConfigs-docs/Infrastructure/Authentik.md @@ -15,7 +15,7 @@ application-level authentication with its embedded proxy outpost. Apps that have their own login (Grafana, Gitea, OpenWebUI, Jellyfin, the *arr stack, Pi-hole) are not wrapped — they handle their own session. -- **Version:** `2026.8.0` (pinned in `dankclaw/authentik/quadlet/*.container`) +- **Version:** `2026.8.3` (pinned in `dankclaw/authentik/quadlet/*.container`) - **Host:** dankclaw (`192.168.0.143`) - **Name:** `auth.franksdank.cloud` - **Stack:** 3 compose services — `authentik-postgres`, `authentik-server`, @@ -70,8 +70,8 @@ contract: | Service | Role | Image | |---|---|---| | `authentik-postgres` | PostgreSQL 16 (users, flows, sessions, events) | `docker.io/library/postgres:16-alpine` | -| `authentik-server` | Core + admin API + the embedded Caddy outpost (port 9000) | `ghcr.io/goauthentik/server:2026.8.0` | -| `authentik-worker` | Background tasks (event processing, provider sync, flows) | `ghcr.io/goauthentik/server:2026.8.0` | +| `authentik-server` | Core + admin API + the embedded Caddy outpost (port 9000) | `ghcr.io/goauthentik/server:2026.8.3` | +| `authentik-worker` | Background tasks (event processing, provider sync, flows) | `ghcr.io/goauthentik/server:2026.8.3` | - **Postgres** is the only stateful store. Sessions, caching, and WebSockets moved to PostgreSQL in 2025.10 (Redis removed). diff --git a/serverAppConfigs-docs/Infrastructure/authentik-server.md b/serverAppConfigs-docs/Infrastructure/authentik-server.md index 459e3a9..e7f8255 100644 --- a/serverAppConfigs-docs/Infrastructure/authentik-server.md +++ b/serverAppConfigs-docs/Infrastructure/authentik-server.md @@ -15,7 +15,7 @@ This is the service the Caddy `forward_auth` vhosts proxy to `https://auth.franksdank.cloud`. - **Unit:** `dankclaw/authentik/quadlet/authentik-server.container` (`authentik-server.service`) -- **Image:** `ghcr.io/goauthentik/server:2026.8.0` (command: `server`) +- **Image:** `ghcr.io/goauthentik/server:2026.8.3` (command: `server`) - **Port:** `9000` (published; the outpost + admin + login all live here) - **Data:** `/home/dank/authentik/data` (bind mount, shared with the worker) - **Health:** `http://localhost:9000/-/health/` diff --git a/serverAppConfigs-docs/Infrastructure/authentik-worker.md b/serverAppConfigs-docs/Infrastructure/authentik-worker.md index 958aca5..a771b29 100644 --- a/serverAppConfigs-docs/Infrastructure/authentik-worker.md +++ b/serverAppConfigs-docs/Infrastructure/authentik-worker.md @@ -14,7 +14,7 @@ synchronization, scheduled flows, and certificate renewal. It runs the same image as the server; the `command: worker` selects the role. - **Unit:** `dankclaw/authentik/quadlet/authentik-worker.container` (`authentik-worker.service`) -- **Image:** `ghcr.io/goauthentik/server:2026.8.0` (command: `worker`) +- **Image:** `ghcr.io/goauthentik/server:2026.8.3` (command: `worker`) - **Runs as:** `0:0` (rootless: container root maps to the host user that owns the data dir) - **Data:** `/home/dank/authentik/data` (bind mount, shared with the server) - **No port** — the worker has no HTTP endpoint. diff --git a/serverAppConfigs-docs/index.md b/serverAppConfigs-docs/index.md index bf5980e..b899542 100644 --- a/serverAppConfigs-docs/index.md +++ b/serverAppConfigs-docs/index.md @@ -46,7 +46,7 @@ covers both workloads). - [[Calibre-Web]] — e-book web frontend - [[Plex]] — media server on Dankserver (lscr.io/linuxserver/plex container via quadlet; CPU decode only — no GPU passthrough) -- [[Tautulli]] — Plex statistics and notifications (v2.18.1-ls242, quadlet unit) +- [[Tautulli]] — Plex statistics and notifications (v2.18.1-ls245, quadlet unit) - [[mariadb]] — RomM database backend - [[redis]] — RomM cache/queue backend