dank/serverAppConfigs
1
0
Fork 0
Code Issues 6 Pull Requests Actions Packages Projects Releases Wiki Activity

Bump pinned images to latest: authentik 2026.8.3, tautulli ls245, calibre-web ls402, plex 1.43.4

Browse Source 
- authentik 2026.8.0 -> 2026.8.3 (server, worker, outpost quadlets)
- tautulli v2.18.1-ls242 -> v2.18.1-ls245
- calibre-web 0.6.27-ls397 -> 0.6.27-ls402
- plex 1.43.3.10896-ls322 -> 1.43.4.10903-ls325
- seerr already at v3.4.1 (latest, no bump)
- sync docs + the dead compose.yaml plex entry

anubis is already at the latest stable (v1.27.0); only pre-releases exist
beyond it, so no stable bump. Local-build images (caddy, alloy, loki,
comfyui, hermes) are refreshed by forced --no-cache rebuilds, not pins.
This commit is contained in:
Frank
2026-09-25 17:11:20 -07:00
parent 650dcba0ea
commit 0b1ea2efb3
14 changed files with 18 additions and 18 deletions
Download Patch File Download Diff File Expand all files Collapse all files
serverAppConfigs-docs/Dankserver/Calibre-Web.md
+3 -3
View File
@@ -19,7 +19,7 @@ vhost — Calibre-Web serves its own login; direct proxy to
| Item | Value |
|------|-------|
| Running image | `lscr.io/linuxserver/calibre-web:0.6.27-ls397` — **pinned** (verified from the live quadlet unit; the pin was chosen so the cutover changed zero bits of application code) |
| Running image | `lscr.io/linuxserver/calibre-web:0.6.27-ls402` — **pinned** (verified from the live quadlet unit; the pin was chosen so the cutover changed zero bits of application code) |
| Network | `pasta` (the default rootless-podman userslide network); only 8083 is host-published |
| Base OS | Ubuntu Noble (24.04 LTS, since 2024-12-05) |
| Port | 8083 (host) → 8083 (container) |
@@ -69,7 +69,7 @@ Deployment since 2026-09-01 is a quadlet unit
(`dankserver/calibre-web/quadlet/calibre-web.container` →
`calibre-web.service`, deploy with
`./scripts/deploy.sh dankserver --service calibre-web`), image pinned to
`0.6.27-ls397`, healthcheck on `/`, `PublishPort=8083:8083`. This service was
`0.6.27-ls402`, healthcheck on `/`, `PublishPort=8083:8083`. This service was
already on the Containers data-root layout before the standardization, so the
cutover was a bare-container retire + unit start with no data movement.
@@ -78,7 +78,7 @@ cutover was a bare-container retire + unit start with no data movement.
```yaml
services:
calibre-web:
image: lscr.io/linuxserver/calibre-web:0.6.27-ls397
image: lscr.io/linuxserver/calibre-web:0.6.27-ls402
container_name: calibre-web
restart: unless-stopped
environment:
serverAppConfigs-docs/Dankserver/Plex.md
+1 -1
View File
@@ -24,7 +24,7 @@ public traffic can be fronted by Caddy like every other vhost.
| Item | Value |
|------|-------|
| Runtime | podman quadlet, `plex.service` (user manager) — migrated from the native `plexmediaserver.service` OS-package unit (2026-09) |
| Image | `lscr.io/linuxserver/plex:1.43.3.10896-cb3ebc72d-ls322` (pinned; verified == the ghcr `latest` manifest digest at pin time) |
| Image | `lscr.io/linuxserver/plex:1.43.4.10903-e5521bd8c-ls325` (pinned; verified == the ghcr `latest` manifest digest at pin time) |
| Data root | `/var/lib/plexmediaserver` bind-mounted **in place** as `/config` (RW) — the migration moved zero bytes |
| Media | `/mnt/entropy` mounted at the same absolute path **read-only** — every library path in the PMS database stayed valid, zero re-scan |
| Identity | fleet rootless model — container root maps to the `dank` user (1000:1000); the deployer chowns the data root on first cutover |
serverAppConfigs-docs/Dankserver/Tautulli.md
+1 -1
View File
@@ -23,7 +23,7 @@ it; it talks to PMS over the appnet at `http://plex:32400`).
| Item | Value |
|------|-------|
| Runtime | podman quadlet, `tautulli.service` (user manager) — migrated from snap `snap.tautulli.tautulli.service` |
| Image | `lscr.io/linuxserver/tautulli:v2.18.1-ls242` (pinned; verified == the ghcr `latest` manifest digest at pin time) |
| Image | `lscr.io/linuxserver/tautulli:v2.18.1-ls245` (pinned; verified == the ghcr `latest` manifest digest at pin time) |
| Data root | `/home/dank/Containers/tautulli` bind-mounted as `/config` (fresh at cutover — the snap's `/var/snap/tautulli/common` was empty) |
| Identity | fleet rootless model — container root maps to the `dank` user (1000:1000) |
| Port | `8181/tcp` published on `0.0.0.0` |
serverAppConfigs-docs/Infrastructure/Authentik.md
+3 -3
View File
@@ -15,7 +15,7 @@ application-level authentication with its embedded proxy outpost. Apps that
have their own login (Grafana, Gitea, OpenWebUI, Jellyfin, the *arr stack,
Pi-hole) are not wrapped — they handle their own session.
- **Version:** `2026.8.0` (pinned in `dankclaw/authentik/quadlet/*.container`)
- **Version:** `2026.8.3` (pinned in `dankclaw/authentik/quadlet/*.container`)
- **Host:** dankclaw (`192.168.0.143`)
- **Name:** `auth.franksdank.cloud`
- **Stack:** 3 compose services — `authentik-postgres`, `authentik-server`,
@@ -70,8 +70,8 @@ contract:
| Service | Role | Image |
|---|---|---|
| `authentik-postgres` | PostgreSQL 16 (users, flows, sessions, events) | `docker.io/library/postgres:16-alpine` |
| `authentik-server` | Core + admin API + the embedded Caddy outpost (port 9000) | `ghcr.io/goauthentik/server:2026.8.0` |
| `authentik-worker` | Background tasks (event processing, provider sync, flows) | `ghcr.io/goauthentik/server:2026.8.0` |
| `authentik-server` | Core + admin API + the embedded Caddy outpost (port 9000) | `ghcr.io/goauthentik/server:2026.8.3` |
| `authentik-worker` | Background tasks (event processing, provider sync, flows) | `ghcr.io/goauthentik/server:2026.8.3` |
- **Postgres** is the only stateful store. Sessions, caching, and WebSockets
moved to PostgreSQL in 2025.10 (Redis removed).
serverAppConfigs-docs/Infrastructure/authentik-server.md
+1 -1
View File
@@ -15,7 +15,7 @@ This is the service the Caddy `forward_auth` vhosts proxy to
`https://auth.franksdank.cloud`.
- **Unit:** `dankclaw/authentik/quadlet/authentik-server.container` (`authentik-server.service`)
- **Image:** `ghcr.io/goauthentik/server:2026.8.0` (command: `server`)
- **Image:** `ghcr.io/goauthentik/server:2026.8.3` (command: `server`)
- **Port:** `9000` (published; the outpost + admin + login all live here)
- **Data:** `/home/dank/authentik/data` (bind mount, shared with the worker)
- **Health:** `http://localhost:9000/-/health/`
serverAppConfigs-docs/Infrastructure/authentik-worker.md
+1 -1
View File
@@ -14,7 +14,7 @@ synchronization, scheduled flows, and certificate renewal. It runs the same
image as the server; the `command: worker` selects the role.
- **Unit:** `dankclaw/authentik/quadlet/authentik-worker.container` (`authentik-worker.service`)
- **Image:** `ghcr.io/goauthentik/server:2026.8.0` (command: `worker`)
- **Image:** `ghcr.io/goauthentik/server:2026.8.3` (command: `worker`)
- **Runs as:** `0:0` (rootless: container root maps to the host user that owns the data dir)
- **Data:** `/home/dank/authentik/data` (bind mount, shared with the server)
- **No port** — the worker has no HTTP endpoint.
serverAppConfigs-docs/index.md
+1 -1
View File
@@ -46,7 +46,7 @@ covers both workloads).
- [[Calibre-Web]] — e-book web frontend
- [[Plex]] — media server on Dankserver (lscr.io/linuxserver/plex container via
quadlet; CPU decode only — no GPU passthrough)
- [[Tautulli]] — Plex statistics and notifications (v2.18.1-ls242, quadlet unit)
- [[Tautulli]] — Plex statistics and notifications (v2.18.1-ls245, quadlet unit)
- [[mariadb]] — RomM database backend
- [[redis]] — RomM cache/queue backend