Frank
d2810ab610
Closing the command-center security queue #70/#71/#72/#73/#74: rolling tags let a rebuild move under a running service with nobody approving it, and make a CVE audit ungradeable. 36 quadlet units across dankclaw, dankserver and frankbook-pro now carry tag@sha256; localhost/* builds stay exempt (their build is the pin). The pihole and copyparty pins pull the fixed builds; valkey 9.1.2 (already running) and redis 7.4.11 are pinned in place, vendor fixes TBD. New gate tests/quadlet_image_pins.bats: no unpinned registry image, no generator-rejected key anywhere. Three seams that pinned the old exact-tag law (frankbook readarr, open_webui, seerr) now require tag AND digest - strictly stronger. Quadlet Lifecycle docs: batch-abort law, entrypoint flags-only law, pin law.
36 lines
1.1 KiB
INI
36 lines
1.1 KiB
INI
# Quadlet unit: Readarr in FrankBook-Pro's podman machine.
|
|
#
|
|
# Install path is INSIDE the machine VM:
|
|
# /home/core/.config/containers/systemd/readarr.container
|
|
#
|
|
#
|
|
# Joins gluetun's network namespace: all egress exits through the WireGuard
|
|
# tunnel; 8787 publishes on the gluetun unit.
|
|
# Grab-only: no media binds; config migrated from dankserver's retired
|
|
# bare container.
|
|
#
|
|
# Image pinned to amd64-1.0.980 (per project image-pin policy — same tag the
|
|
# dankserver compose ran): `latest` historically shipped an amd64-only build
|
|
# of a broken 1.x nightly for Readarr; the pin avoids surprises.
|
|
[Unit]
|
|
Description=Readarr (FrankBook-Pro)
|
|
Wants=gluetun.service
|
|
After=gluetun.service
|
|
|
|
[Container]
|
|
ContainerName=readarr
|
|
Image=lscr.io/linuxserver/readarr:amd64-1.0.980@sha256:a95e82dbb0eb2bb43de4c150f1dab9dd821306c67ea0b418983a957e731f2b61
|
|
Environment=PUID=0
|
|
Environment=PGID=0
|
|
Environment=TZ=America/Los_Angeles
|
|
Environment=UMASK_SET=022
|
|
Volume=/Volumes/COMPLETE/readarr-data:/config
|
|
Network=gluetun.container
|
|
|
|
[Service]
|
|
TimeoutStartSec=900
|
|
Restart=always
|
|
|
|
[Install]
|
|
WantedBy=default.target
|