Dynamic Proxmox inventory doesn't work in CI (token not configured).
Use static inventory like all other services.
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Uncomment token_id/token_secret so CI runners can discover hosts
via the Proxmox dynamic inventory plugin.
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
oCIS runs behind Caddy which handles TLS. Without OCIS_INSECURE=true
the internal services fail TLS verification on startup.
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Run 'ocis init || true' before 'ocis server' in the entrypoint.
Removes the separate init task that was hanging.
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
The docker_container module with detach:false hangs indefinitely.
Use shell docker run --rm which handles exit codes properly.
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
The auto_remove flag prevents reading container exit status.
Use stat check to skip init if already configured.
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Newer UniFi OS requires API key authentication instead of
username/password login. Removes deprecated credential variables.
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Newer versions use /api/auth/login (SSO endpoint) which returns 403
with local accounts. v0.41.12 uses /api/login which works correctly.
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
UniFi provider v0.41.12 can't authenticate with current UDM firmware.
Use flexible version constraint and tofu init -upgrade in CI.
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Woodpecker requires $$ for variable references and proper quoting
to avoid YAML parsing issues.
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Requires PIPELINE=run-ansible and PLAYBOOK=plays/<name>.yml variables.
Independent of S3/tofu state, useful for fixing infrastructure issues.
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Remove PIPELINE=="" catch-all from all pipelines so manual triggers
only run the specifically requested pipeline.
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Apply step now requires both manual trigger and TOFU_APPLY="true"
to prevent accidental applies of destructive plans.
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
LXC 236 on saturn with 4GB RAM, 4 cores, 50GB disk.
Includes Ansible role with Docker Compose, Authentik OIDC integration,
and vault secrets for admin password and OAuth credentials.
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Remove VM 107 (uptime-kuma), VM 110 (mosquitto), and VM 119 (cdns)
to reduce cluster resource usage. Frees 12 CPU cores.
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Keep redis:7.4-alpine (security update) but revert the service
rename that broke the running deployment. Valkey migration
needs to be done with proper container cleanup.
Immich:
- Migrate from redis:6.2-alpine to valkey:9-alpine (upstream change)
- Migrate from tensorchord/pgvecto-rs:pg16-v0.2.1 to
ghcr.io/immich-app/postgres:14-vectorchord0.4.3-pgvectors0.2.0
- Update REDIS_HOSTNAME to point to valkey service
Paperless:
- Update redis:7 to redis:7.4
- Pin postgres:15 to postgres:15.17
The SSH key has been successfully rotated. Remove the one-time
Gitea Actions workflow and Woodpecker sync pipeline.
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Generated fresh ed25519 key. Private key set directly in Woodpecker
secrets. Public key updated in locals.tf, vars.yml, and the SSH key
deployment playbook.
Run configure-ssh-keys.yml from fortress to deploy to all hosts.
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
k.rennerandClaude Opus 4.6