fix(image-automation): scan the Immich repositories every 6h

immich-machine-learning has ~222k tags and immich-server ~33k, nearly all PR builds. Each anonymous scan pages the full list (about 220 requests of 1000 tags for ML) and hourly scans hit ghcr.io's TOOMANYREQUESTS. Immich releases a few times a week at most, so 6h costs nothing. S28-40 Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Merge pull request 'fix(authentik): admit the UDM's LDAPS sync to the LDAP outpost' (#1600 ) from fix/ldap-outpost-udm-ldaps into main
2026-11-07 22:07:33 +01:00 · 2026-11-07 21:03:33 +00:00 · 2026-11-07 22:02:30 +01:00 · 2026-11-07 22:00:21 +01:00 · 2026-11-07 20:02:17 +00:00
3 changed files with 23 additions and 2 deletions
@@ -34,3 +34,10 @@ spec:
              protocol: TCP
            - port: "6636"
              protocol: TCP
+    # The UDM's LDAPS admin-auth sync.
+    - fromCIDRSet:
+        - cidrGroupRef: udm-k8s-ingress
+      toPorts:
+        - ports:
+            - port: "6636"
+              protocol: TCP
@@ -1,11 +1,14 @@
 apiVersion: image.toolkit.fluxcd.io/v1
 kind: ImageRepository
+# 6h, not 1h: both repositories carry tens to hundreds of thousands of PR
+# build tags, and every scan pages the full list anonymously, which runs
+# into ghcr.io's rate limit.
 metadata:
  name: immich-server
  namespace: flux-system
 spec:
  image: ghcr.io/immich-app/immich-server
-  interval: 1h
+  interval: 6h
 ---
 # v-prefix tags only, semver 3.x. The 4.x cutover would need manual
 # review — Immich major bumps historically require migration.
@@ -31,7 +34,7 @@ metadata:
  namespace: flux-system
 spec:
  image: ghcr.io/immich-app/immich-machine-learning
-  interval: 1h
+  interval: 6h
 ---
 # Same policy as immich-server; machine-learning image must stay in
 # version-sync with the server image (Immich docs require it).
@@ -74,6 +74,17 @@ spec:
    - fd02:47::/64
    - 10.2.47.0/24
 ---
+# The UDM's own address on k8s-ingress, which it sources from towards the
+# cluster's LoadBalancer IPs.
+apiVersion: cilium.io/v2
+kind: CiliumCIDRGroup
+metadata:
+  name: udm-k8s-ingress
+spec:
+  externalCIDRs:
+    - fd02:47::1/128
+    - 10.2.47.1/32
+---
 apiVersion: cilium.io/v2
 kind: CiliumCIDRGroup
 metadata:
Author	SHA1	Message	Date
claude-botandClaude Opus 5.5	59cc813a87	fix(image-automation): scan the Immich repositories every 6h ci/woodpecker/pr/ci-scripts-test Pipeline was successful Details ci/woodpecker/pr/ci-manifests-test Pipeline was successful Details immich-machine-learning has ~222k tags and immich-server ~33k, nearly all PR builds. Each anonymous scan pages the full list (about 220 requests of 1000 tags for ML) and hourly scans hit ghcr.io's TOOMANYREQUESTS. Immich releases a few times a week at most, so 6h costs nothing. S28-40 Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>	2026-11-07 22:07:33 +01:00
k.renner	979e3910ca	Merge pull request 'fix(authentik): admit the UDM's LDAPS sync to the LDAP outpost' (#1600 ) from fix/ldap-outpost-udm-ldaps into main Reviewed-on: #1600	2026-11-07 21:03:33 +00:00
claude-botandClaude Opus 5.5	6a0dbf9e26	fix(authentik): admit only the UDM's own address, not all of k8s-ingress ci/woodpecker/pr/ci-scripts-test Pipeline was successful Details ci/woodpecker/pr/ci-manifests-test Pipeline was successful Details New CIDR group udm-k8s-ingress (10.2.47.1/32, fd02:47::1/128); the LDAPS rule references it instead of the whole net-k8s-ingress network. S28-39 Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>	2026-11-07 22:02:30 +01:00
claude-botandClaude Opus 5.5	e25f1a43f8	fix(authentik): admit the UDM's LDAPS sync to the LDAP outpost ci/woodpecker/pr/ci-scripts-test Pipeline was successful Details ci/woodpecker/pr/ci-manifests-test Pipeline was canceled Details The UDM authenticates admins against ldap.renner.uno:636 and syncs hourly. It sources from its k8s-ingress address (10.2.47.1 / fd02:47::1), which ldap-outpost-lan-ingress did not admit: 200 SYNs a day dropped at :26 every hour. Same group the alloy-syslog and CoreDNS policies use for the UDM; LDAPS only. S28-39 Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>	2026-11-07 22:00:21 +01:00
k.renner	a4e5f99ca1	Merge pull request 'docs(trmnl): note the expected Google drops from the renderer's Chromium' (#1599 ) from docs/trmnl-renderer-google-drops into main Reviewed-on: #1599	2026-11-07 20:02:17 +00:00