archipelago
b12d1d3826
Five apps had no app.upstream block, so nothing could ever tell us
when their pins fell behind upstream:
barkd gitlab ark-bitcoin/bark (GitLab-only project)
immich-postgres ghcr immich-app/postgres (image exists only on ghcr.io)
indeedhub-minio github minio/minio
pine-whisper dockerhub rhasspy/wyoming-whisper
lightning-stack manual — no public listing exists for
lightninglabs/lightning-stack anywhere (docker.io,
ghcr.io, github.com all checked), so it is tracked by hand
This adds two fetchers to scripts/check-upstream-releases.py to reach the
first two: latest_gitlab (GitLab releases API; strips the project-name
tag prefix, e.g. bark-0.6.2 -> 0.6.2) and latest_ghcr (anonymous pull
token + tags/list, the same handshake a docker pull performs).
Live-verified after the change:
barkd 0.3.0 -> 0.6.2 (bump gated on ark_client.rs REST compat)
immich-postgres 14-vectorchord0.4.3-pgvectors0.2.0 -> 17-vectorchord0.4.3-pgvector0.8.0
indeedhub-minio RELEASE.2024-11-07T00-52-20Z -> latest (date-opaque: UNCOMPARABLE, shown for hand comparison)
pine-whisper 3.4.1 -> 3.6.0 (tuned-args revision needs re-basing, not just a pin move)
Offline coverage check: 59 apps, 0 untracked.
65 lines
1.9 KiB
YAML
65 lines
1.9 KiB
YAML
app:
|
|
id: immich-postgres
|
|
name: Immich Postgres
|
|
version: "14-vectorchord0.4.3-pgvectors0.2.0"
|
|
# Upstream is the Immich-built Postgres image, published only on ghcr.io
|
|
# (no GitHub release tags, no Docker Hub repo) — the ghcr fetcher in
|
|
# scripts/check-upstream-releases.py is the only one that can see it.
|
|
upstream:
|
|
kind: ghcr
|
|
repo: immich-app/postgres
|
|
description: Postgres (pgvecto.rs / vectorchord) backend for Immich.
|
|
|
|
# Container named immich_postgres (underscore) to match the runtime's existing
|
|
# per-app references (lifecycle/health/crash-recovery/config) and serve as the
|
|
# server's DB_HOSTNAME alias. Top-level key → serde(flatten) → extensions →
|
|
# compute_container_name.
|
|
container_name: immich_postgres
|
|
|
|
container:
|
|
image: source.archipelago-foundation.org/lfg2025/immich-postgres:14-vectorchord0.4.3-pgvectors0.2.0
|
|
pull_policy: if-not-present
|
|
network: archy-net
|
|
# postgres drops to its own uid (container 999 → host 100998 under rootless),
|
|
# so the data dir must be owned by that mapped uid — mirrors archy-btcpay-db.
|
|
# Verified on .228: the live immich-db is owned 100998. Without this a FRESH
|
|
# install's dir would be service-user-owned and postgres would EACCES.
|
|
data_uid: "100998:100998"
|
|
generated_secrets:
|
|
- name: immich-db-password
|
|
kind: hex32
|
|
secret_env:
|
|
- key: POSTGRES_PASSWORD
|
|
secret_file: immich-db-password
|
|
|
|
dependencies:
|
|
- storage: 40Gi
|
|
|
|
resources:
|
|
memory_limit: 2Gi
|
|
disk_limit: 40Gi
|
|
|
|
security:
|
|
capabilities: [CHOWN, DAC_OVERRIDE, FOWNER, SETGID, SETUID]
|
|
readonly_root: false
|
|
network_policy: isolated
|
|
|
|
ports: []
|
|
|
|
volumes:
|
|
- type: bind
|
|
source: /var/lib/archipelago/immich-db
|
|
target: /var/lib/postgresql/data
|
|
options: [rw]
|
|
|
|
environment:
|
|
- POSTGRES_USER=postgres
|
|
- POSTGRES_DB=immich
|
|
|
|
health_check:
|
|
type: tcp
|
|
endpoint: localhost:5432
|
|
interval: 30s
|
|
timeout: 5s
|
|
retries: 3
|