mirror of
https://github.com/kevinveenbirkenbach/computer-playbook.git
synced 2026-11-06 02:54:26 +00:00
Release version 16.2.0
This commit is contained in:
6 files changed
+224
-87
No files matched your search
@@ -1,5 +1,38 @@
|
||||
# Changelog
|
||||
|
||||
## [16.2.0] - 2026-10-20
|
||||
|
||||
Added:
|
||||
|
||||
- Compose: *make compose-network-recreate* rebuilds the stack network safely
|
||||
- CI: the updater keeps the GitHub-hosted runner labels current
|
||||
|
||||
Fixed:
|
||||
|
||||
- Backup: hard links, ACLs and xattrs survive every backup and recover hop
|
||||
- NFS client: clients on Linux 6.19+ no longer fail writes on ganesha < 9.11
|
||||
- AppArmor: the teardown keeps docker-default, so containers keep starting
|
||||
- Wazuh: hosts can be put into WireGuard meshes like every other role
|
||||
- CI: GitHub-hosted runners are pinned to ubuntu-24.04
|
||||
|
||||
Version jumps (net since 16.1.0):
|
||||
|
||||
- *svc-db-rabbitmq*: 4.3-management-alpine to 4.4-management-alpine
|
||||
- *web-app-n8n*: 2.44.4 to 2.45.0
|
||||
- *web-app-pixelfed*: 20261019 to 20261020
|
||||
- *web-app-snipe-it*: v8.8.0-alpine to v8.8.1-alpine
|
||||
- *web-app-taiga*: RabbitMQ 4.3-management-alpine to 4.4-management-alpine
|
||||
- *eslint* (dev): ^10.12.0 to ^10.13.0
|
||||
|
||||
Upgrade notes:
|
||||
|
||||
- Backup: a target without xattr support now fails instead of losing them
|
||||
- Dev: worktree hosts apply the IP pool with *make compose-network-recreate*
|
||||
|
||||
Contributors:
|
||||
|
||||
- [Kevin Veen-Birkenbach](https://veen.world): backups, NFS, AppArmor, CI
|
||||
|
||||
## [16.1.0] - 2026-10-19
|
||||
|
||||
Added:
|
||||
|
||||
@@ -9,49 +9,8 @@ proxy_request_buffering off;
|
||||
proxy_read_timeout 300s;
|
||||
proxy_connect_timeout 30s;
|
||||
|
||||
# Docker embedded DNS, pinned to bypass image-specific resolv.conf order.
|
||||
resolver 127.0.0.11 ipv6=off valid=30s;
|
||||
|
||||
# Nexus answers 502 when a proxy's remote is unreachable (measured) and has no
|
||||
# group repository type for apt, so the mirror failover sits here rather than in
|
||||
# the repo layout. 5xx only: a 404 means the file genuinely is not in the suite,
|
||||
# and apt probes for missing files often enough that retrying those would double
|
||||
# the request rate.
|
||||
#
|
||||
# Nexus answers that 502 only after trying every address of the remote in turn,
|
||||
# one connect timeout each; for a remote with several addresses that outlasts a
|
||||
# client's own timeout before the mirror is ever asked.
|
||||
#
|
||||
# These stay prefix locations. A regex location forfeits nginx's implicit
|
||||
# `/debian` -> `/debian/` redirect, and the URL-reachability test probes exactly
|
||||
# that slash-less form through the runner's DNS hijack, so it turns into a 404.
|
||||
server {
|
||||
listen 80;
|
||||
server_name deb.debian.org;
|
||||
location /debian/ {
|
||||
rewrite ^/debian/(.*)$ /repository/apt-debian/$1 break;
|
||||
proxy_intercept_errors on;
|
||||
proxy_read_timeout 8s;
|
||||
error_page 502 503 504 = @debian_mirror;
|
||||
proxy_pass http://package-cache:8081;
|
||||
}
|
||||
location @debian_mirror {
|
||||
rewrite ^/repository/apt-debian/(.*)$ /repository/apt-debian-mirror/$1 break;
|
||||
proxy_pass http://package-cache:8081;
|
||||
}
|
||||
location /debian-security/ {
|
||||
rewrite ^/debian-security/(.*)$ /repository/apt-debian-security/$1 break;
|
||||
proxy_intercept_errors on;
|
||||
proxy_read_timeout 8s;
|
||||
error_page 502 503 504 = @debian_security_mirror;
|
||||
proxy_pass http://package-cache:8081;
|
||||
}
|
||||
location @debian_security_mirror {
|
||||
rewrite ^/repository/apt-debian-security/(.*)$ /repository/apt-debian-security-mirror/$1 break;
|
||||
proxy_pass http://package-cache:8081;
|
||||
}
|
||||
}
|
||||
|
||||
server {
|
||||
listen 80;
|
||||
server_name archive.ubuntu.com;
|
||||
@@ -59,26 +18,59 @@ server {
|
||||
rewrite ^/ubuntu/(.*)$ /repository/apt-ubuntu/$1 break;
|
||||
proxy_intercept_errors on;
|
||||
proxy_read_timeout 8s;
|
||||
error_page 502 503 504 = @ubuntu_mirror;
|
||||
error_page 502 503 504 = @apt_ubuntu_mirror;
|
||||
proxy_pass http://package-cache:8081;
|
||||
}
|
||||
location @ubuntu_mirror {
|
||||
location @apt_ubuntu_mirror {
|
||||
rewrite ^/repository/apt-ubuntu/(.*)$ /repository/apt-ubuntu-mirror/$1 break;
|
||||
proxy_pass http://package-cache:8081;
|
||||
}
|
||||
}
|
||||
|
||||
server {
|
||||
listen 443 ssl;
|
||||
server_name argos-net.com;
|
||||
ssl_certificate /etc/nginx/certs/argos-net.com.crt;
|
||||
ssl_certificate_key /etc/nginx/certs/argos-net.com.key;
|
||||
location / {
|
||||
proxy_read_timeout 1800s;
|
||||
proxy_pass http://package-cache:8081/repository/raw-argos-net/;
|
||||
}
|
||||
}
|
||||
|
||||
server {
|
||||
listen 443 ssl;
|
||||
server_name codeload.github.com;
|
||||
ssl_certificate /etc/nginx/certs/codeload.github.com.crt;
|
||||
ssl_certificate_key /etc/nginx/certs/codeload.github.com.key;
|
||||
location / {
|
||||
proxy_pass http://package-cache:8081/repository/raw-codeload-github/;
|
||||
}
|
||||
}
|
||||
|
||||
server {
|
||||
listen 80;
|
||||
server_name security.ubuntu.com;
|
||||
location /ubuntu/ {
|
||||
rewrite ^/ubuntu/(.*)$ /repository/apt-ubuntu-security/$1 break;
|
||||
server_name deb.debian.org;
|
||||
location /debian/ {
|
||||
rewrite ^/debian/(.*)$ /repository/apt-debian/$1 break;
|
||||
proxy_intercept_errors on;
|
||||
proxy_read_timeout 8s;
|
||||
error_page 502 503 504 = @ubuntu_security_mirror;
|
||||
error_page 502 503 504 = @apt_debian_mirror;
|
||||
proxy_pass http://package-cache:8081;
|
||||
}
|
||||
location @ubuntu_security_mirror {
|
||||
rewrite ^/repository/apt-ubuntu-security/(.*)$ /repository/apt-ubuntu-security-mirror/$1 break;
|
||||
location @apt_debian_mirror {
|
||||
rewrite ^/repository/apt-debian/(.*)$ /repository/apt-debian-mirror/$1 break;
|
||||
proxy_pass http://package-cache:8081;
|
||||
}
|
||||
location /debian-security/ {
|
||||
rewrite ^/debian-security/(.*)$ /repository/apt-debian-security/$1 break;
|
||||
proxy_intercept_errors on;
|
||||
proxy_read_timeout 8s;
|
||||
error_page 502 503 504 = @apt_debian_security_mirror;
|
||||
proxy_pass http://package-cache:8081;
|
||||
}
|
||||
location @apt_debian_security_mirror {
|
||||
rewrite ^/repository/apt-debian-security/(.*)$ /repository/apt-debian-security-mirror/$1 break;
|
||||
proxy_pass http://package-cache:8081;
|
||||
}
|
||||
}
|
||||
@@ -94,11 +86,11 @@ server {
|
||||
|
||||
server {
|
||||
listen 443 ssl;
|
||||
server_name pypi.org;
|
||||
ssl_certificate /etc/nginx/certs/pypi.org.crt;
|
||||
ssl_certificate_key /etc/nginx/certs/pypi.org.key;
|
||||
server_name dl-cdn.alpinelinux.org;
|
||||
ssl_certificate /etc/nginx/certs/dl-cdn.alpinelinux.org.crt;
|
||||
ssl_certificate_key /etc/nginx/certs/dl-cdn.alpinelinux.org.key;
|
||||
location / {
|
||||
proxy_pass http://package-cache:8081/repository/pypi-proxy/;
|
||||
proxy_pass http://package-cache:8081/repository/raw-alpine/;
|
||||
}
|
||||
}
|
||||
|
||||
@@ -114,28 +106,24 @@ server {
|
||||
|
||||
server {
|
||||
listen 443 ssl;
|
||||
server_name registry.npmjs.org;
|
||||
ssl_certificate /etc/nginx/certs/registry.npmjs.org.crt;
|
||||
ssl_certificate_key /etc/nginx/certs/registry.npmjs.org.key;
|
||||
# Tarball URLs Nexus emits already carry /repository/npm-proxy/; pass them
|
||||
# through as-is (no path on proxy_pass) so they aren't double-prefixed → 404.
|
||||
location /repository/npm-proxy/ {
|
||||
proxy_pass http://package-cache:8081;
|
||||
}
|
||||
server_name huggingface.co;
|
||||
ssl_certificate /etc/nginx/certs/huggingface.co.crt;
|
||||
ssl_certificate_key /etc/nginx/certs/huggingface.co.key;
|
||||
location / {
|
||||
proxy_pass http://package-cache:8081/repository/npm-proxy/;
|
||||
proxy_pass http://package-cache:8081/repository/raw-huggingface/;
|
||||
}
|
||||
}
|
||||
|
||||
server {
|
||||
listen 443 ssl;
|
||||
server_name rubygems.org;
|
||||
ssl_certificate /etc/nginx/certs/rubygems.org.crt;
|
||||
ssl_certificate_key /etc/nginx/certs/rubygems.org.key;
|
||||
server_name index.crates.io;
|
||||
ssl_certificate /etc/nginx/certs/index.crates.io.crt;
|
||||
ssl_certificate_key /etc/nginx/certs/index.crates.io.key;
|
||||
location / {
|
||||
proxy_pass http://package-cache:8081/repository/gem-proxy/;
|
||||
proxy_pass http://package-cache:8081/repository/raw-crates-index/;
|
||||
}
|
||||
}
|
||||
|
||||
server {
|
||||
listen 443 ssl;
|
||||
server_name index.rubygems.org;
|
||||
@@ -146,16 +134,6 @@ server {
|
||||
}
|
||||
}
|
||||
|
||||
server {
|
||||
listen 443 ssl;
|
||||
server_name repo.packagist.org;
|
||||
ssl_certificate /etc/nginx/certs/repo.packagist.org.crt;
|
||||
ssl_certificate_key /etc/nginx/certs/repo.packagist.org.key;
|
||||
location / {
|
||||
proxy_pass http://package-cache:8081/repository/raw-packagist/;
|
||||
}
|
||||
}
|
||||
|
||||
server {
|
||||
listen 443 ssl;
|
||||
server_name proxy.golang.org;
|
||||
@@ -168,11 +146,11 @@ server {
|
||||
|
||||
server {
|
||||
listen 443 ssl;
|
||||
server_name dl-cdn.alpinelinux.org;
|
||||
ssl_certificate /etc/nginx/certs/dl-cdn.alpinelinux.org.crt;
|
||||
ssl_certificate_key /etc/nginx/certs/dl-cdn.alpinelinux.org.key;
|
||||
server_name pypi.org;
|
||||
ssl_certificate /etc/nginx/certs/pypi.org.crt;
|
||||
ssl_certificate_key /etc/nginx/certs/pypi.org.key;
|
||||
location / {
|
||||
proxy_pass http://package-cache:8081/repository/raw-alpine/;
|
||||
proxy_pass http://package-cache:8081/repository/pypi-proxy/;
|
||||
}
|
||||
}
|
||||
|
||||
@@ -188,10 +166,69 @@ server {
|
||||
|
||||
server {
|
||||
listen 443 ssl;
|
||||
server_name codeload.github.com;
|
||||
ssl_certificate /etc/nginx/certs/codeload.github.com.crt;
|
||||
ssl_certificate_key /etc/nginx/certs/codeload.github.com.key;
|
||||
server_name registry.npmjs.org;
|
||||
ssl_certificate /etc/nginx/certs/registry.npmjs.org.crt;
|
||||
ssl_certificate_key /etc/nginx/certs/registry.npmjs.org.key;
|
||||
location /repository/npm-proxy/ {
|
||||
proxy_pass http://package-cache:8081;
|
||||
}
|
||||
location / {
|
||||
proxy_pass http://package-cache:8081/repository/raw-codeload-github/;
|
||||
proxy_pass http://package-cache:8081/repository/npm-proxy/;
|
||||
}
|
||||
}
|
||||
|
||||
server {
|
||||
listen 443 ssl;
|
||||
server_name registry.ollama.ai;
|
||||
ssl_certificate /etc/nginx/certs/registry.ollama.ai.crt;
|
||||
ssl_certificate_key /etc/nginx/certs/registry.ollama.ai.key;
|
||||
location / {
|
||||
proxy_pass http://package-cache:8081/repository/raw-ollama-registry/;
|
||||
}
|
||||
}
|
||||
|
||||
server {
|
||||
listen 443 ssl;
|
||||
server_name repo.packagist.org;
|
||||
ssl_certificate /etc/nginx/certs/repo.packagist.org.crt;
|
||||
ssl_certificate_key /etc/nginx/certs/repo.packagist.org.key;
|
||||
location / {
|
||||
proxy_pass http://package-cache:8081/repository/raw-packagist/;
|
||||
}
|
||||
}
|
||||
|
||||
server {
|
||||
listen 443 ssl;
|
||||
server_name rubygems.org;
|
||||
ssl_certificate /etc/nginx/certs/rubygems.org.crt;
|
||||
ssl_certificate_key /etc/nginx/certs/rubygems.org.key;
|
||||
location / {
|
||||
proxy_pass http://package-cache:8081/repository/gem-proxy/;
|
||||
}
|
||||
}
|
||||
|
||||
server {
|
||||
listen 80;
|
||||
server_name security.ubuntu.com;
|
||||
location /ubuntu/ {
|
||||
rewrite ^/ubuntu/(.*)$ /repository/apt-ubuntu-security/$1 break;
|
||||
proxy_intercept_errors on;
|
||||
proxy_read_timeout 8s;
|
||||
error_page 502 503 504 = @apt_ubuntu_security_mirror;
|
||||
proxy_pass http://package-cache:8081;
|
||||
}
|
||||
location @apt_ubuntu_security_mirror {
|
||||
rewrite ^/repository/apt-ubuntu-security/(.*)$ /repository/apt-ubuntu-security-mirror/$1 break;
|
||||
proxy_pass http://package-cache:8081;
|
||||
}
|
||||
}
|
||||
|
||||
server {
|
||||
listen 443 ssl;
|
||||
server_name static.crates.io;
|
||||
ssl_certificate /etc/nginx/certs/static.crates.io.crt;
|
||||
ssl_certificate_key /etc/nginx/certs/static.crates.io.key;
|
||||
location / {
|
||||
proxy_pass http://package-cache:8081/repository/raw-crates-static/;
|
||||
}
|
||||
}
|
||||
@@ -1,7 +1,7 @@
|
||||
# Maintainer: Kevin Veen-Birkenbach <info@veen.world>
|
||||
|
||||
pkgname=infinito-nexus
|
||||
pkgver=16.1.0
|
||||
pkgver=16.2.0
|
||||
pkgrel=1
|
||||
pkgdesc="Meta package for Infinito.Nexus host dependencies (dev + CI)."
|
||||
arch=('any')
|
||||
|
||||
@@ -1,3 +1,38 @@
|
||||
infinito-nexus (16.2.0-1) unstable; urgency=medium
|
||||
|
||||
Added:
|
||||
|
||||
- Compose: *make compose-network-recreate* rebuilds the stack network safely
|
||||
- CI: the updater keeps the GitHub-hosted runner labels current
|
||||
|
||||
Fixed:
|
||||
|
||||
- Backup: hard links, ACLs and xattrs survive every backup and recover hop
|
||||
- NFS client: clients on Linux 6.19+ no longer fail writes on ganesha < 9.11
|
||||
- AppArmor: the teardown keeps docker-default, so containers keep starting
|
||||
- Wazuh: hosts can be put into WireGuard meshes like every other role
|
||||
- CI: GitHub-hosted runners are pinned to ubuntu-24.04
|
||||
|
||||
Version jumps (net since 16.1.0):
|
||||
|
||||
- *svc-db-rabbitmq*: 4.3-management-alpine to 4.4-management-alpine
|
||||
- *web-app-n8n*: 2.44.4 to 2.45.0
|
||||
- *web-app-pixelfed*: 20261019 to 20261020
|
||||
- *web-app-snipe-it*: v8.8.0-alpine to v8.8.1-alpine
|
||||
- *web-app-taiga*: RabbitMQ 4.3-management-alpine to 4.4-management-alpine
|
||||
- *eslint* (dev): ^10.12.0 to ^10.13.0
|
||||
|
||||
Upgrade notes:
|
||||
|
||||
- Backup: a target without xattr support now fails instead of losing them
|
||||
- Dev: worktree hosts apply the IP pool with *make compose-network-recreate*
|
||||
|
||||
Contributors:
|
||||
|
||||
- [Kevin Veen-Birkenbach](https://veen.world): backups, NFS, AppArmor, CI
|
||||
|
||||
-- Kevin Veen-Birkenbach <kevin@veen.world> Tue, 20 Oct 2026 21:11:50 +0200
|
||||
|
||||
infinito-nexus (16.1.0-1) unstable; urgency=medium
|
||||
|
||||
Added:
|
||||
|
||||
@@ -1,5 +1,5 @@
|
||||
Name: infinito-nexus
|
||||
Version: 16.1.0
|
||||
Version: 16.2.0
|
||||
Release: 1%{?dist}
|
||||
Summary: Meta package for Infinito.Nexus host dependencies
|
||||
|
||||
@@ -58,6 +58,38 @@ install -d %{buildroot}%{_docdir}/%{name}
|
||||
%doc %{_docdir}/%{name}/DEPENDENCIES
|
||||
|
||||
%changelog
|
||||
* Tue Oct 20 2026 Kevin Veen-Birkenbach <kevin@veen.world> - 16.2.0-1
|
||||
- Added:
|
||||
|
||||
- - Compose: *make compose-network-recreate* rebuilds the stack network safely
|
||||
- - CI: the updater keeps the GitHub-hosted runner labels current
|
||||
|
||||
- Fixed:
|
||||
|
||||
- - Backup: hard links, ACLs and xattrs survive every backup and recover hop
|
||||
- - NFS client: clients on Linux 6.19+ no longer fail writes on ganesha < 9.11
|
||||
- - AppArmor: the teardown keeps docker-default, so containers keep starting
|
||||
- - Wazuh: hosts can be put into WireGuard meshes like every other role
|
||||
- - CI: GitHub-hosted runners are pinned to ubuntu-24.04
|
||||
|
||||
- Version jumps (net since 16.1.0):
|
||||
|
||||
- - *svc-db-rabbitmq*: 4.3-management-alpine to 4.4-management-alpine
|
||||
- - *web-app-n8n*: 2.44.4 to 2.45.0
|
||||
- - *web-app-pixelfed*: 20261019 to 20261020
|
||||
- - *web-app-snipe-it*: v8.8.0-alpine to v8.8.1-alpine
|
||||
- - *web-app-taiga*: RabbitMQ 4.3-management-alpine to 4.4-management-alpine
|
||||
- - *eslint* (dev): ^10.12.0 to ^10.13.0
|
||||
|
||||
- Upgrade notes:
|
||||
|
||||
- - Backup: a target without xattr support now fails instead of losing them
|
||||
- - Dev: worktree hosts apply the IP pool with *make compose-network-recreate*
|
||||
|
||||
- Contributors:
|
||||
|
||||
- - [Kevin Veen-Birkenbach](https://veen.world): backups, NFS, AppArmor, CI
|
||||
|
||||
* Mon Oct 19 2026 Kevin Veen-Birkenbach <kevin@veen.world> - 16.1.0-1
|
||||
- Added:
|
||||
|
||||
|
||||
+1
-1
@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
|
||||
|
||||
[project]
|
||||
name = "infinito-nexus"
|
||||
version = "16.1.0"
|
||||
version = "16.2.0"
|
||||
description = "Infinito.Nexus"
|
||||
readme = "README.md"
|
||||
requires-python = ">=3.11"
|
||||
|
||||
Reference in new issue
Block a user