diff --git a/CHANGELOG.md b/CHANGELOG.md index 2a1626fff7..b491b18d30 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -1,5 +1,38 @@ # Changelog +## [16.2.0] - 2026-10-20 + +Added: + +- Compose: *make compose-network-recreate* rebuilds the stack network safely +- CI: the updater keeps the GitHub-hosted runner labels current + +Fixed: + +- Backup: hard links, ACLs and xattrs survive every backup and recover hop +- NFS client: clients on Linux 6.19+ no longer fail writes on ganesha < 9.11 +- AppArmor: the teardown keeps docker-default, so containers keep starting +- Wazuh: hosts can be put into WireGuard meshes like every other role +- CI: GitHub-hosted runners are pinned to ubuntu-24.04 + +Version jumps (net since 16.1.0): + +- *svc-db-rabbitmq*: 4.3-management-alpine to 4.4-management-alpine +- *web-app-n8n*: 2.44.4 to 2.45.0 +- *web-app-pixelfed*: 20261019 to 20261020 +- *web-app-snipe-it*: v8.8.0-alpine to v8.8.1-alpine +- *web-app-taiga*: RabbitMQ 4.3-management-alpine to 4.4-management-alpine +- *eslint* (dev): ^10.12.0 to ^10.13.0 + +Upgrade notes: + +- Backup: a target without xattr support now fails instead of losing them +- Dev: worktree hosts apply the IP pool with *make compose-network-recreate* + +Contributors: + +- [Kevin Veen-Birkenbach](https://veen.world): backups, NFS, AppArmor, CI + ## [16.1.0] - 2026-10-19 Added: diff --git a/compose/package-cache-frontend/upstreams.conf b/compose/package-cache-frontend/upstreams.conf index b5c5ef08e7..9e0acd5a03 100644 --- a/compose/package-cache-frontend/upstreams.conf +++ b/compose/package-cache-frontend/upstreams.conf @@ -9,49 +9,8 @@ proxy_request_buffering off; proxy_read_timeout 300s; proxy_connect_timeout 30s; -# Docker embedded DNS, pinned to bypass image-specific resolv.conf order. resolver 127.0.0.11 ipv6=off valid=30s; -# Nexus answers 502 when a proxy's remote is unreachable (measured) and has no -# group repository type for apt, so the mirror failover sits here rather than in -# the repo layout. 5xx only: a 404 means the file genuinely is not in the suite, -# and apt probes for missing files often enough that retrying those would double -# the request rate. -# -# Nexus answers that 502 only after trying every address of the remote in turn, -# one connect timeout each; for a remote with several addresses that outlasts a -# client's own timeout before the mirror is ever asked. -# -# These stay prefix locations. A regex location forfeits nginx's implicit -# `/debian` -> `/debian/` redirect, and the URL-reachability test probes exactly -# that slash-less form through the runner's DNS hijack, so it turns into a 404. -server { - listen 80; - server_name deb.debian.org; - location /debian/ { - rewrite ^/debian/(.*)$ /repository/apt-debian/$1 break; - proxy_intercept_errors on; - proxy_read_timeout 8s; - error_page 502 503 504 = @debian_mirror; - proxy_pass http://package-cache:8081; - } - location @debian_mirror { - rewrite ^/repository/apt-debian/(.*)$ /repository/apt-debian-mirror/$1 break; - proxy_pass http://package-cache:8081; - } - location /debian-security/ { - rewrite ^/debian-security/(.*)$ /repository/apt-debian-security/$1 break; - proxy_intercept_errors on; - proxy_read_timeout 8s; - error_page 502 503 504 = @debian_security_mirror; - proxy_pass http://package-cache:8081; - } - location @debian_security_mirror { - rewrite ^/repository/apt-debian-security/(.*)$ /repository/apt-debian-security-mirror/$1 break; - proxy_pass http://package-cache:8081; - } -} - server { listen 80; server_name archive.ubuntu.com; @@ -59,26 +18,59 @@ server { rewrite ^/ubuntu/(.*)$ /repository/apt-ubuntu/$1 break; proxy_intercept_errors on; proxy_read_timeout 8s; - error_page 502 503 504 = @ubuntu_mirror; + error_page 502 503 504 = @apt_ubuntu_mirror; proxy_pass http://package-cache:8081; } - location @ubuntu_mirror { + location @apt_ubuntu_mirror { rewrite ^/repository/apt-ubuntu/(.*)$ /repository/apt-ubuntu-mirror/$1 break; proxy_pass http://package-cache:8081; } } + +server { + listen 443 ssl; + server_name argos-net.com; + ssl_certificate /etc/nginx/certs/argos-net.com.crt; + ssl_certificate_key /etc/nginx/certs/argos-net.com.key; + location / { + proxy_read_timeout 1800s; + proxy_pass http://package-cache:8081/repository/raw-argos-net/; + } +} + +server { + listen 443 ssl; + server_name codeload.github.com; + ssl_certificate /etc/nginx/certs/codeload.github.com.crt; + ssl_certificate_key /etc/nginx/certs/codeload.github.com.key; + location / { + proxy_pass http://package-cache:8081/repository/raw-codeload-github/; + } +} + server { listen 80; - server_name security.ubuntu.com; - location /ubuntu/ { - rewrite ^/ubuntu/(.*)$ /repository/apt-ubuntu-security/$1 break; + server_name deb.debian.org; + location /debian/ { + rewrite ^/debian/(.*)$ /repository/apt-debian/$1 break; proxy_intercept_errors on; proxy_read_timeout 8s; - error_page 502 503 504 = @ubuntu_security_mirror; + error_page 502 503 504 = @apt_debian_mirror; proxy_pass http://package-cache:8081; } - location @ubuntu_security_mirror { - rewrite ^/repository/apt-ubuntu-security/(.*)$ /repository/apt-ubuntu-security-mirror/$1 break; + location @apt_debian_mirror { + rewrite ^/repository/apt-debian/(.*)$ /repository/apt-debian-mirror/$1 break; + proxy_pass http://package-cache:8081; + } + location /debian-security/ { + rewrite ^/debian-security/(.*)$ /repository/apt-debian-security/$1 break; + proxy_intercept_errors on; + proxy_read_timeout 8s; + error_page 502 503 504 = @apt_debian_security_mirror; + proxy_pass http://package-cache:8081; + } + location @apt_debian_security_mirror { + rewrite ^/repository/apt-debian-security/(.*)$ /repository/apt-debian-security-mirror/$1 break; proxy_pass http://package-cache:8081; } } @@ -94,11 +86,11 @@ server { server { listen 443 ssl; - server_name pypi.org; - ssl_certificate /etc/nginx/certs/pypi.org.crt; - ssl_certificate_key /etc/nginx/certs/pypi.org.key; + server_name dl-cdn.alpinelinux.org; + ssl_certificate /etc/nginx/certs/dl-cdn.alpinelinux.org.crt; + ssl_certificate_key /etc/nginx/certs/dl-cdn.alpinelinux.org.key; location / { - proxy_pass http://package-cache:8081/repository/pypi-proxy/; + proxy_pass http://package-cache:8081/repository/raw-alpine/; } } @@ -114,28 +106,24 @@ server { server { listen 443 ssl; - server_name registry.npmjs.org; - ssl_certificate /etc/nginx/certs/registry.npmjs.org.crt; - ssl_certificate_key /etc/nginx/certs/registry.npmjs.org.key; - # Tarball URLs Nexus emits already carry /repository/npm-proxy/; pass them - # through as-is (no path on proxy_pass) so they aren't double-prefixed → 404. - location /repository/npm-proxy/ { - proxy_pass http://package-cache:8081; - } + server_name huggingface.co; + ssl_certificate /etc/nginx/certs/huggingface.co.crt; + ssl_certificate_key /etc/nginx/certs/huggingface.co.key; location / { - proxy_pass http://package-cache:8081/repository/npm-proxy/; + proxy_pass http://package-cache:8081/repository/raw-huggingface/; } } server { listen 443 ssl; - server_name rubygems.org; - ssl_certificate /etc/nginx/certs/rubygems.org.crt; - ssl_certificate_key /etc/nginx/certs/rubygems.org.key; + server_name index.crates.io; + ssl_certificate /etc/nginx/certs/index.crates.io.crt; + ssl_certificate_key /etc/nginx/certs/index.crates.io.key; location / { - proxy_pass http://package-cache:8081/repository/gem-proxy/; + proxy_pass http://package-cache:8081/repository/raw-crates-index/; } } + server { listen 443 ssl; server_name index.rubygems.org; @@ -146,16 +134,6 @@ server { } } -server { - listen 443 ssl; - server_name repo.packagist.org; - ssl_certificate /etc/nginx/certs/repo.packagist.org.crt; - ssl_certificate_key /etc/nginx/certs/repo.packagist.org.key; - location / { - proxy_pass http://package-cache:8081/repository/raw-packagist/; - } -} - server { listen 443 ssl; server_name proxy.golang.org; @@ -168,11 +146,11 @@ server { server { listen 443 ssl; - server_name dl-cdn.alpinelinux.org; - ssl_certificate /etc/nginx/certs/dl-cdn.alpinelinux.org.crt; - ssl_certificate_key /etc/nginx/certs/dl-cdn.alpinelinux.org.key; + server_name pypi.org; + ssl_certificate /etc/nginx/certs/pypi.org.crt; + ssl_certificate_key /etc/nginx/certs/pypi.org.key; location / { - proxy_pass http://package-cache:8081/repository/raw-alpine/; + proxy_pass http://package-cache:8081/repository/pypi-proxy/; } } @@ -188,10 +166,69 @@ server { server { listen 443 ssl; - server_name codeload.github.com; - ssl_certificate /etc/nginx/certs/codeload.github.com.crt; - ssl_certificate_key /etc/nginx/certs/codeload.github.com.key; + server_name registry.npmjs.org; + ssl_certificate /etc/nginx/certs/registry.npmjs.org.crt; + ssl_certificate_key /etc/nginx/certs/registry.npmjs.org.key; + location /repository/npm-proxy/ { + proxy_pass http://package-cache:8081; + } location / { - proxy_pass http://package-cache:8081/repository/raw-codeload-github/; + proxy_pass http://package-cache:8081/repository/npm-proxy/; + } +} + +server { + listen 443 ssl; + server_name registry.ollama.ai; + ssl_certificate /etc/nginx/certs/registry.ollama.ai.crt; + ssl_certificate_key /etc/nginx/certs/registry.ollama.ai.key; + location / { + proxy_pass http://package-cache:8081/repository/raw-ollama-registry/; + } +} + +server { + listen 443 ssl; + server_name repo.packagist.org; + ssl_certificate /etc/nginx/certs/repo.packagist.org.crt; + ssl_certificate_key /etc/nginx/certs/repo.packagist.org.key; + location / { + proxy_pass http://package-cache:8081/repository/raw-packagist/; + } +} + +server { + listen 443 ssl; + server_name rubygems.org; + ssl_certificate /etc/nginx/certs/rubygems.org.crt; + ssl_certificate_key /etc/nginx/certs/rubygems.org.key; + location / { + proxy_pass http://package-cache:8081/repository/gem-proxy/; + } +} + +server { + listen 80; + server_name security.ubuntu.com; + location /ubuntu/ { + rewrite ^/ubuntu/(.*)$ /repository/apt-ubuntu-security/$1 break; + proxy_intercept_errors on; + proxy_read_timeout 8s; + error_page 502 503 504 = @apt_ubuntu_security_mirror; + proxy_pass http://package-cache:8081; + } + location @apt_ubuntu_security_mirror { + rewrite ^/repository/apt-ubuntu-security/(.*)$ /repository/apt-ubuntu-security-mirror/$1 break; + proxy_pass http://package-cache:8081; + } +} + +server { + listen 443 ssl; + server_name static.crates.io; + ssl_certificate /etc/nginx/certs/static.crates.io.crt; + ssl_certificate_key /etc/nginx/certs/static.crates.io.key; + location / { + proxy_pass http://package-cache:8081/repository/raw-crates-static/; } } diff --git a/packaging/arch/PKGBUILD b/packaging/arch/PKGBUILD index 32b4c239a6..56668d0805 100644 --- a/packaging/arch/PKGBUILD +++ b/packaging/arch/PKGBUILD @@ -1,7 +1,7 @@ # Maintainer: Kevin Veen-Birkenbach pkgname=infinito-nexus -pkgver=16.1.0 +pkgver=16.2.0 pkgrel=1 pkgdesc="Meta package for Infinito.Nexus host dependencies (dev + CI)." arch=('any') diff --git a/packaging/debian/changelog b/packaging/debian/changelog index 7130893af6..3d1e3dfd16 100644 --- a/packaging/debian/changelog +++ b/packaging/debian/changelog @@ -1,3 +1,38 @@ +infinito-nexus (16.2.0-1) unstable; urgency=medium + + Added: + + - Compose: *make compose-network-recreate* rebuilds the stack network safely + - CI: the updater keeps the GitHub-hosted runner labels current + + Fixed: + + - Backup: hard links, ACLs and xattrs survive every backup and recover hop + - NFS client: clients on Linux 6.19+ no longer fail writes on ganesha < 9.11 + - AppArmor: the teardown keeps docker-default, so containers keep starting + - Wazuh: hosts can be put into WireGuard meshes like every other role + - CI: GitHub-hosted runners are pinned to ubuntu-24.04 + + Version jumps (net since 16.1.0): + + - *svc-db-rabbitmq*: 4.3-management-alpine to 4.4-management-alpine + - *web-app-n8n*: 2.44.4 to 2.45.0 + - *web-app-pixelfed*: 20261019 to 20261020 + - *web-app-snipe-it*: v8.8.0-alpine to v8.8.1-alpine + - *web-app-taiga*: RabbitMQ 4.3-management-alpine to 4.4-management-alpine + - *eslint* (dev): ^10.12.0 to ^10.13.0 + + Upgrade notes: + + - Backup: a target without xattr support now fails instead of losing them + - Dev: worktree hosts apply the IP pool with *make compose-network-recreate* + + Contributors: + + - [Kevin Veen-Birkenbach](https://veen.world): backups, NFS, AppArmor, CI + + -- Kevin Veen-Birkenbach Tue, 20 Oct 2026 21:11:50 +0200 + infinito-nexus (16.1.0-1) unstable; urgency=medium Added: diff --git a/packaging/fedora/infinito-nexus.spec b/packaging/fedora/infinito-nexus.spec index fa0b42a559..666506d68d 100644 --- a/packaging/fedora/infinito-nexus.spec +++ b/packaging/fedora/infinito-nexus.spec @@ -1,5 +1,5 @@ Name: infinito-nexus -Version: 16.1.0 +Version: 16.2.0 Release: 1%{?dist} Summary: Meta package for Infinito.Nexus host dependencies @@ -58,6 +58,38 @@ install -d %{buildroot}%{_docdir}/%{name} %doc %{_docdir}/%{name}/DEPENDENCIES %changelog +* Tue Oct 20 2026 Kevin Veen-Birkenbach - 16.2.0-1 +- Added: + +- - Compose: *make compose-network-recreate* rebuilds the stack network safely +- - CI: the updater keeps the GitHub-hosted runner labels current + +- Fixed: + +- - Backup: hard links, ACLs and xattrs survive every backup and recover hop +- - NFS client: clients on Linux 6.19+ no longer fail writes on ganesha < 9.11 +- - AppArmor: the teardown keeps docker-default, so containers keep starting +- - Wazuh: hosts can be put into WireGuard meshes like every other role +- - CI: GitHub-hosted runners are pinned to ubuntu-24.04 + +- Version jumps (net since 16.1.0): + +- - *svc-db-rabbitmq*: 4.3-management-alpine to 4.4-management-alpine +- - *web-app-n8n*: 2.44.4 to 2.45.0 +- - *web-app-pixelfed*: 20261019 to 20261020 +- - *web-app-snipe-it*: v8.8.0-alpine to v8.8.1-alpine +- - *web-app-taiga*: RabbitMQ 4.3-management-alpine to 4.4-management-alpine +- - *eslint* (dev): ^10.12.0 to ^10.13.0 + +- Upgrade notes: + +- - Backup: a target without xattr support now fails instead of losing them +- - Dev: worktree hosts apply the IP pool with *make compose-network-recreate* + +- Contributors: + +- - [Kevin Veen-Birkenbach](https://veen.world): backups, NFS, AppArmor, CI + * Mon Oct 19 2026 Kevin Veen-Birkenbach - 16.1.0-1 - Added: diff --git a/pyproject.toml b/pyproject.toml index 91d16d1233..90ee16c53a 100644 --- a/pyproject.toml +++ b/pyproject.toml @@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta" [project] name = "infinito-nexus" -version = "16.1.0" +version = "16.2.0" description = "Infinito.Nexus" readme = "README.md" requires-python = ">=3.11"