selfhostedops/selfhostedops-stack
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Episode 17: updates one service at a time, a health check that asks real questions, every tag pinned

Browse source 
updates/health.sh: 43 checks across all services (API answers, git refs, a push
message round trip, SSO redirects and token endpoint, mesh state, backup age).
updates/update.sh: per service pull or build, snapshot, recreate, wait for the
health check, put image and data back on red and stop the run.
backup/backup.sh: online dumps for n8n, Pocket ID and tinyauth; BACKUP_TAG so
pre-update snapshots are not removed by the nightly keep-daily rule.
compose.yml and caddy/Dockerfile: exact versions instead of latest, 16, 7-alpine
and caddy:2-alpine.
This commit is contained in:
Maximilian Grimm 2026-10-08 22:04:29 +02:00
parent 1655d04d7d
commit 55b2fe7646
7 changed files with 380 additions and 19 deletions
Download patch file Download diff file Expand all files Collapse all files

10
caddy/Dockerfile
View file

@ -3,11 +3,15 @@
# in with xcaddy - there is no runtime "enable" for it.
# episode 12: same trick for CrowdSec. The bouncer (http) and the AppSec
# handler (appsec) are plugins too, pinned to a release tag instead of @main.
FROM caddy:2-builder-alpine AS builder
# episode 17: every version is written down. "caddy:2-alpine" plus an unpinned
# plugin means the next rebuild is an update nobody decided on. docker compose
# pull never touches this image, it only changes when you run a build, so the
# compose file carries the same version in the image tag.
FROM caddy:2.11.7-builder-alpine AS builder
RUN xcaddy build \
--with github.com/mholt/caddy-ratelimit \
--with github.com/mholt/caddy-ratelimit@v0.1.0 \
--with github.com/hslatman/caddy-crowdsec-bouncer/http@v0.14.1 \
--with github.com/hslatman/caddy-crowdsec-bouncer/appsec@v0.14.1
FROM caddy:2-alpine
FROM caddy:2.11.7-alpine
COPY --from=builder /usr/bin/caddy /usr/bin/caddy