- discourse 2026.10.0: skip assets:precompile in init container
(assets are pre-built in 2026.x images, no git repo present)
Re-enable slot 2026 as latest
- moodle: migrate from bitnamilegacy/moodle (EOL Aug 2025) to
oksigenia/moodle:4.5 (drop-in replacement, same env vars/volumes,
weekly rebuilds with PHP patches)
- supabase: bump all 7 components to self-hosted v0.8.3 tags
(studio, gotrue, postgrest, realtime, storage-api, postgres-meta, kong)
- jitsi: stable tags moved to ghcr.io/jitsi/* (no longer on Docker Hub)
- keila: mount emptyDir at /opt/app/lib/tz-0.28.2/priv so the tz
library can write timezone data (TZ_AUTOUPDATE env var doesn't work,
it's Elixir app config not env-driven)
- zulip: rename legacy env vars per 12.x migration guide
(DB_HOST -> SETTING_REMOTE_POSTGRES_HOST, etc.)
Remove DISABLE_HTTPS/SSL_CERTIFICATE_GENERATION (HTTP is default in 12.x)
Re-enable slot 12 as latest
- open-webui: try v0.10.0 as intermediate step from v0.9.5
(v0.12.4 had duplicate column migration error jumping from v0.9.5)
- immich: add fsGroup: 1000 so init container can write to PVC
- keila: set TZ_AUTOUPDATE=disabled to prevent tz library crash
on read-only /opt/app/lib path in v0.30.3
- open-webui: revert to v0.9.5 — v0.12.x migration crashes on
existing DB (duplicate column name: info_json)
- gitea: use rootless image tag (28.2.0-rootless) since deployment
runs as non-root UID 1000; standard tag uses s6-overlay requiring root
- openproject: add secretKeyBase secret and SECRET_KEY_BASE env var
to web, worker, and seeder; v17 enforces non-default SECRET_KEY_BASE
feat(synapse): update ingress to use traefik ingress class and bump version
feat(syncthing-discovery): introduce syncthing discovery service with deployment and ingress
feat(syncthing-relay): add syncthing relay server with deployment and ingress configuration
fix(taiga): update liveness and readiness probes to use tcpSocket for health checks
fix(taiga): change PVC access mode to ReadWriteMany for media and static storage
feat(traefik): add icon and ignore rules for traefik service
docs(ushahidi): add notes for Redis configuration and Laravel startup probe adjustments
feat(ushahidi): implement dedicated Redis deployment for Ushahidi
fix(vllm): update deployment strategy and readiness/liveness probes for improved stability
fix(writefreely): pin writefreely image version to v0.15.1 for consistency
docs(zulip): add notes for TLS-terminating reverse proxy configuration and expected behavior
pretix/standalone runs gunicorn + celery + celery-beat in one container
and OOMKilled at 4Gi. Increased limit to 6Gi, request to 512Mi.
eventyay: add nginx sidecar to serve static files, update health probes
to check a static asset at port 8080, add create-superuser script,
register script in manifest.
crowdsec: middleware fix (previously uncommitted).
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
The karrot-frontend nginx template hardcodes Docker's DNS resolver
(127.0.0.11) which doesn't exist in Kubernetes. Added a ConfigMap to
override the template, removing the Docker DNS resolver by using a
direct proxy_pass with no nginx variable (which would force runtime
resolution). Also adds a README with usage instructions.
Documents lessons learned in ADDING-APPS-NOTES.md:
- Note 24: nginx Docker DNS resolver doesn't work in Kubernetes; any
nginx variable in proxy_pass (including $request_uri) forces runtime
DNS resolution requiring a resolver directive
- Note 25: ConfigMap changes don't restart pods; subPath mounts never
auto-update; always follow with kubectl rollout restart
- Note 26: includeSelectors mismatch affects every deployment in an
app — check all endpoints, not just the web-facing one
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
