Replace direct repo.jellyfin.org download with artifactapi.k8s.syd1.au.unkin.net
remote. SHA256 pin guarantees integrity over HTTP. Both plugins now consistent
in sourcing from artifactapi infrastructure.
The PR build failed at the plugins stage: the CI build network can reach
artifactapi and package mirrors (repo.jellyfin.org) but not github.com
directly, so the SSO plugin download from github failed (curl exit 7).
Route the SSO fetch through the artifactapi github remote proxy instead;
SSO_SHA256 still pins the exact bytes. LDAP is unchanged.
Phase-1 SSO/app-passwords for jellyfin needs the ldapauth and sso plugins
present without relying on the in-app catalog (which the plugins-baked PVC
would otherwise let drift). Pin the newest release of each whose targetAbi
is <= the pinned server version (10.11.6) and let the image own the version.
- Add a plugins build stage that downloads, sha256-verifies (matching each
release's published .sha256), and unpacks the plugin zips into versioned
dirs baked at /usr/share/jellyfin/plugins-baked.
- LDAP Authentication 22.0.0.0 (targetAbi 10.11.2.0; v23 needs 10.11.9).
- SSO Authentication 4.0.0.4 (targetAbi 10.11.0.0).
- Add docker-entrypoint.sh that syncs baked plugin dirs into /config/plugins
on every start, removing any stale versioned dir of the same plugin so the
image controls the version across restarts; preserves plugin configurations.
- Point ENTRYPOINT at the new script.
The runtime image based on aspnet:10.0 provides only .NET 10.x, but the
publish step builds framework-dependent against SDK 9.0, so the app requires
Microsoft.NETCore.App 9.0.0 and crashes on start under 10.x.
Pin the runtime base to aspnet:9.0 to match the SDK 9.0 publish.
Point the release docker step at the custom
artifactapi.k8s.syd1.au.unkin.net/docker-internal/plugin-docker-buildx
image, which bakes artifactapi's internal Vault CA into
/etc/docker/certs.d/<registry>/ca.crt.
- Swap the docker step image from upstream woodpeckerci/plugin-docker-buildx
to the CA-baked custom image.
- Drop the separate ca-trust step (and its almalinux9-base dependency) that
staged the CA into the workspace.
- Repoint buildkit_config ca= at the in-image baked CA path so the buildx
docker-container builder still hands the CA to buildkitd for the push.
The v0.1.0 release pipeline built the runtime image fine but failed the
push to artifactapi.k8s.syd1.au.unkin.net/docker-internal with a TLS
x509 unknown-authority error: buildkit did not trust artifactapi's
Vault-signed cert.
Stage the internal CA into the shared workspace via the almalinux9-base
image (already trusts the unkin CA; same image the RPM release pipelines
use to reach artifactapi over HTTPS) and point the docker-buildx plugin
at it through buildkit_config. buildx copies the referenced CA into the
buildkitd container at builder-create time, so the push handshake now
verifies. No credentials needed: anonymous push to docker-internal is
allowed for trusted clients.
The pinned jellyfin-ha-src fork sets global.json sdk 9.0.0 (rollForward
latestMinor), so the publish steps in build.yaml and docker.yaml must run
on the .NET 9 SDK. They referenced sdk:10.0, which fails the pinned build.
Repoint both publish steps to mcr.microsoft.com/dotnet/sdk:9.0.
Why:
- The build should pull from our own source fork so local HA patches can be
carried and pinned, rather than cloning the upstream GitHub tree directly.
How:
- Point the clone URL in the Makefile and both Woodpecker pipelines at
https://git.unkin.net/unkin/jellyfin-ha-src.git.
- Keep UPSTREAM_REF at d4f9c12c22d3a640f3b0a3622b23b8cd01d044ad, which is the
seeded fork main, so the produced image is byte-identical for now; the
feature bump is a later change.
Hard switch of the docker push target from the Gitea registry to the
artifactapi local docker registry (docker-internal); the Gitea VM and its
registry are being retired. Drops the droneci/DRONECI_PASSWORD creds since
artifactapi accepts unauthenticated in-cluster pushes. Also repoints the Makefile IMAGE and README image paths.
Claude-Session: https://claude.ai/code/session_015ur3i7D2azsMAWTSVABApv
unkin-agent
benvin
unkin-agent
unkinben
gitadmin