server_automation

1---
2# ============================================================================
3# Container image pins - the single source of truth
4# ============================================================================
5#
6# Every third-party image deployed by this repo is pinned here to an exact
7# tag. Roles keep fallback values in their own defaults/, which this file
8# overrides (group_vars beat role defaults - which is why no role may define
9# an image in vars/main.yml, where it would win over this file).
10#
11# Bumping a version is a manual, deliberate act: change `tag` below, commit,
12# then run that host's playbook with the service's tag. Nothing here is ever
13# changed automatically. The nightly update monitor (check-image-updates.yml)
14# only reads this file and reports newer tags to Home Assistant.
15#
16# Fields:
17#   image    registry/repository, without tag
18#   tag      exact tag. `<tag>@sha256:...` pins a digest where upstream has
19#            no stable tag for what runs (docker ignores the tag part then)
20#   tier     main  - the service itself; the monitor reports its updates
21#            aux   - supporting image (database, cache, VPN, sidecar). Reported
22#                    as information only: aux images are bumped when the main
23#                    image's release notes require it, never on their own.
24#   service  groups images of one deployment in the report
25#   host     where it runs (informational; drift check compares against it)
26#   variant  tag suffix that must be kept (cuda, tensorrt, rpi, apache,
27#            alpine, bookworm, full, ubuntu-...-full, linuxserver -lsNNN).
28#            The monitor only considers newer tags of the same variant.
29#   arch     architectures a newer tag must provide to count as an update
30#   version  human-readable version, where the tag itself does not say it
31#
32# Not in this file, on purpose:
33#   - own images (ys-registry.com/*, local builds) - they follow `latest`
34#     or a git SHA and are versioned by their own CI
35#   - Harbor (versions set by its offline installer, see harbor_version)
36#   - CVAT (images come from its upstream compose at cvat_repo_version)
37#   - Home Assistant core, add-ons and Supervisor (managed by HA itself)
38#   - the website stack (deployed by the website repo's CI)
39# ============================================================================
40
41images:
42  # --- homeassistant -------------------------------------------------------
43  npm:
44    image: docker.io/jc21/nginx-proxy-manager
45    tag: "2.12.6"
46    tier: main
47    service: reverse-proxy
48    host: homeassistant
49    arch: [amd64]
50  crowdsec:
51    image: docker.io/crowdsecurity/crowdsec
52    tag: "v1.7.6"
53    tier: aux
54    service: reverse-proxy
55    host: homeassistant
56    arch: [amd64]
57  semaphore:
58    image: docker.io/semaphoreui/semaphore
59    tag: "v2.19.17"
60    tier: main
61    service: semaphore
62    host: homeassistant
63    arch: [amd64]
64
65  # --- monitoring (every docker host) --------------------------------------
66  glances:
67    image: docker.io/nicolargo/glances
68    tag: "4.5.3.2-full"
69    tier: main
70    service: glances
71    host: all
72    variant: full
73    arch: [amd64, arm64]
74  glances_gpu:
75    image: docker.io/nicolargo/glances
76    tag: "ubuntu-4.5.3.2-full"
77    tier: main
78    service: glances
79    host: runner
80    variant: ubuntu-full        # Ubuntu base is required for NVIDIA GPU stats
81    arch: [amd64]
82
83  # --- storage -------------------------------------------------------------
84  jellyfin:
85    image: docker.io/jellyfin/jellyfin
86    tag: "10.11.6"
87    tier: main
88    service: jellyfin
89    host: storage
90    arch: [amd64]
91  sonarr:
92    image: lscr.io/linuxserver/sonarr
93    tag: "4.0.15.2941-ls291"
94    tier: main
95    service: media-automation
96    host: storage
97    variant: ls
98    arch: [amd64]
99  radarr:
100    image: lscr.io/linuxserver/radarr
101    tag: "5.27.5.10198-ls283"
102    tier: main
103    service: media-automation
104    host: storage
105    variant: ls
106    arch: [amd64]
107  prowlarr:
108    image: lscr.io/linuxserver/prowlarr
109    tag: "2.0.5.5160-ls125"
110    tier: main
111    service: media-automation
112    host: storage
113    variant: ls
114    arch: [amd64]
115  lidarr:
116    image: lscr.io/linuxserver/lidarr
117    tag: "3.1.0.4875-ls20"
118    tier: main
119    service: media-automation
120    host: storage
121    variant: ls
122    arch: [amd64]
123  bazarr:
124    image: lscr.io/linuxserver/bazarr
125    tag: "v1.5.3-ls322"
126    tier: main
127    service: media-automation
128    host: storage
129    variant: ls
130    arch: [amd64]
131  qbittorrent:
132    image: lscr.io/linuxserver/qbittorrent
133    tag: "5.1.2-r1-ls413"
134    tier: main
135    service: media-automation
136    host: storage
137    variant: ls
138    arch: [amd64]
139  lazylibrarian:
140    # Base of the custom build that adds Calibre (storage/files/lazylibrarian)
141    image: lscr.io/linuxserver/lazylibrarian
142    tag: "e7c7ce2d-ls262"
143    tier: main
144    service: media-automation
145    host: storage
146    variant: ls
147    arch: [amd64]
148  jellyseerr:
149    image: docker.io/fallenbagel/jellyseerr
150    tag: "2.7.3"
151    tier: main
152    service: media-automation
153    host: storage
154    arch: [amd64]
155  cleanuparr:
156    image: ghcr.io/cleanuparr/cleanuparr
157    tag: "2.8.1"
158    tier: main
159    service: media-automation
160    host: storage
161    arch: [amd64]
162  flaresolverr:
163    image: ghcr.io/flaresolverr/flaresolverr
164    tag: "v3.4.1"
165    tier: aux
166    service: media-automation
167    host: storage
168    arch: [amd64]
169  gluetun:
170    # The running build is an unreleased dev build of `latest`, 12 commits
171    # past v3.40.0 (included in v3.41.0). No release tag matches it, so the
172    # exact image is pinned by digest. Docker Hub still serves it; hosts
173    # that already have it keep their local copy regardless.
174    image: docker.io/qmcgaw/gluetun
175    tag: "latest@sha256:156ed7abe05c2e8cbe505e699909e2fe1779c71d977df5936484b692c61d3717"
176    version: "v3.40.0+12 (075cbd5)"
177    tier: aux
178    service: media-automation
179    host: storage
180    arch: [amd64]
181  calibre:
182    image: lscr.io/linuxserver/calibre
183    tag: "v7.19.0-ls304"
184    tier: main
185    service: calibre
186    host: storage
187    variant: ls
188    arch: [amd64]
189  calibre_web:
190    image: lscr.io/linuxserver/calibre-web
191    tag: "0.6.25-ls352"
192    tier: main
193    service: calibre
194    host: storage
195    variant: ls
196    arch: [amd64]
197  navidrome:
198    image: docker.io/deluan/navidrome
199    tag: "0.60.3"
200    tier: main
201    service: navidrome
202    host: storage
203    arch: [amd64]
204  nextcloud:
205    image: docker.io/library/nextcloud
206    tag: "30.0.17-apache"
207    tier: main
208    service: nextcloud
209    host: storage
210    variant: apache
211    arch: [amd64]
212  nextcloud_mariadb:
213    image: docker.io/library/mariadb
214    tag: "11.8.6"
215    tier: aux
216    service: nextcloud
217    host: storage
218    arch: [amd64]
219  nextcloud_redis:
220    image: docker.io/library/redis
221    tag: "7.4.8-alpine"
222    tier: aux
223    service: nextcloud
224    host: storage
225    variant: alpine
226    arch: [amd64]
227  nextcloud_collabora:
228    image: docker.io/collabora/code
229    tag: "25.04.9.4.1"
230    tier: aux
231    service: nextcloud
232    host: storage
233    arch: [amd64]
234  nextcloud_elasticsearch:
235    image: docker.io/library/elasticsearch
236    tag: "7.17.27"
237    tier: aux
238    service: nextcloud
239    host: storage
240    arch: [amd64]
241  nextcloud_imaginary:
242    image: docker.io/nextcloud/aio-imaginary
243    tag: "20250325_084656"
244    tier: aux
245    service: nextcloud
246    host: storage
247    arch: [amd64]
248  restic_server:
249    image: docker.io/restic/rest-server
250    tag: "0.14.0"
251    tier: main
252    service: restic-server
253    host: storage
254    arch: [amd64]
255  gdu:
256    image: ghcr.io/dundee/gdu
257    tag: "v5.38.0"
258    tier: main
259    service: gdu
260    host: storage
261    arch: [amd64]
262
263  # --- runner --------------------------------------------------------------
264  immich_server:
265    image: ghcr.io/immich-app/immich-server
266    tag: "v2.3.1"
267    tier: main
268    service: immich
269    host: runner
270    arch: [amd64]
271  immich_machine_learning:
272    # Must stay the -cuda variant: ML runs on the runner's NVIDIA GPU.
273    # Bump together with immich_server - the two must run the same release.
274    image: ghcr.io/immich-app/immich-machine-learning
275    tag: "v2.3.1-cuda"
276    tier: main
277    service: immich
278    host: runner
279    variant: cuda
280    arch: [amd64]
281  immich_postgres:
282    image: ghcr.io/immich-app/postgres
283    tag: "14-vectorchord0.4.3-pgvectors0.2.0"
284    tier: aux
285    service: immich
286    host: runner
287    arch: [amd64]
288  immich_valkey:
289    image: docker.io/valkey/valkey
290    tag: "8.1.3-bookworm"
291    tier: aux
292    service: immich
293    host: runner
294    variant: bookworm
295    arch: [amd64]
296  frigate:
297    image: ghcr.io/blakeblackshear/frigate
298    tag: "0.16.1"
299    tier: main
300    service: frigate
301    host: runner
302    arch: [amd64]
303  frigate_tensorrt:
304    # The variant actually deployed on the runner (NVIDIA detector)
305    image: ghcr.io/blakeblackshear/frigate
306    tag: "0.16.1-tensorrt"
307    tier: main
308    service: frigate
309    host: runner
310    variant: tensorrt
311    arch: [amd64]
312  forgejo:
313    image: codeberg.org/forgejo/forgejo
314    tag: "12.0.2"
315    tier: main
316    service: forgejo
317    host: runner
318    arch: [amd64]
319  forgejo_runner:
320    image: data.forgejo.org/forgejo/runner
321    tag: "9.1.1"
322    tier: aux
323    service: forgejo
324    host: runner
325    arch: [amd64]
326  binfmt:
327    # One-shot container registering QEMU binfmt handlers for arm64 builds
328    image: docker.io/tonistiigi/binfmt
329    tag: "qemu-v10.2.3"
330    tier: aux
331    service: forgejo
332    host: runner
333    arch: [amd64]
334  ollama:
335    image: docker.io/ollama/ollama
336    tag: "0.32.6"
337    tier: main
338    service: llm-stack
339    host: runner
340    arch: [amd64]
341  openwebui:
342    image: ghcr.io/open-webui/open-webui
343    tag: "v0.11.3"
344    tier: main
345    service: llm-stack
346    host: runner
347    arch: [amd64]
348  litellm:
349    image: ghcr.io/berriai/litellm
350    tag: "v1.96.2"
351    tier: main
352    service: llm-stack
353    host: runner
354    arch: [amd64]
355  litellm_postgres:
356    image: docker.io/library/postgres
357    tag: "15.17-alpine"
358    tier: aux
359    service: llm-stack
360    host: runner
361    variant: alpine
362    arch: [amd64]
363  stirling_pdf:
364    image: docker.io/frooodle/s-pdf
365    tag: "1.2.0"
366    tier: main
367    service: web-tools
368    host: runner
369    arch: [amd64]
370  convertx:
371    image: ghcr.io/c4illin/convertx
372    tag: "v0.17.0"
373    tier: main
374    service: web-tools
375    host: runner
376    arch: [amd64]
377  cyberchef:
378    image: ghcr.io/gchq/cyberchef
379    tag: "10.23.0"
380    tier: main
381    service: web-tools
382    host: runner
383    arch: [amd64]
384  it_tools:
385    image: docker.io/corentinth/it-tools
386    tag: "2024.10.22-7ca5933"
387    tier: main
388    service: web-tools
389    host: runner
390    arch: [amd64]
391  tandoor:
392    image: docker.io/vabene1111/recipes
393    tag: "2.0.3"
394    tier: main
395    service: tandoor
396    host: runner
397    arch: [amd64]
398  tandoor_postgres:
399    image: docker.io/library/postgres
400    tag: "15.17-alpine"
401    tier: aux
402    service: tandoor
403    host: runner
404    variant: alpine
405    arch: [amd64]
406  ghost:
407    image: docker.io/library/ghost
408    tag: "5.130.4-alpine"
409    tier: main
410    service: ghost
411    host: runner
412    variant: alpine
413    arch: [amd64]
414  ghost_mysql:
415    image: docker.io/library/mysql
416    tag: "8.0.43"
417    tier: aux
418    service: ghost
419    host: runner
420    arch: [amd64]
421  livekit:
422    image: docker.io/livekit/livekit-server
423    tag: "v1.13.5"
424    tier: main
425    service: livekit
426    host: runner
427    arch: [amd64]
428  dnd_stt:
429    image: ghcr.io/speaches-ai/speaches
430    tag: "0.8.3-cuda"
431    tier: aux
432    service: dnd
433    host: runner
434    variant: cuda
435    arch: [amd64]
436  macros_searxng:
437    image: docker.io/searxng/searxng
438    tag: "2026.10.16-ff8f5ddcc"
439    tier: aux
440    service: macros
441    host: runner
442    arch: [amd64]
443  macros_postgres:
444    image: docker.io/library/postgres
445    tag: "16.15-alpine"
446    tier: aux
447    service: macros
448    host: runner
449    variant: alpine
450    arch: [amd64]
451  mealie:
452    image: ghcr.io/mealie-recipes/mealie
453    tag: "v3.27.0"
454    tier: main
455    service: mealie
456    host: runner
457    arch: [amd64]
458  mealie_stt:
459    image: ghcr.io/speaches-ai/speaches
460    tag: "0.8.3-cpu"
461    tier: aux
462    service: mealie
463    host: runner
464    variant: cpu
465    arch: [amd64]
466  mealie_postgres:
467    image: docker.io/library/postgres
468    tag: "17.11-alpine"
469    tier: aux
470    service: mealie
471    host: runner
472    variant: alpine
473    arch: [amd64]
474
475  # --- ground-floor-edge (arm64) -------------------------------------------
476  zigbee2mqtt:
477    image: docker.io/koenkk/zigbee2mqtt
478    tag: "2.6.1"
479    tier: main
480    service: zigbee2mqtt
481    host: ground-floor-edge
482    arch: [arm64]
483  otbr:
484    # Upstream publishes only short-lived sha-<commit> tags and has already
485    # deleted the tag for the running commit, so it is pinned by digest.
486    # This is the Thread border router: bump only with a tested image.
487    image: docker.io/openthread/border-router
488    tag: "latest@sha256:5c00ac87cd3050ccee5853393969349e5b0b0aa37058839fed7a7b5a33dba698"
489    version: "0.3.0 (336ee21, 2025-09-25)"
490    tier: main
491    service: otbr
492    host: ground-floor-edge
493    arch: [arm64]
494  dsmr_reader:
495    image: ghcr.io/xirixiz/dsmr-reader-docker
496    tag: "6.0.2"
497    tier: main
498    service: dsmr
499    host: ground-floor-edge
500    arch: [arm64]
501  dsmr_postgres:
502    image: docker.io/library/postgres
503    tag: "15.14"
504    tier: aux
505    service: dsmr
506    host: ground-floor-edge
507    arch: [arm64]
508
509  # --- doorbell (arm64) ----------------------------------------------------
510  mediamtx:
511    # Must stay the -rpi variant: it carries the Raspberry Pi camera stack
512    image: docker.io/bluenviron/mediamtx
513    tag: "1.15.3-rpi"
514    tier: main
515    service: doorbell
516    host: doorbell
517    variant: rpi
518    arch: [arm64]
519
520# Compose projects whose images are versioned elsewhere (see the header).
521# The update monitor's drift check ignores their containers.
522images_unmanaged_projects:
523  - cvat            # upstream compose at cvat_repo_version
524  - harbor          # offline installer at harbor_version
525  - website         # deployed by the website repo's CI
526  - website-stage
527
528# ============================================================================
529# Role variables derived from the catalog above. Roles read these; edit the
530# catalog, never these lines.
531# ============================================================================
532
533# --- homeassistant role ---
534homeassistant_npm_image: "{{ images.npm.image }}"
535homeassistant_npm_version: "{{ images.npm.tag }}"
536homeassistant_crowdsec_image: "{{ images.crowdsec.image }}"
537homeassistant_crowdsec_version: "{{ images.crowdsec.tag }}"
538homeassistant_semaphore_image: "{{ images.semaphore.image }}"
539homeassistant_semaphore_version: "{{ images.semaphore.tag }}"
540
541# --- monitoring role ---
542glances_image: "{{ images.glances.image }}:{{ images.glances.tag }}"
543glances_gpu_image: "{{ images.glances_gpu.image }}:{{ images.glances_gpu.tag }}"
544
545# --- storage role ---
546jellyfin_image: "{{ images.jellyfin.image }}"
547jellyfin_version: "{{ images.jellyfin.tag }}"
548sonarr_image: "{{ images.sonarr.image }}"
549sonarr_version: "{{ images.sonarr.tag }}"
550radarr_image: "{{ images.radarr.image }}"
551radarr_version: "{{ images.radarr.tag }}"
552prowlarr_image: "{{ images.prowlarr.image }}"
553prowlarr_version: "{{ images.prowlarr.tag }}"
554lidarr_image: "{{ images.lidarr.image }}"
555lidarr_version: "{{ images.lidarr.tag }}"
556bazarr_image: "{{ images.bazarr.image }}"
557bazarr_version: "{{ images.bazarr.tag }}"
558qbittorrent_image: "{{ images.qbittorrent.image }}"
559qbittorrent_version: "{{ images.qbittorrent.tag }}"
560lazylibrarian_image: "{{ images.lazylibrarian.image }}"
561lazylibrarian_version: "{{ images.lazylibrarian.tag }}"
562jellyseer_image: "{{ images.jellyseerr.image }}"
563jellyseer_version: "{{ images.jellyseerr.tag }}"
564cleanuparr_image: "{{ images.cleanuparr.image }}"
565cleanuparr_version: "{{ images.cleanuparr.tag }}"
566flaresolverr_image: "{{ images.flaresolverr.image }}"
567flaresolverr_version: "{{ images.flaresolverr.tag }}"
568gluetun_image: "{{ images.gluetun.image }}"
569gluetun_version: "{{ images.gluetun.tag }}"
570calibre_image: "{{ images.calibre.image }}"
571calibre_version: "{{ images.calibre.tag }}"
572calibre_web_image: "{{ images.calibre_web.image }}"
573calibre_web_version: "{{ images.calibre_web.tag }}"
574navidrome_image: "{{ images.navidrome.image }}"
575navidrome_version: "{{ images.navidrome.tag }}"
576nextcloud_image: "{{ images.nextcloud.image }}"
577nextcloud_version: "{{ images.nextcloud.tag }}"
578nextcloud_mariadb_image: "{{ images.nextcloud_mariadb.image }}"
579nextcloud_mariadb_version: "{{ images.nextcloud_mariadb.tag }}"
580nextcloud_redis_image: "{{ images.nextcloud_redis.image }}"
581nextcloud_redis_version: "{{ images.nextcloud_redis.tag }}"
582nextcloud_collabora_image: "{{ images.nextcloud_collabora.image }}"
583nextcloud_collabora_version: "{{ images.nextcloud_collabora.tag }}"
584nextcloud_elasticsearch_image: "{{ images.nextcloud_elasticsearch.image }}"
585nextcloud_elasticsearch_version: "{{ images.nextcloud_elasticsearch.tag }}"
586nextcloud_imaginary_image: "{{ images.nextcloud_imaginary.image }}"
587nextcloud_imaginary_version: "{{ images.nextcloud_imaginary.tag }}"
588restic_image: "{{ images.restic_server.image }}"
589restic_version: "{{ images.restic_server.tag }}"
590gdu_image: "{{ images.gdu.image }}"
591gdu_version: "{{ images.gdu.tag }}"
592
593# --- runner role ---
594# A role default dict cannot be merged from here, so the complete dict is
595# defined. Every key the runner templates use must exist.
596container_images:
597  dnd_stt: "{{ images.dnd_stt.image }}:{{ images.dnd_stt.tag }}"
598  ollama: "{{ images.ollama.image }}:{{ images.ollama.tag }}"
599  openwebui: "{{ images.openwebui.image }}:{{ images.openwebui.tag }}"
600  litellm: "{{ images.litellm.image }}:{{ images.litellm.tag }}"
601  frigate: "{{ images.frigate.image }}:{{ images.frigate.tag }}"
602  frigate_tensorrt: "{{ images.frigate_tensorrt.image }}:{{ images.frigate_tensorrt.tag }}"
603  immich_server: "{{ images.immich_server.image }}:{{ images.immich_server.tag }}"
604  immich_machine_learning: "{{ images.immich_machine_learning.image }}:{{ images.immich_machine_learning.tag }}"
605  immich_postgres: "{{ images.immich_postgres.image }}:{{ images.immich_postgres.tag }}"
606  valkey: "{{ images.immich_valkey.image }}:{{ images.immich_valkey.tag }}"
607  forgejo: "{{ images.forgejo.image }}:{{ images.forgejo.tag }}"
608  forgejo_runner: "{{ images.forgejo_runner.image }}:{{ images.forgejo_runner.tag }}"
609  stirling_pdf: "{{ images.stirling_pdf.image }}:{{ images.stirling_pdf.tag }}"
610  convertx: "{{ images.convertx.image }}:{{ images.convertx.tag }}"
611  cyberchef: "{{ images.cyberchef.image }}:{{ images.cyberchef.tag }}"
612  it_tools: "{{ images.it_tools.image }}:{{ images.it_tools.tag }}"
613  tandoor: "{{ images.tandoor.image }}:{{ images.tandoor.tag }}"
614  ghost: "{{ images.ghost.image }}:{{ images.ghost.tag }}"
615  livekit: "{{ images.livekit.image }}:{{ images.livekit.tag }}"
616  postgres: "{{ images.tandoor_postgres.image }}:{{ images.tandoor_postgres.tag }}"
617  mysql: "{{ images.ghost_mysql.image }}:{{ images.ghost_mysql.tag }}"
618llm_stack_postgres_image: "{{ images.litellm_postgres.image }}:{{ images.litellm_postgres.tag }}"
619macros_searxng_image: "{{ images.macros_searxng.image }}:{{ images.macros_searxng.tag }}"
620macros_postgres_image: "{{ images.macros_postgres.image }}:{{ images.macros_postgres.tag }}"
621mealie_version: "{{ images.mealie.tag }}"
622mealie_image: "{{ images.mealie.image }}:{{ images.mealie.tag }}"
623mealie_stt_image: "{{ images.mealie_stt.image }}:{{ images.mealie_stt.tag }}"
624mealie_postgres_image: "{{ images.mealie_postgres.image }}:{{ images.mealie_postgres.tag }}"
625forgejo_runner_binfmt_image: "{{ images.binfmt.image }}:{{ images.binfmt.tag }}"
626
627# --- entrance role ---
628z2m_image: "{{ images.zigbee2mqtt.image }}"
629z2m_version: "{{ images.zigbee2mqtt.tag }}"
630otbr_image: "{{ images.otbr.image }}:{{ images.otbr.tag }}"
631dsmr_reader_image: "{{ images.dsmr_reader.image }}:{{ images.dsmr_reader.tag }}"
632dsmr_postgres_image: "{{ images.dsmr_postgres.image }}:{{ images.dsmr_postgres.tag }}"
633
634# --- doorbell role ---
635doorbell_rtsp_image: "{{ images.mediamtx.image }}:{{ images.mediamtx.tag }}"
636