Working-tree improvements to the audit scripts (authored locally, not by me;
reviewed for correctness + bash -n clean before commit):
- compose-runtime-drift: prefer `docker compose config` for the expected image
with a raw-parse fallback; raw parser now resolves YAML anchors (*alias) so
anchor-based composes (e.g. dawarich) no longer mis-report drift.
- komodo-stack-hygiene: treat an unreachable Komodo API as critical and exit 3
so the Healthchecks EXIT trap sends /fail (the monitor itself is down, not
"all green"); git fetch before hash-drift compare; clearer "cannot compare"
message; pin in-container km host to localhost:9120.
- cert-token-check: expand monitored cert domains to the full set incl.
hc.kaleschke.info.
- gitea-bundle-mirror: skip empty repos without refs instead of failing.
- unraid-user-scripts.md: document SEND_NTFY/NTFY_TOPIC for the daily report.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Add endpoint-agnostic Healthchecks pings to the three remaining scheduled
host-audit jobs via an EXIT-trap merge (start + success/fail), so the body of
each script (incl. the 1400-line daily-status-report) stays untouched. Exit
0/1/2 = ran (ok/warning/critical); only rc>2 pings /fail. Capability URLs come
from per-job host secret files (healthchecks_<job>_url), never in the repo.
bash -n verified.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
- Hash drift now requires actual file changes inside the stack's
compose-dir between deployed_hash and latest_hash. Komodo's
deployed_hash bumps only on redeploy while latest_hash tracks master
HEAD, which produced six false-positive "Pending Update" warnings
for stacks whose own files never changed.
- Add EXPECTED_NOT_IN_KOMODO env (default: hermes-agent) for compose
files intentionally not Komodo-managed (work-in-progress, build/dev
compose).
End-to-end run on host: 0 critical, 0 warnings.
Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
Catches the failure class that let immich_new slip through: stacks
without a configured repo, project_missing, hash drift, and repo
compose files without a matching Komodo stack. Dry-run on host found
6 honest warnings, 0 critical. Wrapper as Unraid User Script for
weekly cadence is tracked in MASTER_TODO.
Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
Micha