OS update + reboot — 2026-06-18
Na strežniku je bil izveden sistemski update paketov, vključno z Docker komponentami,
nato pa kontroliran reboot zaradi novega kernela in AppArmor sprememb.
| Postavka | Stanje po vzdrževanju |
|---|
| Kernel | 6.8.0-124-generic |
| Ubuntu | 24.04.4 LTS noble |
| Docker | 29.5.3 |
| Docker Compose | v5.1.4 |
| containerd | 2.2.4 |
| APT stanje po rebootu | 0 updates, no reboot required |
| Backup pred update-om | /srv/backups/os-upgrade-2026-06-18-092603 |
Preverjeno po rebootu: Docker in containerd sta active.
Ključni servisi so se ponovno zagnali. Preverjeni so bili Runbook, Stirling PDF,
Immich, Uptime Kuma, Jellyfin, Vikunja in Minecraft TCP port.
Cloud-init disabled — 2026-06-18
Po rebootu je bil cloud-init.service v stanju failed zaradi starega provider
NoCloud bootcmd ukaza, ki je poskušal spreminjati SSH root/password
nastavitve. Efektivni SSH hardening je ostal pravilen, zato je bil cloud-init deaktiviran
za prihodnje boote z marker datoteko.
| Postavka | Stanje |
|---|
| Marker | /etc/cloud/cloud-init.disabled |
| cloud-init boot status | disabled-by-marker-file |
| Backup pred spremembo | /srv/backups/cloud-init-disable-2026-06-18-094323 |
| Rollback | sudo rm -f /etc/cloud/cloud-init.disabled |
Efektivni SSH po spremembi:
permitrootlogin no,
passwordauthentication no,
pubkeyauthentication yes,
maxauthtries 3.
# OS / reboot stanje
uname -r
apt list --upgradable
test -f /var/run/reboot-required && cat /var/run/reboot-required || echo "OK: no reboot required"
# Docker stanje
docker --version
docker compose version
systemctl is-active docker
systemctl is-active containerd
sudo docker ps
# Cloud-init stanje
ls -l /etc/cloud/cloud-init.disabled
cloud-init status --long
# SSH efektivne nastavitve
sudo sshd -T | grep -Ei 'permitrootlogin|passwordauthentication|pubkeyauthentication|maxauthtries'
Maintenance zgodovina
Spodnji zapisi so arhiv večjih vzdrževalnih posegov in update batch-ev.
Niso samostojni servisi, zato so zbrani tukaj pod Maintenance.
📄 Stirling PDF update — 2026-07-02
DIUN file provider je javil nov image digest za stirlingtools/stirling-pdf:latest.
Stirling PDF je bil posodobljen kontrolirano: najprej pull/check, nato backup persistent konfiguracije,
rollback image tag, recreate containerja in endpoint preverjanje.
| Podatek | Vrednost |
|---|
| Compose path | /srv/stirling-pdf/docker-compose.yml |
| Old image | sha256:dc2d06bc68bb5a023d3635060ba0070381446bff02011143c7e46ea0c184755c |
| New image | sha256:a6c5e627ceef6ed323a63da13e0d44ef68503320d1917cbc7ca2fd8e4a827aae |
| Version after update | 2.14.0 |
| Backup | /srv/backups/stirling-pdf-update-2026-07-02-084502 |
| Rollback tag | stirlingtools/stirling-pdf:rollback-2026-07-02-084502 |
| Post-check | running, healthy |
| Tailscale endpoint | HTTP 401 |
| Public HTTPS endpoint | HTTP 401 |
Rezultat: Stirling PDF je po updateu uspešno dosegljiv prek
http://100.74.84.18:8095 in https://pdf.nemac.si.
HTTP 401 je pričakovan, ker je vklopljen login
(SECURITY_ENABLELOGIN=true).
Opomba: zagon po recreateu je trajal približno minuto. Prvih 12 preverjanj je vrnilo
http=000 in health=starting, nato je container postal healthy
in endpoint je vrnil pričakovani 401.
# Stirling PDF quick check
docker inspect stirling-pdf --format 'IMAGE={{.Image}} STATUS={{.State.Status}} HEALTH={{if .State.Health}}{{.State.Health.Status}}{{else}}none{{end}}'
curl -sS -o /dev/null -w '%{http_code}\n' --max-time 15 http://100.74.84.18:8095
curl -sS -o /dev/null -w '%{http_code}\n' --max-time 20 https://pdf.nemac.si
# Stirling PDF rollback
cd /srv/stirling-pdf
docker rm -f stirling-pdf
docker tag stirlingtools/stirling-pdf:rollback-2026-07-02-084502 stirlingtools/stirling-pdf:latest
docker compose up -d stirling-pdf
🧰 OS / Docker / Tailscale update — 2026-06-30
Izveden je bil varnostno-nadzorovan APT update za Docker stack, Tailscale in povezane sistemske pakete.
Pred nadgradnjo je bil narejen preflight snapshot, APT simulacija, pregled Docker containerjev,
preverjanje endpointov in preverjanje reboot statusa. Po nadgradnji je bil Docker daemon ponovno zagnan,
containerji pa so se samodejno pobrali prek svojih restart politik.
| Komponenta | Pred updateom | Po updateu |
|---|
| Docker Engine | 29.5.3 | 29.6.1 |
| containerd | 2.2.4 | 2.2.5 |
| runc | 1.3.5 | 1.3.6 |
| Docker Compose plugin | 5.1.4 | 5.2.0 |
| Tailscale | 1.98.4 | 1.98.8 |
| kpartx | 0.9.4-5ubuntu8.1 | 0.9.4-5ubuntu8.2 |
| multipath-tools | 0.9.4-5ubuntu8.1 | 0.9.4-5ubuntu8.2 |
| Preverjanje | Rezultat |
|---|
| APT simulation | 9 upgraded, 0 newly installed, 0 to remove, 0 not upgraded |
| APT after update | Listing... Done brez preostalih paketov za nadgradnjo |
| Reboot required | no |
| Failed systemd units | 0 loaded units listed |
| docker.service | active |
| containerd.service | active |
| tailscaled.service | active |
| Endpoint | Post-check |
|---|
| FileBrowser | HTTP 200 |
| BentoPDF | HTTP 200 |
| GLPI | HTTP 200 |
| osTicket | HTTP 200 |
| Vikunja | HTTP 200 |
| Gitea | HTTP 200 |
| Uptime Kuma | HTTP 302 |
| Vaultwarden | HTTP 200 |
| Immich | HTTP 200 |
| Pingvin Share | HTTP 200, container healthy |
| Stirling PDF | HTTP 401 — pričakovano zaradi zaščite/prijave |
Rezultat: OS paketni update je uspešno zaključen. Docker, containerd in Tailscale so aktivni,
ni zahtevanega reboot-a, ni preostalih APT updateov in glavni self-hosted servisi so dosegljivi.
Opomba: Docker daemon se je med updateom ponovno zagnal. Zato so se containerji ponovno
pobrali in so bili nekaj minut prikazani kot Up <minute> oziroma začasno
health: starting. Končni post-check je potrdil normalno stanje.
| Artefakt | Lokacija |
|---|
| Preflight snapshot | /srv/backups/os-update-preflight-2026-06-30-124812 |
| Update log / backup dir | /srv/backups/os-update-docker-tailscale-2026-06-30-125205 |
# Quick version check
docker version
docker compose version
tailscale version
# Service status
systemctl is-active docker containerd tailscaled
systemctl --failed --no-pager
# Reboot / APT check
test -f /var/run/reboot-required && cat /var/run/reboot-required || echo "REBOOT_REQUIRED=no"
apt list --upgradable
# Main endpoint checks
curl -sS -o /dev/null -w '%{http_code}\n' --max-time 10 http://100.74.84.18:8090 # FileBrowser
curl -sS -o /dev/null -w '%{http_code}\n' --max-time 10 http://100.74.84.18:8097 # BentoPDF
curl -sS -o /dev/null -w '%{http_code}\n' --max-time 10 http://100.74.84.18:8099 # GLPI
curl -sS -o /dev/null -w '%{http_code}\n' --max-time 10 http://100.74.84.18:8098 # osTicket
curl -sS -o /dev/null -w '%{http_code}\n' --max-time 10 http://127.0.0.1:3456 # Vikunja
2026-07-30 — DNS fix + TLS renewal: hub.nemac.si
- Po objavi runbook vnosa je bil zaznan potekel TLS certifikat za
hub.nemac.si; javni HTTPS check brez -k je padel z napako certificate has expired.
- Vsebina runbooka je bila objavljena pravilno; preverjanje s
curl -k je vrnilo HTTP 200 in našlo nov runbook marker.
- Vzrok je bil napačen javni DNS A zapis za
hub.nemac.si, ki je kazal na Tailscale IP 100.74.84.18 namesto na javni IP 178.238.233.68.
- DNS A zapis je bil popravljen na
178.238.233.68; javni resolverji in authoritative Neoserv NS so po popravku vrnili pravi IP.
- Na strežniku je bil počiščen lokalni
systemd-resolved DNS cache z sudo resolvectl flush-caches, nato je tudi lokalni resolver vrnil 178.238.233.68.
- Caddy konfiguracija je bila validirana kot veljavna; v aktivnem
Caddyfile ni bilo posebne staging ACME nastavitve.
- Izveden je bil kontroliran restart Caddy containerja; Caddy je uspešno izvedel Let's Encrypt HTTP-01 validacijo in obnovil certifikat.
- Novi certifikat za
hub.nemac.si je izdan prek Let's Encrypt YE2 in velja od 2026-07-30 do 2026-10-28.
- Končni public HTTPS check za
https://hub.nemac.si/runbook/ brez -k je vrnil HTTP 200.
- Začasne runbook delovne mape in temp HTML check datoteke so bile po popravku odstranjene.
2026-07-30 — Claude Code + GitHub lab
- Vzpostavljen je bil izoliran testni uporabnik
claude-lab za preizkus Claude Code + GitHub workflowa na strežniku.
- Uporabnik
claude-lab nima sudo pravic; lab pot je /srv/ai-lab.
- Sistemski
node, npm in claude niso nameščeni; Node/npm/Claude Code so nameščeni samo pod uporabnikom claude-lab prek nvm.
- Preverjene verzije: Node
v24.18.1, npm 11.16.0, Claude Code 2.1.220, GitHub CLI 2.96.0.
- Claude Code auto-update je izklopljen z okoljsko spremenljivko
DISABLE_AUTOUPDATER=1.
- GitHub CLI prijava je bila uspešna; tokeni, OAuth URL-ji, e-mail, orgId in zasebni URL-ji niso zapisani v runbook.
- Testni workflow je bil uspešno preverjen: Claude read-only pregled repozitorija, lokalna sprememba, ročni diff pregled, ročni commit in kontroliran push v zasebni testni repozitorij.
- Končno stanje: lokalni
main se ujema z origin/main; zadnji testni commit je 8e7ae5a; reboot ni zahtevan.
- Potrjen varen način dela: Claude pripravi spremembo lokalno → skrbnik pregleda diff → lokalno testiranje → ročni commit → ročni push.
2026-07-29 — Reboot + DIUN updates: BentoPDF, FileBrowser, Gitea
- Controlled reboot performed after unattended-upgrade updated
libc6 and created /var/run/reboot-required.
- Post-reboot verification confirmed kernel
6.8.0-136-generic, REBOOT REQUIRED no, no pending APT upgrades, and core services healthy.
- BentoPDF updated from image
sha256:eaeea1e4... to sha256:165113f4....
- BentoPDF compose path:
/srv/bentopdf/docker-compose.yml.
- BentoPDF backup created before change:
/srv/backups/bentopdf-update-2026-07-29-074840.
- BentoPDF rollback tag:
bentopdfteam/bentopdf:rollback-2026-07-29-074840.
- An earlier interrupted BentoPDF backup attempt created
/srv/backups/bentopdf-update-2026-07-29-073652; it was not used for rollback.
- FileBrowser updated from image
sha256:b1d9980d... to sha256:a469ea07....
- FileBrowser compose path:
/var/lib/docker/volumes/portainer_data/_data/compose/2.
- FileBrowser compose files:
docker-compose.yml and docker-compose.healthcheck-override.yml.
- FileBrowser backup created before change:
/srv/backups/filebrowser-update-2026-07-29-082338.
- FileBrowser config/database backup:
/srv/backups/filebrowser-update-2026-07-29-082338/filebrowser-config-database.tar.gz.
- FileBrowser rollback tag:
filebrowser/filebrowser:rollback-2026-07-29-082338.
- FileBrowser log after update showed a project notice: File Browser is being wound down and archived on
2026-09-01; replacement planning should be tracked separately.
- Gitea updated from image
sha256:7dff60d7... to sha256:34e3f6b7....
- Gitea version changed from
1.27.0 to 1.27.1.
- Gitea compose path:
/srv/gitea/docker-compose.yml.
- Gitea backup created before change:
/srv/backups/gitea-update-2026-07-29-082611.
- Gitea data backup:
/srv/backups/gitea-update-2026-07-29-082611/gitea-data.tar.gz.
- Gitea rollback tag:
gitea/gitea:rollback-2026-07-29-082611.
- Updates were completed with backup files, Docker inspect snapshots, rollback image tags, service-only recreates, and post-update HTTP checks.
- Final verification passed: Runbook public HTTP 200, Gitea public/local HTTP 200, FileBrowser HTTP 200, BentoPDF HTTP 200, Vikunja HTTP 200, Immich HTTP 200, Vaultwarden HTTP 200, GLPI HTTP 200, osTicket HTTP 200, Navidrome HTTP 302, Stirling PDF HTTP 401 expected due login.
- No reboot required after final verification.
2026-07-27 — DIUN update: FileBrowser + Vaultwarden
- FileBrowser updated from image
sha256:c4c627f6... to sha256:b1d9980d....
- FileBrowser compose path:
/var/lib/docker/volumes/portainer_data/_data/compose/2.
- FileBrowser compose files:
docker-compose.yml and docker-compose.healthcheck-override.yml.
- FileBrowser backup created before change:
/srv/backups/filebrowser-update-2026-07-27-124708.
- FileBrowser config/database backup:
/srv/backups/filebrowser-update-2026-07-27-124708/filebrowser-config-database.tar.gz.
- FileBrowser rollback tag:
filebrowser/filebrowser:rollback-2026-07-27-124708.
- Vaultwarden updated from image
sha256:9a8eec71... to sha256:e6443e3d....
- Vaultwarden version after update:
1.37.0.
- Vaultwarden compose path:
/srv/vaultwarden/docker-compose.yml.
- Vaultwarden backup created before change:
/srv/backups/vaultwarden-update-2026-07-27-124936.
- Vaultwarden data backup:
/srv/backups/vaultwarden-update-2026-07-27-124936/vaultwarden-data.tar.gz. This archive contains vault data and must not be shared.
- Vaultwarden rollback tag:
vaultwarden/server:rollback-2026-07-27-124936.
- Vaultwarden was stopped before creating the data backup to keep the backup consistent, then recreated with the new image.
- Final verification passed: FileBrowser healthy + HTTP 200, Vaultwarden healthy + HTTP 200, Runbook HTTP 200, Gitea HTTP 200, Vikunja HTTP 200, Immich HTTP 200, BentoPDF HTTP 200, GLPI HTTP 200, osTicket HTTP 200, Navidrome HTTP 302, Stirling PDF HTTP 401 expected due login.
- No reboot required after final verification.
2026-07-22 — DIUN update: Immich Valkey 9
- Immich Valkey cache container updated from image
sha256:8e8d64b4... to sha256:3acc0687....
- Updated image reference in compose:
docker.io/valkey/valkey:9@sha256:3acc0687f2a2e1091fae6450d7842dd658c941338cf0a873ddd9e14b9e4ea4dd.
- Valkey version after update:
9.1.1.
- Compose path:
/srv/immich/app/docker-compose.yml.
- Updated service:
redis; container: immich_redis.
- Only the Valkey/Redis cache service was recreated;
immich_server, immich_postgres, and immich_machine_learning remained running and healthy.
- Backup created before change:
/srv/backups/immich-valkey9-update-2026-07-22-113612.
- Backed up compose file,
.env if present, and Docker inspect files. These backup files may contain sensitive configuration and must not be shared publicly.
- Rollback tag:
valkey/valkey:rollback-immich-2026-07-22-113612.
- Safe update procedure used: verify pinned digest, backup configuration, create rollback image tag, patch compose digest, validate
docker compose config, pull pinned image, and recreate only the redis service with --no-deps.
- Initial
immich_server logs showed temporary getaddrinfo ENOTFOUND redis messages during the Redis/Valkey recreate window.
- Follow-up verification confirmed
immich_redis healthy, immich_server healthy, Immich HTTP 200, and no new Redis/error lines in the last 2 minutes.
- No reboot required after final verification.
2026-07-21 — DIUN update: RustDesk server
- RustDesk server updated from image
sha256:10818ec05... to sha256:8ecdab65....
- Updated image:
rustdesk/rustdesk-server:latest.
- Updated containers:
hbbs and hbbr.
- Both containers use
--network host, --restart unless-stopped, and mount /srv/rustdesk to /root.
- Container commands confirmed before update:
hbbs uses hbbs; hbbr uses hbbr.
- Backup created before change:
/srv/backups/rustdesk-server-update-2026-07-21-123315.
- RustDesk data backup:
/srv/backups/rustdesk-server-update-2026-07-21-123315/rustdesk-data.tar.gz. This archive contains RustDesk key material and must not be shared.
- Rollback tag:
rustdesk/rustdesk-server:rollback-2026-07-21-123315.
- Final listener checks passed:
21115/tcp, 21116/tcp, 21116/udp, and 21117/tcp.
- The new RustDesk server also listens locally on websocket ports
21118/tcp and 21119/tcp; these were not opened in UFW because the standard RustDesk setup currently uses 21115–21117.
- UFW rules for
21115/tcp, 21116/tcp, 21116/udp, and 21117/tcp remained present.
- Logs confirmed
hbbs loaded its private key from id_ed25519; log key output was masked during final verification and should not be pasted publicly.
- RustDesk client connection test passed after the update.
- Other post-checks passed: Runbook public HTTP 200, Gitea public HTTP 200, Vikunja HTTP 200, Immich HTTP 200, FileBrowser HTTP 200, BentoPDF HTTP 200, GLPI HTTP 200, osTicket HTTP 200, Navidrome HTTP 302, Stirling PDF HTTP 401 expected due login.
- No reboot required after final verification.
2026-07-20 — DIUN update: Vikunja app
- Vikunja app updated from image
sha256:f6b80393... to sha256:1a5dd2d4....
- Vikunja version updated from
v2.3.0 to v2.4.0.
- Compose path:
/var/lib/docker/volumes/portainer_data/_data/compose/8/docker-compose.yml.
- Updated service:
vikunja; container: vikunja.
- Database service
vikunja-db was left untouched and remained healthy on postgres:18 / PostgreSQL 18.4.
- Backup created before change:
/srv/backups/vikunja-app-update-2026-07-20-095134.
- Logical DB dump before app update:
/srv/backups/vikunja-app-update-2026-07-20-095134/vikunja-db-before-app-update.sql.gz.
- Vikunja files backup:
/srv/backups/vikunja-app-update-2026-07-20-095134/vikunja-files-before-app-update.tar.gz.
- Rollback tag:
vikunja/vikunja:rollback-2026-07-20-095134.
- Safe app update procedure used: backup compose/inspect files, create rollback image tag, create fresh DB dump, pull the new app image, recreate only the
vikunja app container with --no-deps.
- Vikunja migrations ran successfully after the app update.
- Log note:
No license key configured. Pro features have been disabled. is expected when running without a Pro license.
- Log note: schema link warnings were observed during startup, but HTTP checks and migrations passed.
- Final post-checks passed: Runbook public HTTP 200, Gitea public HTTP 200, Vikunja HTTP 200, Immich HTTP 200, FileBrowser HTTP 200, BentoPDF HTTP 200, GLPI HTTP 200, osTicket HTTP 200, Navidrome HTTP 302, Stirling PDF HTTP 401 expected due login.
- No reboot required after final verification; no APT packages were pending.
2026-07-20 — APT update, controlled reboot + Vikunja Postgres 18
- APT upgrade completed successfully after pre-checks showed reboot required for
linux-image-6.8.0-136-generic and linux-base.
- APT upgrade log:
/srv/backups/apt-upgrade-2026-07-20-075413.log.
- Packages upgraded:
docker-ce, docker-ce-cli, docker-ce-rootless-extras, and tailscale.
- Docker server updated from
29.6.1 to 29.6.2.
- Tailscale updated from
1.98.8 to 1.98.9.
- Docker Compose remained on
v5.3.1; containerd remained on 2.2.6.
- Docker engine restart during the APT upgrade caused a short warmup period; Immich, GLPI and Stirling PDF initially returned HTTP 000 but were OK after warmup.
- Controlled reboot completed after the kernel update.
- Kernel before reboot:
6.8.0-134-generic.
- Kernel after reboot:
6.8.0-136-generic.
/var/run/reboot-required cleared after reboot.- Weekly config backup before maintenance was present and verified:
/srv/backups/weekly/2026-07-19-041855 (52M).
- Vikunja database updated on
postgres:18 from image sha256:48ebba8b... to sha256:3a82e1f5....
- Vikunja DB is running PostgreSQL
18.4.
- Vikunja compose service names confirmed: DB service
db, app service vikunja; fixed container names vikunja-db and vikunja.
- Vikunja DB persistent mount confirmed:
/srv/vikunja/db → /var/lib/postgresql.
- Vikunja Postgres backup created:
/srv/backups/vikunja-postgres18-update-2026-07-20-090121.
- Logical DB dump:
/srv/backups/vikunja-postgres18-update-2026-07-20-090121/vikunja-db-all-databases.sql.gz.
- Bind mount backup:
/srv/backups/vikunja-postgres18-update-2026-07-20-090121/vikunja-db-bind.tar.gz.
- Vikunja Postgres rollback tag:
postgres:rollback-vikunja-2026-07-20-090121.
- Safe Vikunja procedure used: stop app, create logical dump and bind backup, remove/recreate only the DB container while keeping
/srv/vikunja/db, then remove/recreate the app container to refresh Docker DNS/network resolution.
- Final post-checks passed: Runbook public HTTP 200, Gitea public HTTP 200, Vikunja HTTP 200, Immich HTTP 200, FileBrowser HTTP 200, BentoPDF HTTP 200, GLPI HTTP 200, osTicket HTTP 200, Navidrome HTTP 302, Stirling PDF HTTP 401 expected due login.
- APT state after maintenance: no upgradable packages and
dpkg --audit clean.
- No reboot required after final verification.
2026-07-15 — DIUN update: Immich Valkey 9
- Immich Valkey updated from image
sha256:e30fbdc8... to sha256:8e8d64b....
- Valkey version after update:
9.1.0.
- Compose path:
/srv/immich/app/docker-compose.yml.
- The Valkey image is pinned by digest in compose; digest was updated from
sha256:e30fbdc8... to sha256:8e8d64b....
- Updated service:
redis; container: immich_redis.
- No persistent Valkey mount was present; only the cache container was recreated.
- Backup created before change:
/srv/backups/immich-valkey9-update-2026-07-15-120505.
- Backup compose file:
/srv/backups/immich-valkey9-update-2026-07-15-120505/docker-compose.yml.before.
- Rollback tag:
valkey/valkey:rollback-immich-2026-07-15-120505.
docker compose config -q passed after the digest change.- Post-checks passed:
immich_redis healthy, immich_server healthy, Immich HTTP 200.
- Temporary Redis connection errors were seen in
immich_server logs while Valkey was restarting; follow-up check showed no recent Redis/error lines in the last 5 minutes.
- Other post-checks passed: Runbook public HTTP 200, Gitea public HTTP 200, Vikunja HTTP 200, FileBrowser HTTP 200, BentoPDF HTTP 200, GLPI HTTP 200, osTicket HTTP 200, Navidrome HTTP 302, Stirling PDF HTTP 401 expected due login.
- No reboot required after this update.
2026-07-14 — Vikunja config cleanup: jwtsecret → secret
- Resolved non-urgent Vikunja warning about deprecated
service.jwtsecret.
- Compose file updated at
/var/lib/docker/volumes/portainer_data/_data/compose/8/docker-compose.yml.
- Environment key renamed from
VIKUNJA_SERVICE_JWTSECRET to VIKUNJA_SERVICE_SECRET.
- The secret value was preserved and was not printed in terminal output or added to the runbook.
- Backup created before change:
/srv/backups/vikunja-jwtsecret-migration-2026-07-14-113353.
- Backup compose file:
/srv/backups/vikunja-jwtsecret-migration-2026-07-14-113353/docker-compose.yml.before.
docker compose config -q passed after the change.- Only the Vikunja app container was recreated; the PostgreSQL container and data were not changed.
- Post-checks passed: Vikunja HTTP 200, Runbook public HTTP 200, Gitea public HTTP 200, FileBrowser HTTP 200, BentoPDF HTTP 200, GLPI HTTP 200, osTicket HTTP 200, Navidrome HTTP 302, Stirling PDF HTTP 401 expected due login.
- Recent Vikunja logs no longer show the deprecated
jwtsecret warning.
- No reboot required after this configuration cleanup.
2026-07-14 — DIUN updates: Gitea + Vikunja Postgres 18
- Gitea updated from image
sha256:8e25c717... to sha256:7dff60d7....
- Gitea version after update:
1.27.0.
- Gitea compose path:
/srv/gitea/docker-compose.yml.
- Gitea persistent mount confirmed:
/srv/gitea/data → /data.
- Gitea backup created:
/srv/backups/gitea-update-2026-07-14-094022.
- Gitea data backup:
/srv/backups/gitea-update-2026-07-14-094022/gitea-data.tar.gz.
- Gitea rollback tag:
gitea/gitea:rollback-2026-07-14-094022.
- Vikunja database updated on
postgres:18 from image sha256:22c89fe0... to sha256:48ebba8b....
- Vikunja DB is running PostgreSQL
18.4.
- Vikunja compose services confirmed: DB service
db, app service vikunja; fixed container names vikunja-db and vikunja.
- Vikunja DB persistent mount confirmed:
/srv/vikunja/db → /var/lib/postgresql.
- Vikunja Postgres backup created:
/srv/backups/vikunja-postgres18-update-2026-07-14-095355.
- Logical DB dump:
/srv/backups/vikunja-postgres18-update-2026-07-14-095355/vikunja-db-all-databases.sql.gz.
- Bind mount backup:
/srv/backups/vikunja-postgres18-update-2026-07-14-095355/vikunja-db-bind.tar.gz.
- Vikunja Postgres rollback tag:
postgres:rollback-vikunja-2026-07-14-095355.
- Safe Vikunja procedure used: stop app, create logical dump and bind backup, remove/recreate only the DB container while keeping
/srv/vikunja/db, then remove/recreate the app container to refresh Docker DNS/network resolution.
- Post-checks passed: Gitea local/public HTTP 200, Runbook public HTTP 200, Vikunja HTTP 200, FileBrowser HTTP 200, BentoPDF HTTP 200, GLPI HTTP 200, osTicket HTTP 200, Navidrome HTTP 302, Stirling PDF HTTP 401 expected due login.
- Note: Vikunja logged a non-urgent warning that
service.jwtsecret is deprecated because both service.secret and service.jwtsecret are set. No change was made during this update.
2026-07-13 — OS updates + controlled reboot
- APT upgrade completed successfully:
16 packages upgraded, 0 remaining upgradable packages.
- Upgrade log:
/srv/backups/apt-upgrade-2026-07-13-071702.log.
- Important package updates:
containerd.io updated to 2.2.6.docker-compose-plugin updated to 5.3.1.- Docker server remained on
29.6.1.
- Controlled reboot completed after kernel update.
- Kernel before reboot:
6.8.0-124-generic.
- Kernel after reboot:
6.8.0-134-generic.
/var/run/reboot-required cleared after reboot.- Docker containers restarted automatically after reboot; services became healthy after warmup.
- Post-checks passed: FileBrowser HTTP 200, BentoPDF HTTP 200, GLPI HTTP 200, osTicket HTTP 200, Vikunja HTTP 200, Navidrome HTTP 302, Stirling PDF HTTP 401 expected due login, Runbook public HTTP 200.
- Note: GLPI and Stirling PDF initially returned HTTP 000 immediately after reboot while containers were still starting; both were OK after warmup.
2026-07-10 — DIUN update: Navidrome
- Navidrome updated from image
sha256:60080f8... to sha256:7c43af9....
- Navidrome version after update:
0.63.1.
- Compose path:
/srv/navidrome/docker-compose.yml.
- Persistent mounts confirmed:
/srv/navidrome/data → /data/srv/navidrome/music → /music
- Backup created:
/srv/backups/navidrome-update-2026-07-10-120726.
- Data backup:
/srv/backups/navidrome-update-2026-07-10-120726/navidrome-data.tar.gz.
- Rollback tag:
deluan/navidrome:rollback-2026-07-10-120726.
- Post-checks passed: Navidrome local HTTP 302, server ready, scan completed, FileBrowser HTTP 200, osTicket HTTP 200, GLPI HTTP 200, BentoPDF HTTP 200, Vikunja HTTP 200, Stirling PDF HTTP 401 expected due login.
2026-07-09 — DIUN update: Navidrome
- Navidrome updated from image
sha256:c4b5cb36... to sha256:60080f8....
- Compose path:
/srv/navidrome/docker-compose.yml.
- Persistent mounts confirmed:
/srv/navidrome/data → /data/srv/navidrome/music → /music
- Backup created:
/srv/backups/navidrome-update-2026-07-09-092524.
- Data backup:
/srv/backups/navidrome-update-2026-07-09-092524/navidrome-data.tar.gz.
- Rollback tag:
deluan/navidrome:rollback-2026-07-09-092524.
- Post-checks passed: Navidrome local HTTP 302, server ready, scan completed, FileBrowser HTTP 200, osTicket HTTP 200, GLPI HTTP 200, BentoPDF HTTP 200, Vikunja HTTP 200.
- Related DIUN alert for Stirling PDF was checked; no update was needed because local and remote digest already matched
sha256:7ed4d968....
2026-07-09 — DIUN updates: Stirling PDF + Vikunja Postgres 18
- Stirling PDF updated from image
sha256:a6c5e627... to sha256:7ed4d968....
- Vikunja database updated on
postgres:18 from image sha256:4efc78b... to sha256:22c89fe0....
- Vikunja DB is running PostgreSQL
18.4; app migrations completed successfully.
- Backups created:
/srv/backups/stirling-pdf-update-2026-07-08-132427/srv/backups/vikunja-postgres18-update-retry-2026-07-08-135618- Logical DB dump:
/srv/backups/vikunja-postgres18-update-retry-2026-07-08-135618/vikunja-db-all-databases.sql.gz
/srv/backups/vikunja-postgres18-container-recreate-2026-07-08-144726- Bind mount backup:
/srv/backups/vikunja-postgres18-container-recreate-2026-07-08-144726/vikunja-db-bind.tar.gz
/srv/backups/vikunja-app-container-recreate-2026-07-09-075349
- Rollback tags:
stirlingtools/stirling-pdf:rollback-2026-07-08-132427postgres:rollback-vikunja-2026-07-08-135618postgres:rollback-vikunja-before-container-recreate-2026-07-08-144727
- Important Vikunja note: compose services are
db and vikunja, but fixed container names are vikunja-db and vikunja. During this update, docker compose up --force-recreate hit container name conflicts. The safe working procedure was to stop the app, remove/recreate only the DB container while keeping /srv/vikunja/db, then remove/recreate only the app container to refresh Docker DNS/network resolution.
- Post-checks passed: Vikunja HTTP 200, Stirling PDF Tailscale/Public HTTP 401 expected due login, FileBrowser HTTP 200, osTicket HTTP 200, GLPI HTTP 200, BentoPDF HTTP 200.
2026-07-06 — DIUN updates: FileBrowser + osTicket MariaDB
- FileBrowser updated from image
sha256:271ec822... to sha256:c4c627f....
- osTicket database updated on
mariadb:10.11 from image sha256:5a5c675... to sha256:be981e....
- osTicket MariaDB version after update:
10.11.18-MariaDB-ubu2204.
- Backups created:
/srv/backups/filebrowser-update-root-2026-07-06-074037/srv/backups/osticket-mariadb-update-2026-07-06-074521- Logical DB dump:
/srv/backups/osticket-mariadb-update-2026-07-06-074521/osticket-db-all-databases.sql.gz
- Rollback tags:
filebrowser/filebrowser:rollback-2026-07-06-074037mariadb:rollback-osticket-2026-07-06-074521
- Post-checks passed: FileBrowser HTTP 200, osTicket HTTP 200, GLPI HTTP 200, BentoPDF HTTP 200, Stirling PDF HTTP 401 expected due login.
🔔 DIUN updates — FileBrowser + BentoPDF — 2026-06-29
DIUN file provider je javil nova image digesta za filebrowser/filebrowser:latest
in bentopdfteam/bentopdf:latest. Oba servisa sta bila posodobljena z backupom,
rollback tagom in HTTP preverjanjem.
| Servis | Podatek | Vrednost |
|---|
| FileBrowser | Compose path | /var/lib/docker/volumes/portainer_data/_data/compose/2 |
| FileBrowser | Old image | sha256:a6653eb79ecf8312f4f6bf0d0adf65d81016f17a92d64d5b2562340984e39405 |
| FileBrowser | New image | sha256:271ec822a03112ee8d2fc7042e8434995dfa74421e6a48e031be68c88fcded1c |
| FileBrowser | Backup | /srv/backups/filebrowser-update-2026-06-29-071113 |
| FileBrowser | Rollback tag | filebrowser/filebrowser:rollback-2026-06-29-071113 |
| FileBrowser | Post-check | running, healthy, HTTP 200 |
| BentoPDF | Compose path | /srv/bentopdf/docker-compose.yml |
| BentoPDF | Old image | sha256:2d867aacb8ab5b196d00ee86944b1899d09d72df355384c5e15cf974737963a0 |
| BentoPDF | New image | sha256:eaeea1e447205a79cb61d7efdc6966f37311dc1bc9c36a3a5c897bf79107c2c3 |
| BentoPDF | Backup | /srv/backups/bentopdf-update-2026-06-29-071716 |
| BentoPDF | Rollback tag | bentopdfteam/bentopdf:rollback-2026-06-29-071716 |
| BentoPDF | Post-check | running, HTTP 200 |
Rezultat: oba servisa sta po posodobitvi dosegljiva prek Tailscale naslovov:
FileBrowser na http://100.74.84.18:8090 in BentoPDF na
http://100.74.84.18:8097.
Opomba: pri FileBrowser updateu je prvi docker compose up --force-recreate
naletel na conflict obstoječega container imena. Popravljeno je bilo s kontroliranim
docker rm -f filebrowser in ponovnim ustvarjanjem iz Portainer compose datotek.
Podatki so ostali varni, ker so na bind mountih /srv/filebrowser in
/srv/navidrome/music, ne v containerju.
# FileBrowser quick check
docker inspect filebrowser --format 'IMAGE={{.Image}} STATUS={{.State.Status}} HEALTH={{if .State.Health}}{{.State.Health.Status}}{{else}}none{{end}}'
curl -sS -o /dev/null -w '%{http_code}\n' --max-time 10 http://100.74.84.18:8090
# FileBrowser rollback
cd /var/lib/docker/volumes/portainer_data/_data/compose/2
docker rm -f filebrowser
docker tag filebrowser/filebrowser:rollback-2026-06-29-071113 filebrowser/filebrowser:latest
docker compose -f docker-compose.yml -f docker-compose.healthcheck-override.yml up -d filebrowser
# BentoPDF quick check
docker inspect bentopdf --format 'IMAGE={{.Image}} STATUS={{.State.Status}}'
curl -sS -o /dev/null -w '%{http_code}\n' --max-time 10 http://100.74.84.18:8097
# BentoPDF rollback
cd /srv/bentopdf
docker rm -f bentopdf
docker tag bentopdfteam/bentopdf:rollback-2026-06-29-071716 bentopdfteam/bentopdf:latest
docker compose up -d bentopdf
🧹 Backup retention policy update — 2026-06-24
Urejena je bila politika čiščenja backupov, da se na strežniku ne nabira preveč ročnih
update backup map. Weekly config/admin backupi in ročni *-update-* backupi
se zdaj obravnavajo ločeno.
| Postavka | Vrednost |
|---|
| Weekly backup script | /usr/local/sbin/nemac-weekly-backup |
| Weekly service | nemac-weekly-backup.service |
| Weekly timer | nemac-weekly-backup.timer |
| Weekly backup path | /srv/backups/weekly |
| Weekly retention | 6 weekly backupov |
| Weekly override | /etc/systemd/system/nemac-weekly-backup.service.d/override.conf |
| Manual update retention script | /usr/local/sbin/nemac-manual-update-backup-retention |
| Manual update retention service | nemac-manual-update-backup-retention.service |
| Manual update retention timer | nemac-manual-update-backup-retention.timer |
| Manual retention log path | /var/log/nemac-backup-retention |
| Systemd config backup | /srv/backups/manual-update-retention-systemd-2026-06-24-111959 |
| Weekly retention config backup | /srv/backups/backup-retention-config-2026-06-24-110937 |
Manual *-update-* politika:
backupi mlajši od 14 dni se obdržijo, najnovejši update backup po posamezni storitvi se obdrži,
backupi starejši od 45 dni pa se izbrišejo tudi, če so zadnji za posamezni prefix.
Pomembno: manual update retention skripta namenoma čisti samo varni top-level pattern
/srv/backups/*-update-YYYY-MM-DD*. Ne čisti /srv/backups/weekly,
baseline backupov, GLPI before/after backupov, Minecraft dnevnih backupov ali drugih posebnih map.
# Weekly backup retention status
systemctl cat nemac-weekly-backup.service
systemctl status nemac-weekly-backup.timer --no-pager
RETENTION=6 /usr/local/sbin/nemac-weekly-backup --dry-run
# Manual update backup retention status
systemctl status nemac-manual-update-backup-retention.timer --no-pager
systemctl list-timers --all --no-pager | grep -E 'nemac-weekly-backup|nemac-manual-update-backup-retention'
sudo /usr/local/sbin/nemac-manual-update-backup-retention --dry-run
# Manual update retention rollback
sudo systemctl disable --now nemac-manual-update-backup-retention.timer
sudo rm -f /etc/systemd/system/nemac-manual-update-backup-retention.service
sudo rm -f /etc/systemd/system/nemac-manual-update-backup-retention.timer
sudo systemctl daemon-reload
# Weekly retention rollback na default iz skripte
sudo rm -f /etc/systemd/system/nemac-weekly-backup.service.d/override.conf
sudo systemctl daemon-reload
systemctl show nemac-weekly-backup.service -p Environment
🐘 Vikunja Postgres update — 2026-06-24
DIUN file provider je javil update za postgres:18.
Ugotovljeno je bilo, da ta image uporablja vikunja-db, ne Immich.
Update je bil izveden previdno z logičnim PostgreSQL dumpom, rollback tagom in kratkim restartom Vikunja stacka.
| Postavka | Vrednost |
|---|
| App container | vikunja |
| DB container | vikunja-db |
| Compose project | vikunja |
| DB service | db |
| App service | vikunja |
| Portainer compose path | /var/lib/docker/volumes/portainer_data/_data/compose/8 |
| Compose files | docker-compose.yml, docker-compose.healthcheck-override.yml |
| DB image | postgres:18 |
| Old DB image | sha256:65f70a152846cf504dff86e807007e9aeac98c3aeb7b62541b2c55ab9d264e56 |
| New DB image | sha256:4efc78b0491e2d66547dc968c5fed5b0b805d79ed034fc632c4989f372722ea9 |
| PostgreSQL version | PostgreSQL 18.4 |
| DB bind mount | /srv/vikunja/db -> /var/lib/postgresql |
| Vikunja local URL | http://127.0.0.1:3456 |
| Backup | /srv/backups/vikunja-postgres18-update-2026-06-24-093455 |
| Rollback tag | postgres:rollback-vikunja-2026-06-24-093455 |
Rezultat: Postgres image za vikunja-db je bil posodobljen.
Baza je po updateu healthy, pg_isready vrača accepting connections,
Vikunja lokalni endpoint http://127.0.0.1:3456 pa vrača HTTP 200.
Opomba: backup vsebuje logični PostgreSQL dump, compose datoteke in inspect podatke.
Ker inspect/compose lahko vsebujeta okoljske vrednosti, mora backup ostati zaščiten.
# Preverjanje Vikunja stacka
cd /var/lib/docker/volumes/portainer_data/_data/compose/8
sudo docker compose -p vikunja -f docker-compose.yml -f docker-compose.healthcheck-override.yml ps
sudo docker exec vikunja-db sh -lc 'pg_isready'
curl -sS -o /dev/null -w "Vikunja_LOCAL_HTTP=%{http_code}\n" http://127.0.0.1:3456 --max-time 15
# Rollback po neuspešnem DB image updateu
cd /var/lib/docker/volumes/portainer_data/_data/compose/8
sudo docker tag postgres:rollback-vikunja-2026-06-24-093455 postgres:18
sudo docker compose -p vikunja -f docker-compose.yml -f docker-compose.healthcheck-override.yml up -d --no-deps --force-recreate db
sudo docker compose -p vikunja -f docker-compose.yml -f docker-compose.healthcheck-override.yml up -d --force-recreate vikunja
📁 FileBrowser update — 2026-06-24
DIUN file provider je javil update za filebrowser/filebrowser:latest.
FileBrowser je nameščen kot Portainer stack in je dostopen samo preko Tailscale omrežja.
| Postavka | Vrednost |
|---|
| URL | http://100.74.84.18:8090 |
| Container | filebrowser |
| Compose project | filebrowser |
| Portainer compose path | /var/lib/docker/volumes/portainer_data/_data/compose/2 |
| Compose files | docker-compose.yml, docker-compose.healthcheck-override.yml |
| Image | filebrowser/filebrowser:latest |
| Old image | sha256:9805b21cf910f3ef6f4a1c8f441f1dd6cc4197136f9541fe2a1ab6d050706e4b |
| New image | sha256:a6653eb79ecf8312f4f6bf0d0adf65d81016f17a92d64d5b2562340984e39405 |
| Port bind | 100.74.84.18:8090 -> 80/tcp |
| Backup | /srv/backups/filebrowser-update-2026-06-24-091525 |
| Rollback tag | filebrowser/filebrowser:rollback-2026-06-24-091525 |
Rezultat: FileBrowser je bil posodobljen preko Portainer compose stacka.
Container je po posodobitvi postal healthy, endpoint http://100.74.84.18:8090
pa vrača HTTP 200.
# Preverjanje FileBrowser
sudo docker ps --filter name=filebrowser
curl -sS -o /dev/null -w "FileBrowser_HTTP=%{http_code}\n" http://100.74.84.18:8090 --max-time 15
# Compose / Portainer stack
cd /var/lib/docker/volumes/portainer_data/_data/compose/2
sudo docker compose -p filebrowser -f docker-compose.yml -f docker-compose.healthcheck-override.yml ps
# Rollback po neuspešnem updateu
cd /var/lib/docker/volumes/portainer_data/_data/compose/2
sudo docker tag filebrowser/filebrowser:rollback-2026-06-24-091525 filebrowser/filebrowser:latest
sudo docker compose -p filebrowser -f docker-compose.yml -f docker-compose.healthcheck-override.yml up -d --force-recreate filebrowser
🧾 GLPI lab install — 2026-06-23
Nameščen je bil testni/lab GLPI sistem za preverjanje asset managementa in helpdesk funkcij.
Servis je dostopen samo preko Tailscale omrežja.
| Postavka | Vrednost |
|---|
| URL | http://100.74.84.18:8099 |
| Project path | /srv/glpi |
| Compose | /srv/glpi/docker-compose.yml |
| Compose project | glpi |
| App container | glpi |
| DB container | glpi-db |
| App image | glpi/glpi:latest / sha256:7e100562afe13cce132fe46c0a21ddb94f7ed2c06950da9c4b34ce734a1ad4ac |
| DB image | mysql:8.4 / sha256:563602a18ffd5be220968e8508d84c9dcd80fbffe69e28af51572db29e3285b2 |
| Runtime | Apache/2.4.67, PHP 8.5.7, MySQL 8.4.10 |
| Port bind | 100.74.84.18:8099 -> 80/tcp |
| UFW | 8099/tcp on tailscale0 |
| Tailscale ACL | 100.74.84.18:8099 dodan v ACL. |
| Volumes | glpi_glpi_data, glpi_db_data |
| Baseline backup | /srv/backups/glpi-baseline-2026-06-23-150643 |
Rezultat: GLPI se je uspešno namestil, auto-install je bil uspešen,
default uporabniki so bili zavarovani, opozorilo za privzeta gesla je izginilo,
endpoint http://100.74.84.18:8099 vrača HTTP 200,
baza pa vrne mysqld is alive.
Opomba: datoteka /srv/glpi/.env vsebuje lokalno generirana gesla in se ne sme deliti.
Backup glpi-project.tar.gz vsebuje tudi .env, zato mora ostati zaščiten.
# Preverjanje GLPI
sudo docker ps --filter name=glpi
curl -sS -o /dev/null -w "GLPI_HTTP=%{http_code}\n" http://100.74.84.18:8099 --max-time 20
sudo docker exec glpi-db sh -lc 'MYSQL_PWD="$MYSQL_ROOT_PASSWORD" mysqladmin ping -uroot --silent'
# Compose
cd /srv/glpi
sudo docker compose -p glpi --env-file .env -f docker-compose.yml ps
# Rollback, če se GLPI lab opusti
cd /srv/glpi && sudo docker compose -p glpi --env-file .env -f docker-compose.yml down -v
sudo rm -rf /srv/glpi
sudo ufw delete allow in on tailscale0 to any port 8099 proto tcp
# Tailscale ACL: odstrani 100.74.84.18:8099
📨 GLPI mail-to-ticket automation — 2026-06-24
Nastavljena je bila avtomatska obdelava e-mailov v GLPI lab okolju.
Testni mailbox se pobira prek GLPI mail receiverja, mailgate pa se samodejno zaganja s systemd timerjem.
| Postavka | Vrednost |
|---|
| GLPI URL | http://100.74.84.18:8099 |
| Mail receiver | GLPI Gmail test receiver |
| IMAP server | imap.gmail.com:993, IMAP, SSL, VALIDATE-CERT |
| Mail folders | INBOX, GLPI-accepted, GLPI-refused |
| Ticket routing | Mail receiver rule preusmeri nove tickete v Root entity > CPK Lab. |
| CPK domain mail rule — 2026-06-24 | Pravilo je omejeno na pošiljatelje z domeno @cpk.si. Kriterij: From email address, regular expression matches, regex /@cpk\.si([>\s]|$)/i. |
| Domain restriction test | Zunanji testni mail TEST external blocked je šel v GLPI-refused in ni ustvaril ticketa. Mail iz @cpk.si z zadevo TEST CPK allowed je šel v GLPI-accepted in ustvaril ticket. |
| Backup pred domeno | /srv/backups/glpi-before-cpk-domain-mail-rule-2026-06-24-134805 |
| Backup po domeni | /srv/backups/glpi-after-cpk-domain-mail-rule-working-2026-06-24-135627 |
| Anonymous receiver setting | Allow anonymous ticket creation (receiver) = Yes; Allow anonymous followups (receiver) = No. |
| Automatic action | mailgate je nastavljen na CLI. |
| Systemd script | /usr/local/sbin/glpi-mailgate-run |
| Systemd service | glpi-mailgate.service |
| Systemd timer | glpi-mailgate.timer |
| Timer schedule | OnCalendar=*:0/10, AccuracySec=30s, Persistent=true |
| Delujoč test | Testni mail TEST GLPI timer auto je bil avtomatsko pobran, premaknjen v GLPI-accepted in ustvaril GLPI ticket. |
| Backup po receiver testu | /srv/backups/glpi-after-mail-receiver-working-2026-06-24-131144 |
| Backup po timer testu | /srv/backups/glpi-after-mailgate-timer-working-2026-06-24-132324 |
Rezultat: e-mail-to-ticket tok deluje end-to-end:
Gmail inbox → systemd timer → GLPI mailgate → GLPI-accepted → GLPI ticket.
Varnostna opomba: Gmail app password in druga gesla niso zapisana v runbooku.
Nastavitev Allow anonymous ticket creation (receiver) je v lab okolju omogočena zato,
da lahko GLPI sprejme e-mail tudi, če pošiljatelj še nima pravilno dodeljenega profila v entiteti.
Sprejem ticketov je dodatno omejen z mail receiver pravilom na domeno @cpk.si.
Pri produkcijski uvedbi je priporočeno uporabnike povezati z AD/LDAP in jim dodeliti ustrezne pravice v pravi entiteti.
# Preverjanje GLPI mailgate timerja
systemctl is-enabled glpi-mailgate.timer
systemctl is-active glpi-mailgate.timer
systemctl list-timers --all | grep -i glpi || true
sudo journalctl -u glpi-mailgate.service -n 30 --no-pager
# Ročni force test mailgate receiverja
sudo docker exec -u www-data glpi sh -lc 'cd /var/www/glpi && php front/cron.php --debug --force mailgate; echo "EXIT=$?"'
# Rollback CPK domain omejitve, če je treba začasno sprejeti vse pošiljatelje
# V GLPI mail assignment rule vrni kriterij:
# Subject email header / regular expression matches / .*/
# Action ostane: Entity = Root entity > CPK Lab
# Rollback timerja, če avtomatsko pobiranje mailov ni več zaželeno
sudo systemctl disable --now glpi-mailgate.timer
sudo rm -f /etc/systemd/system/glpi-mailgate.timer /etc/systemd/system/glpi-mailgate.service /usr/local/sbin/glpi-mailgate-run
sudo systemctl daemon-reload
🎫 osTicket update — 2026-06-22
DIUN file provider je javil update za rinkp/osticket-dockerized:latest.
Preverjanje digestov je potrdilo, da je remote image novejši od lokalnega, zato je bil izveden varen update
samo za osTicket app servis osticket. Podatkovni servis osticket-db ni bil posodobljen.
| Postavka | Vrednost |
|---|
| Prejšnji image | sha256:31724b51e74793bf5e47fb2af10cb71338221ac1e8b375075b28df4bdbe02513 |
| Novi image | sha256:f8244c3fb27ad8d36125d2f705541a852af840819f2ab6a4c0f31b79273a2d2a |
| Runtime po update-u | Apache/2.4.67, PHP/8.4.22 |
| Compose | /srv/osticket/docker-compose.yml |
| Backup | /srv/backups/osticket-update-2026-06-22-094620 |
| Rollback tag | rinkp/osticket-dockerized:rollback-2026-06-22-094620 |
| Končno stanje | osticket in osticket-db sta healthy. Endpoint vrača 200, admin pot /scp/ vrača 302 na login. |
Rezultat: update je uspel. Tailscale endpoint http://100.74.84.18:8098
vrača HTTP 200, /scp/ pravilno preusmeri na login, DB ping vrne mysqld is alive,
backup arhiva za projekt in bazo pa prestaneta gzip -t.
# Preverjanje po update-u
sudo docker ps --filter name=osticket
curl -I http://100.74.84.18:8098 --max-time 20
curl -I http://100.74.84.18:8098/scp/ --max-time 20
sudo docker exec osticket-db sh -lc 'MYSQL_PWD="${MARIADB_ROOT_PASSWORD:-$MYSQL_ROOT_PASSWORD}" mariadb-admin ping -uroot --silent'
# Rollback image tag
rinkp/osticket-dockerized:rollback-2026-06-22-094620
🧩 Gitea update — 2026-06-22
DIUN file provider je javil update za gitea/gitea:latest.
Preverjanje digestov je potrdilo, da je remote image novejši od lokalnega, zato je bil izveden varen update
samo za servis gitea.
| Postavka | Vrednost |
|---|
| Prejšnji image | sha256:7d13848af12645600a5f9d93ee2560daa9c6fa6b5b859b7bff3a5e1c0b661031 |
| Novi image | sha256:8e25c717b8f748445e15ec46e0390f577cb628101184cb0a150d1dae126c1f39 |
| Nova verzija | Gitea 1.26.4 |
| Compose | /srv/gitea/docker-compose.yml |
| Backup | /srv/backups/gitea-update-2026-06-22-064651 |
| Rollback tag | gitea/gitea:rollback-2026-06-22-064651 |
| Končno stanje | gitea teče, lokalni endpoint in public endpoint vračata 200. |
Rezultat: update je uspel. https://git.nemac.si vrača HTTP/2 200,
runbook repo je prestal git fsck, backup arhiv pa gzip -t.
# Preverjanje po update-u
sudo docker ps --filter name=gitea
sudo docker logs --since 10m gitea
curl -I http://127.0.0.1:3002 --max-time 20
curl -I https://git.nemac.si --max-time 20
sudo git --git-dir=/srv/gitea/data/git/repositories/nemacd/home-server.git fsck --no-progress
# Rollback image tag
gitea/gitea:rollback-2026-06-22-064651
📄 Stirling PDF update — 2026-06-19
DIUN file provider je javil update za stirlingtools/stirling-pdf:latest.
Preverjanje je pokazalo, da je remote digest drugačen od lokalnega, zato je bil izveden varen update
samo za servis stirling-pdf.
| Postavka | Vrednost |
|---|
| Prejšnji image | sha256:2bb9b67f3edbca7ecc80f6e851a02cd04a10d5ea1d69b3e80b1e1f615e97b7a2 |
| Novi image | sha256:dc2d06bc68bb5a023d3635060ba0070381446bff02011143c7e46ea0c184755c |
| Nova verzija | Stirling-PDF v2.13.0 |
| Compose | /srv/stirling-pdf/docker-compose.yml |
| Backup | /srv/backups/stirling-pdf-update-2026-06-19-093144 |
| Rollback tag | stirlingtools/stirling-pdf:rollback-2026-06-19-093144 |
| Končno stanje | stirling-pdf je healthy, endpointa vračata 401, kar je pričakovano zaradi prijave. |
Rezultat: update je uspel. Public endpoint https://pdf.nemac.si
in Tailscale endpoint http://100.74.84.18:8095 vračata 401 Unauthorized,
kar je normalen rezultat za zaščiten Stirling PDF.
Opomba: prvi poskus update skripte se je ustavil v backup koraku zaradi permission napake pri shell redirectionu.
Pull/recreate se takrat ni izvedel. Prazna partial backup mapa je bila nato odstranjena, update pa je bil ponovljen v root shellu.
# Preverjanje po update-u
sudo docker ps --filter name=stirling-pdf
sudo docker logs --tail 120 stirling-pdf
curl -I http://100.74.84.18:8095 --max-time 20
curl -I https://pdf.nemac.si --max-time 20
# Rollback image tag
stirlingtools/stirling-pdf:rollback-2026-06-19-093144
⛏️ Minecraft image update — 2026-06-16
2026-06-16 je DIUN ponovno javil update za itzg/minecraft-server:latest. Preverjanje je pokazalo,
da to ni bil samo ponovljen alert: remote digest se je spremenil, zato je bil izveden nov varen update Minecraft image-a.
| Postavka | Vrednost |
|---|
| Prejšnji image | sha256:d54e9c99dfc77b18c02b896772798884b430f8e65865e785a2f5a9780d566320 |
| Novi image | sha256:9cd46375d0921e77784eabd88d67b4501eaf0b9af9de7d0ca71784d76d358ee4 |
| Backup | /srv/backups/minecraft-image-update-2026-06-16-092859 |
| Rollback tag | itzg/minecraft-server:rollback-2026-06-16-092859 |
| Postopek | save-all flush, clean stop, offline backup mape /srv/minecraft/data, pull novega image-a, start. |
| Končno stanje | minecraft je healthy, igralcev je bilo 0/20, TPS je 20.0 / 20.0 / 20.0. |
| Plugini | Essentials in EssentialsSpawn ostajata na stable verziji 2.22.0. |
Rezultat: update je uspel, rollback ni potreben. Server je po nekaj minutah vrnil
TPS 20.0 / 20.0 / 20.0.
Opomba: ker je bil 2026-06-15 že narejen Minecraft image update, je bil 2026-06-16 najprej
preverjen remote digest brez pull ali restarta. Šele ko se je digest izkazal za novega, je bil izveden update.
Preverjanje po update-u
sudo docker ps --filter name=minecraft
sudo docker exec minecraft rcon-cli list
sudo docker exec minecraft rcon-cli tps
sudo docker exec minecraft rcon-cli "version Essentials"
sudo docker exec minecraft rcon-cli "version EssentialsSpawn"
🧩 Update batch — 2026-06-15
2026-06-15 so bili obdelani update alerti za File Browser in Minecraft. Dodatno je bil posodobljen
Minecraft plugin paket EssentialsX iz dev builda na stable release.
| Komponenta | Sprememba | Preverjanje | Backup / rollback |
|---|
| File Browser |
Posodobljen image filebrowser/filebrowser:latest. |
Container filebrowser je healthy. Browser test na http://100.74.84.18:8090 je bil uspešen. HTTP root lahko vrne 404, zato je browser test merodajen. |
/srv/backups/filebrowser-update-2026-06-15-070526
filebrowser/filebrowser:rollback-2026-06-15-070526 |
| Minecraft image |
Posodobljen image itzg/minecraft-server:latest. |
Pred update-om je bil izveden save-all flush, nato clean stop in offline backup mape /srv/minecraft/data. Po update-u je container healthy, RCON deluje in TPS je 20.0 / 20.0 / 20.0. |
/srv/backups/minecraft-image-update-2026-06-15-071012
itzg/minecraft-server:rollback-2026-06-15-071012 |
| EssentialsX plugini |
EssentialsX.jar in EssentialsXSpawn.jar sta bila posodobljena iz 2.22.0-dev+111-c38c925 na stable 2.22.0. |
Minecraft je po restartu healthy. RCON vrača Essentials version 2.22.0 in EssentialsSpawn version 2.22.0. Plugini so Essentials, EssentialsSpawn in NemacWelcome. |
/srv/backups/essentialsx-update-2026-06-15-073031
Rollback je prek shranjenih .jar.before datotek in arhiva Essentials-folder-before-update.tar.gz. |
Končno stanje: filebrowser in minecraft sta healthy.
Minecraft RCON deluje, igralcev med update-om ni bilo, TPS po update-u je 20.0 / 20.0 / 20.0.
Backup permissions: update backup mape so nastavljene na 700, datoteke pa na
600. Rollback tage in backupe pusti nekaj dni, nato jih počisti v ločenem cleanup koraku.
Preverjanje po update-u
sudo docker ps --filter name=filebrowser --filter name=minecraft
sudo docker exec minecraft rcon-cli "version Essentials"
sudo docker exec minecraft rcon-cli "version EssentialsSpawn"
sudo docker exec minecraft rcon-cli tps
Backup lokacije
/srv/backups/filebrowser-update-2026-06-15-070526
/srv/backups/minecraft-image-update-2026-06-15-071012
/srv/backups/essentialsx-update-2026-06-15-073031
🔔 DIUN update batch — 2026-06-12
Telegram/DIUN alerti so bili obdelani 2026-06-12. Posodobljeni so bili Navidrome, Stirling PDF in
PostgreSQL image za Vikunja DB. Vsi update-i so bili narejeni postopno, z rollback tagi in backupi.
| Servis | Image | Rezultat | Backup / rollback |
|---|
| Navidrome |
deluan/navidrome:latest |
Posodobljen. Teče kot network_mode: host, posluša na 127.0.0.1:4533, Caddy ga objavlja na https://ente.nemac.si/music/. Direktni 100.74.84.18:4533 ni pravilen test za to postavitev. |
/srv/backups/navidrome-update-2026-06-12-072926
deluan/navidrome:rollback-2026-06-12-072926 |
| Stirling PDF |
stirlingtools/stirling-pdf:latest |
Posodobljen. Container je healthy, health endpoint javlja verzijo 2.12.0. 401 Unauthorized na https://pdf.nemac.si je pričakovan, ker je servis zaščiten z loginom. |
/srv/backups/stirling-pdf-update-2026-06-12-073721
stirlingtools/stirling-pdf:rollback-2026-06-12-073721 |
| Vikunja DB |
postgres:18 |
Posodobljen po logičnem backupu baze. Compose service ime je db, container name je vikunja-db. Pri compose ukazih mora biti uporabljen project name -p vikunja, sicer lahko pride do konflikta container name-a. Po update-u je vikunja-db healthy, https://todo.nemac.si/ pa vrača 200 OK. |
/srv/backups/vikunja-postgres-update-2026-06-12-074812
postgres:rollback-vikunja-2026-06-12-075847 |
Končno stanje: Navidrome, Stirling PDF, vikunja in
vikunja-db delujejo. Kritični servisi Caddy, Uptime Kuma,
Portainer, File Browser, Jellyfin in Minecraft so ostali OK.
Varnostna opomba za DB dumpe: pg_dumpall lahko v headerju izpiše role in
SCRAM password hash. To ni plain-text geslo, vendar se vseeno obravnava kot občutljiv podatek. Pri prihodnjih
DB backupih se dump headerjev ne kopira v chat; preverja se samo gzip integrity in varni markerji brez role/password vrstic.
Preverjanje po update-u
curl -sS -o /dev/null -w "navidrome=%{http_code}\n" https://ente.nemac.si/music/ --max-time 20
curl -I https://pdf.nemac.si --max-time 15
curl -I https://todo.nemac.si/ --max-time 15
sudo docker ps --filter name=navidrome --filter name=stirling --filter name=vikunja
Vikunja Postgres posebnost
Portainer compose stack je v /var/lib/docker/volumes/portainer_data/_data/compose/8.
Service za bazo je db, container pa vikunja-db. Za ukaze uporabljaš:
cd /var/lib/docker/volumes/portainer_data/_data/compose/8
docker compose -p vikunja -f docker-compose.yml -f docker-compose.healthcheck-override.yml config --services
Rollback opomba
Rollback tagi in backupi naj ostanejo nekaj dni. Čiščenje naredi šele, ko so storitve stabilne in ni novih DIUN alertov za iste image-e.
Kraken Telegram Crypto Simulator
Kraken Telegram Crypto Simulator je interni simulacijski crypto trading bot/portal na Contabo VPS.
Namenjen je simulaciji strategije z realnimi Kraken public market podatki, Telegram obvestili in Streamlit portalom.
Sistem trenutno ne trguje s pravim denarjem, ne uporablja Kraken private API ključev in uporablja samo public market podatke.
Osnovni podatki
- Projekt:
/srv/kraken-telegram-sim
- Postavitev: Docker Compose
- Portal: Streamlit, container
kraken-sim-portal
- Worker: Python background worker, container
kraken-sim-worker
- Baza: SQLite,
/srv/kraken-telegram-sim/data/sim.db
- Backupi baze:
/srv/kraken-telegram-sim/backups
- Skrivnosti:
/srv/kraken-telegram-sim/.env; te datoteke ne izpisuj javno.
.env vsebuje TELEGRAM_BOT_TOKEN in TELEGRAM_CHAT_ID; v runbooku smejo biti zapisana samo imena ključev, nikoli vrednosti.
Containerji in dostop
kraken-sim-portal: Streamlit portal, bindan samo lokalno kot 127.0.0.1:8501->8501. Ni javno odprt na internetu.kraken-sim-worker: background worker, vsakih 300 sekund preverja trg, izvaja samo simulirane BUY/SELL odločitve, pošilja Telegram obvestila in piše v SQLite bazo.- Dostop do portala je prek SSH tunnela. Če tunnel ni odprt, bot še vedno dela; nedosegljiv je samo portal iz lokalnega brskalnika.
ssh -L 8501:127.0.0.1:8501 nemacd@nemac
# potem lokalno odpri:
# http://127.0.0.1:8501
Trenutna aktivna strategija
Aktivna strategija je Strategy v3.2 — candle-based confirmation.
Nastavitve v bazi so bile preverjene 2026-05-14:
strategy_version = v3.2_candle_based_confirmationsimulation_mode = OFFICIAL_STRATEGY_V3_2_CANDLE_CONFIRMATIONsimulation_started_at = 2026-05-14T08:33:46+02:00bot_enabled = true- Na dan preverjanja:
trades=0, positions=0, decision_logs=9, bot_runs=4.
Glavna sprememba v3.2
Prej so se entry/exit potrditve štele po worker ciklih. Worker teče na 5 minut, signal engine pa uporablja zaprte 15m sveče,
zato je lahko bot isto zaprto 15m svečo prebral večkrat. V v3.2 confirmation counter šteje samo različne zaprte 15m sveče.
- BUY confirmation šteje različne zaprte 15m sveče.
- AVOID SELL confirmation šteje različne zaprte 15m sveče.
- Worker cikli sami po sebi ne povečajo confirmation counterja, če gre za isto 15m svečo.
- Trenutni signal
AVOID je lahko pričakovan, kadar 1h trend ni potrjen.
Audit stolpci v decision_logs
signal_candle: timestamp zaprte 15m sveče, na kateri je bil izračunan signal.htf_candle: timestamp zaprte 1h sveče, uporabljene za higher-timeframe filter.
Exit logika
- Hard take-profit se sproži takoj.
- Hard stop-loss se sproži takoj.
- Hard TP/SL ne čakata na confirmation in ne čakata na minimum hold.
- AVOID izhod čaka confirmation po različnih zaprtih 15m svečah.
Glavna pravila strategije v3.2
- 15-minutni signal engine + 1h higher-timeframe filter.
- Pari:
BTC/EUR, ETH/EUR, SOL/EUR.
- BUY samo, če je 15m signal
BUY WATCH in je 1h trend filter OK.
- Za altcoine je dodatno pomemben BTC 1h režim.
- Brez early reversal vstopov; low-frequency trend mode.
- Trade znesek:
10 €.
- Max odprtih pozicij:
2.
- Max BUY na dan:
3.
- Entry confirmation:
3 različne zaprte 15m sveče.
- Exit confirmation:
3 različne zaprte 15m sveče.
- Worker interval:
300 sekund.
- Cooldown po prodaji:
90 minut.
- Minimalno držanje:
60 minut za običajne izhode, ne pa za hard TP/SL.
- Take profit:
+3.0%.
- Stop loss:
-2.0%.
- Dnevno Telegram poročilo: po 21:00.
Portal
Portal prikazuje tudi Signal candle / 15m sveča in 1h candle / 1h sveča v signal engine in decision log pogledu.
Pomembne datoteke
/srv/kraken-telegram-sim/docker-compose.yml
/srv/kraken-telegram-sim/Dockerfile
/srv/kraken-telegram-sim/requirements.txt
/srv/kraken-telegram-sim/app/main.py
/srv/kraken-telegram-sim/app/worker.py
/srv/kraken-telegram-sim/app/trading_core.py
/srv/kraken-telegram-sim/app/report_test.py
/srv/kraken-telegram-sim/app/telegram_test.py
/srv/kraken-telegram-sim/data/sim.db
/srv/kraken-telegram-sim/.env
Standardni status ukazi
cd /srv/kraken-telegram-sim
docker ps --filter name=kraken-sim
docker logs --tail 120 kraken-sim-worker
curl -I http://127.0.0.1:8501 --max-time 10
Preveri DB nastavitve, schema in zadnje odločitve
cd /srv/kraken-telegram-sim
docker compose run --rm -e PYTHONPATH=/app/app kraken-sim-worker python - <<'PY'
import sqlite3
from pathlib import Path
db = Path("/app/data/sim.db")
with sqlite3.connect(db) as conn:
conn.row_factory = sqlite3.Row
print("=== SETTINGS ===")
for row in conn.execute(
'''
SELECT key, value
FROM settings
WHERE key IN ('cash_eur','simulation_started_at','strategy_version','simulation_mode','bot_enabled')
ORDER BY key
'''
):
print(f"{row['key']}={row['value']}")
print("
=== decision_logs columns ===")
for row in conn.execute("PRAGMA table_info(decision_logs)"):
print(row["name"])
print("
=== latest decisions ===")
for row in conn.execute(
'''
SELECT created_at, pair, signal, decision, signal_candle, htf_candle, reason
FROM decision_logs
ORDER BY id DESC
LIMIT 20
'''
):
print(dict(row))
PY
Preveri trenutne signale
cd /srv/kraken-telegram-sim
docker compose run --rm -e PYTHONPATH=/app/app kraken-sim-worker python - <<'PY'
from trading_core import build_signal_table
df = build_signal_table()
cols = [
"Par", "Signal", "Score", "Risk", "Trend", "RSI",
"Signal candle", "1h OK", "1h Score", "1h Trend", "1h RSI", "1h candle", "Razlaga",
]
existing = [c for c in cols if c in df.columns]
print(df[existing].to_string(index=False))
PY
Restart / rebuild
cd /srv/kraken-telegram-sim
docker compose up -d --build
docker compose ps
Ročni backup baze
cd /srv/kraken-telegram-sim
mkdir -p backups
cp data/sim.db backups/sim-manual-$(date +%Y%m%d-%H%M%S).db
ls -lh backups | tail
Pause / resume bota
Pavziranje bota ne ustavi containerja; spremeni samo stanje v aplikaciji in pošlje Telegram obvestilo.
cd /srv/kraken-telegram-sim
docker compose run --rm -e PYTHONPATH=/app/app kraken-sim-worker python - <<'PY'
from trading_core import set_bot_enabled, send_telegram_message, log_bot
set_bot_enabled(False)
msg = "⏸️ Kraken Simulator pavziran ročno."
log_bot(msg)
send_telegram_message(msg)
print(msg)
PY
cd /srv/kraken-telegram-sim
docker compose run --rm -e PYTHONPATH=/app/app kraken-sim-worker python - <<'PY'
from trading_core import set_bot_enabled, send_telegram_message, log_bot
set_bot_enabled(True)
msg = "▶️ Kraken Simulator ponovno vklopljen ročno."
log_bot(msg)
send_telegram_message(msg)
print(msg)
PY
Kaj spremljati
- V portalu: AUTO Performance / GO-NO-GO, signal engine, graf vrednosti portfelja, dnevnik odločitev, zgodovino simuliranih tradeov in odprte pozicije.
- V Telegramu: AUTO BUY, AUTO SELL, dnevno poročilo in error obvestila.
Operativna opomba
Strategy v3.2 naj zdaj teče vsaj 24–48 ur ali do prvega Telegram BUY/SELL obvestila.
Ne spreminjaj dodatnih pravil, dokler ni dovolj podatkov za oceno. Produkcija z realnim denarjem je trenutno NO-GO.
Sistemski update / reboot 2026-05-13
Po posodobitvi paketov z apt upgrade je bil izveden reboot za nov kernel 6.8.0-111-generic.
Pred rebootom je bil narejen snapshot stanja containerjev in Caddy portov. Po rebootu je bilo preverjeno:
ni več pending updateov, /var/run/reboot-required ne obstaja, zombie procesov ni več, Docker je aktiven,
Caddy posluša na 80/443/2019, ključni HTTP endpointi so odzivni, container healthchecki pa so se po nekaj minutah stabilizirali.
uname -r
sudo apt update
apt list --upgradable
test -f /var/run/reboot-required && cat /var/run/reboot-required.pkgs || echo "No reboot required"
ps -eo stat,pid,ppid,etime,cmd | awk '$1 ~ /^Z/ {print}'
systemctl is-active docker
sudo docker ps
sudo ss -ltnp '( sport = :80 or sport = :443 or sport = :2019 )'
Caddy / Tailscale Serve opomba
Če Caddy po updateu javi listen tcp :443: bind: address already in use, preveri, ali port 443 drži tailscaled.
To se lahko zgodi, če je aktiven Tailscale Serve/Funnel. Rešitev je resetirati samo Tailscale Serve/Funnel konfiguracijo, ne celotnega Tailscale VPN-ja, nato ponovno zagnati Caddy.
sudo ss -ltnp '( sport = :80 or sport = :443 or sport = :2019 )'
sudo tailscale serve status
sudo tailscale funnel status
# po potrebi reset samo serve/funnel konfiguracije, nato:
sudo docker restart caddy
Hitri pregled stanja
df -h
free -h
swapon --show
grep '^/swapfile ' /etc/fstab
sudo du -sh /srv/* 2>/dev/null | sort -h
sudo docker ps
sudo docker system df
sudo journalctl -p warning --since today
sudo docker stats --no-stream
Preverjanje Caddy domen
sudo grep -nE "^[a-zA-Z0-9.-]+\.nemac\.si[[:space:]]*\{" /srv/caddy/Caddyfile
Preverjanje compose datotek
sudo find /srv -maxdepth 4 \( -name "docker-compose.yml" -o -name "compose.yml" -o -name "docker-compose.yaml" \) -print
Posodobitev Docker aplikacije
cd /srv/IME_STORITVE
sudo docker compose pull
sudo docker compose up -d
sudo docker logs IME_CONTAINERJA --tail 100
Ne delaj brez razloga
- Ne briši map v
/srv, če ni jasno, kateri servis jih uporablja.
- Ne briši Docker volume/data map brez backupov.
- Ne izpostavljaj dodatnih portov na javni IP, če lahko uporabiš Caddy ali Tailscale.
- Ne commitaj skrivnosti v Giteo.