fix(edu): deploy reviewed application release with Redis authentication

Reviewed-on: #96

.gitea/tests/deploy-validation.sh

@@ -73,6 +73,20 @@ fi
 grep -q 'MISSING OR UNREADABLE: app/credentials' "$scratch/secrets.log"
 # API/rendering errors must not produce an empty reference list and pass.
 kubectl() { return 1; }
+if ! skip_uninstalled_vmagent_crd "$REPO/prometheus-stack/k8s/vmagent.yaml"; then
+  echo 'VMAgent preflight did not skip an uninstalled CRD' >&2
+  exit 1
+fi
+kubectl() { return 0; }
+if skip_uninstalled_vmagent_crd "$REPO/prometheus-stack/k8s/vmagent.yaml"; then
+  echo 'VMAgent preflight skipped an installed CRD' >&2
+  exit 1
+fi
+if skip_uninstalled_vmagent_crd "$REPO/prometheus-stack/k8s/victoria.yaml"; then
+  echo 'VMAgent preflight skipped an unrelated manifest' >&2
+  exit 1
+fi
+kubectl() { return 1; }
 if check_referenced_secrets >"$scratch/secrets.log"; then
   echo 'Secret check accepted a failed manifest render' >&2
   exit 1

.gitea/workflows/ci.yaml

@@ -338,11 +338,20 @@ jobs:
       - name: Detect changed docker-built services
         id: services
         shell: bash
+        env:
+          PUSH_BEFORE: ${{ github.event.before }}
         run: |
           set -euo pipefail
-          base="${{ github.event.before }}"
-          if [ -z "$base" ] || [ "$base" = "0000000000000000000000000000000000000000" ]; then
-            base="$(git rev-list --max-parents=0 HEAD)"
+          base="${PUSH_BEFORE:-}"
+          empty_tree="$(git hash-object -t tree /dev/null)"
+          if [[ "$base" =~ ^0{40}$ ]]; then
+            base="$empty_tree"
+          elif [[ ! "$base" =~ ^[0-9a-fA-F]{40}$ ]] || ! git cat-file -e "${base}^{commit}" 2>/dev/null; then
+            # Some Gitea push payloads expose `before` as multiple root commits
+            # joined by newlines. It is not a usable diff base; use this push's
+            # first parent so image changes in the current commit are still built.
+            base="$(git rev-parse "${GITHUB_SHA}^" 2>/dev/null || printf '%s' "$empty_tree")"
+            echo "::warning::invalid push-before value; comparing against ${base}"
           fi
 
           # A failed diff used to leave changed_files empty, which reads exactly
@@ -378,9 +387,6 @@ jobs:
               homepages/*)
                 add_service homepages
                 ;;
-              edu_master/phpsessid-bot/*|edu_master/webinar-checker/*|edu_master/compose.yaml)
-                add_service edu_master
-                ;;
             esac
           done
 
@@ -487,32 +493,6 @@ jobs:
                   done
                 done
                 ;;
-              edu_master)
-                for variant in session-keeper webinar-checker; do
-                  case "$variant" in
-                    session-keeper)
-                      context="edu_master/phpsessid-bot"
-                      image="${REGISTRY}/forust/session-keeper"
-                      ;;
-                    webinar-checker)
-                      context="edu_master/webinar-checker"
-                      image="${REGISTRY}/forust/webinar-checker"
-                      ;;
-                  esac
-                  set_tags
-                  build_args=()
-                  for tag in "${tags[@]}"; do
-                    build_args+=(-t "${image}:${tag}")
-                  done
-                  docker build \
-                    --cache-from "type=registry,ref=${image}:buildcache" \
-                    --cache-to "type=registry,ref=${image}:buildcache,mode=max" \
-                    "${build_args[@]}" "$context"
-                  for tag in "${tags[@]}"; do
-                    docker push "${image}:${tag}"
-                  done
-                done
-                ;;
             esac
           done
 
@@ -543,6 +523,11 @@ jobs:
           fi
           echo "pinning ${#repos[@]} image(s) to $commit_tag"
           for repo in "${repos[@]}"; do
+            # EDU images are released by the application repository and pinned
+            # directly by digest in edu_master manifests. Never retag them here.
+            case "$repo" in
+              */session-keeper|*/webinar-checker) continue ;;
+            esac
             if docker buildx imagetools inspect "$repo:$commit_tag" >/dev/null 2>&1; then
               echo "  already built by this push: ${repo##*/}"
               continue

.gitea/workflows/deploy-lib.sh

@@ -705,6 +705,9 @@ check_referenced_secrets() {
   local missing=()
   refs=""
   for m in ${K8S_MANIFESTS[@]+"${K8S_MANIFESTS[@]}"}; do
+    if skip_uninstalled_vmagent_crd "$m"; then
+      continue
+    fi
     objects="$(kubectl create --dry-run=client --validate=false -f "$m" -o json)" || return 1
     extracted="$(printf '%s' "$objects" | jq -r -f "$REPO/.gitea/workflows/secret-references.jq")" || return 1
     refs+="$extracted"$'\n'
@@ -731,6 +734,18 @@ check_referenced_secrets() {
   fi
 }
 
+# The VMAgent CRD is installed by the VictoriaMetrics Operator Helm release in
+# stage_apply_k8s, after this preflight stage. Skip only its dry-run until then.
+skip_uninstalled_vmagent_crd() {
+  local manifest="$1"
+  if [[ "$manifest" == "$REPO/prometheus-stack/k8s/vmagent.yaml" ]] \
+    && ! kubectl get crd vmagents.operator.victoriametrics.com >/dev/null 2>&1; then
+    echo "  skip: VMAgent CRD is installed by Helm during apply: ${manifest#"$REPO"/}"
+    return 0
+  fi
+  return 1
+}
+
 stage_validate() {
   check_prune_mode || return 1
   cd "$REPO"
@@ -748,6 +763,9 @@ stage_validate() {
   done
   log "Validate k8s manifests (kubectl dry-run=client)"
   for m in ${K8S_MANIFESTS[@]+"${K8S_MANIFESTS[@]}"}; do
+    if skip_uninstalled_vmagent_crd "$m"; then
+      continue
+    fi
     kubectl apply --dry-run=client -f "$m" >/dev/null
   done
   for k in ${KUSTOMIZE_APPS[@]+"${KUSTOMIZE_APPS[@]}"}; do
@@ -755,6 +773,9 @@ stage_validate() {
   done
   log "Validate k8s manifests (kubectl dry-run=server)"
   for m in ${K8S_MANIFESTS[@]+"${K8S_MANIFESTS[@]}"}; do
+    if skip_uninstalled_vmagent_crd "$m"; then
+      continue
+    fi
     kubectl apply --dry-run=server -f "$m" >/dev/null
   done
   for k in ${KUSTOMIZE_APPS[@]+"${KUSTOMIZE_APPS[@]}"}; do

edu_master/README.md

@@ -0,0 +1,14 @@
+# EDU deployment ownership
+
+Application source and release builds: `forust/edu-master`.
+The homelab pipeline deploys `edu_master/k8s` and preserves explicit image digests.
+The application copies in this directory are legacy and are not build inputs.
+Do not publish EDU `prod` images from homelab or resolve releases from moving tags.
+
+For an EDU release, validate both images, select their digests in the keeper and
+checker manifests, and run the existing homelab validation/apply/verification
+helpers against this service. Keep the existing Secret and Redis PVC.
+Coordinate Redis authentication changes with both clients and all init/probes;
+keep a pre-rollout Redis backup and both previous compatible image references.
+The current HTTP checker does not depend on Playwright; check other consumers
+before removing the separate browser service.

edu_master/k8s/alerts.yaml

@@ -50,7 +50,36 @@ spec:
             severity: critical
           annotations:
             summary: "Webinar checker failing consecutively"
-            description: 'edu-master/webinar-checker: {{ $value }} consecutive webinar check failures (timeout / playwright error / page error). Check pod logs (Loki: {namespace="edu-master", container="webinar-checker"}).'
+            description: 'edu-master/webinar-checker: {{ $value }} consecutive webinar check failures (timeout / http error / page error). Check pod logs (Loki: {namespace="edu-master", container="webinar-checker"}).'
+
+        - alert: WebinarCheckerNeverStarted
+          expr: |
+            (time() - edu_process_start > 120)
+              and (webinar_check_last_run_timestamp_seconds == 0)
+          for: 2m
+          labels:
+            severity: critical
+          annotations:
+            summary: "Webinar checker job has not started"
+            description: "The process exposes metrics but its webinar job has never started."
+
+        - alert: WebinarDeliveryPending
+          expr: edu_delivery_pending > 0
+          for: 5m
+          labels:
+            severity: warning
+          annotations:
+            summary: "Webinar notifications await delivery"
+            description: "Telegram delivery has pending recipients. Check delivery failures and retry status."
+
+        - alert: EduRedisUnavailable
+          expr: edu_redis_connected == 0
+          for: 2m
+          labels:
+            severity: critical
+          annotations:
+            summary: "EDU checker cannot reach Redis"
+            description: "Redis health checks are failing; checker commands and delivery may be unavailable."
 
         # Metrics endpoint not scraped for 10m: pod down, metrics server dead, or ServiceMonitor broken.
         - alert: WebinarCheckerScrapeDown
@@ -74,7 +103,7 @@ spec:
             summary: "EDU_PHPSESSID missing"
             description: "edu-master: EDU_PHPSESSID absent from redis for 10m. Webinar/diari/schedule checks are all skipped. Check session-keeper logs and EDU credentials."
 
-        # Hard deps: checker and playwright deployments unavailable.
+        # Hard deps: checker deployment unavailable.
         - alert: WebinarCheckerDeploymentDown
           expr: |
             kube_deployment_status_replicas_unavailable{deployment="webinar-checker", namespace="edu-master"} > 0
@@ -84,13 +113,3 @@ spec:
           annotations:
             summary: "Webinar checker deployment unavailable"
             description: "edu-master/webinar-checker deployment has {{ $value }} unavailable replica(s) for 10m."
-
-        - alert: PlaywrightServiceDown
-          expr: |
-            kube_deployment_status_replicas_unavailable{deployment="playwright-service", namespace="edu-master"} > 0
-          for: 10m
-          labels:
-            severity: critical
-          annotations:
-            summary: "Playwright service unavailable"
-            description: "edu-master/playwright-service deployment has {{ $value }} unavailable replica(s) for 10m. All webinar/diari/schedule checks fail without it."

edu_master/k8s/redis-networkpolicy.yaml

@@ -0,0 +1,22 @@
+apiVersion: networking.k8s.io/v1
+kind: NetworkPolicy
+metadata:
+  name: redis-clients-only
+  namespace: edu-master
+spec:
+  podSelector:
+    matchLabels:
+      app: edu-master-redis
+  policyTypes:
+    - Ingress
+  ingress:
+    - from:
+        - podSelector:
+            matchLabels:
+              app: edu-master-session-keeper
+        - podSelector:
+            matchLabels:
+              app: edu-master-webinar-checker
+      ports:
+        - protocol: TCP
+          port: 6379

edu_master/k8s/redis.yaml

@@ -20,6 +20,27 @@ spec:
         - name: redis
           image: redis:8.10.2-alpine
           imagePullPolicy: IfNotPresent
+          env:
+            - name: REDIS_PASSWORD
+              valueFrom:
+                secretKeyRef:
+                  name: edu-master-secrets
+                  key: REDIS_PASSWORD
+            - name: REDISCLI_AUTH
+              valueFrom:
+                secretKeyRef:
+                  name: edu-master-secrets
+                  key: REDIS_PASSWORD
+          command:
+            - /bin/sh
+            - -ec
+            - |
+              case "$REDIS_PASSWORD" in *[!0-9a-fA-F]*|'') echo 'REDIS_PASSWORD must be 64 hex characters' >&2; exit 1;; esac
+              [ "${#REDIS_PASSWORD}" -eq 64 ] || { echo 'REDIS_PASSWORD must be 64 hex characters' >&2; exit 1; }
+              umask 077
+              printf 'requirepass "%s"\n' "$REDIS_PASSWORD" > /tmp/redis-auth.conf
+              chown redis:redis /tmp/redis-auth.conf
+              exec docker-entrypoint.sh redis-server /tmp/redis-auth.conf
           ports:
             - containerPort: 6379
           volumeMounts:

edu_master/k8s/session-keeper.yaml

@@ -16,12 +16,20 @@ spec:
     type: Recreate
   template:
     metadata:
+      annotations:
+        edu.forust.xyz/source-commit: "90829d6c8080b9928f9da23587678e640939e10a"
       labels:
         app: edu-master-session-keeper
     spec:
       initContainers:
         - name: wait-redis
           image: redis:8.10.2-alpine
+          env:
+            - name: REDISCLI_AUTH
+              valueFrom:
+                secretKeyRef:
+                  name: edu-master-secrets
+                  key: REDIS_PASSWORD
           command:
             - /bin/sh
             - -ec
@@ -35,10 +43,16 @@ spec:
               echo "redis is ready"
       containers:
         - name: session-keeper
-          image: gcr.forust.xyz/forust/session-keeper:prod
+          image: gcr.forust.xyz/forust/session-keeper@sha256:49285e87cc5bc4cf4ffe190813d87927916c2df8a206daac0aeb7d227c636450
           envFrom:
             - secretRef:
                 name: edu-master-secrets
+          env:
+            - name: REDISCLI_AUTH
+              valueFrom:
+                secretKeyRef:
+                  name: edu-master-secrets
+                  key: REDIS_PASSWORD
           resources:
             requests:
               cpu: 25m

edu_master/k8s/webinar-checker.yaml

@@ -16,14 +16,22 @@ spec:
     type: Recreate
   template:
     metadata:
+      annotations:
+        edu.forust.xyz/source-commit: "90829d6c8080b9928f9da23587678e640939e10a"
       labels:
         app: edu-master-webinar-checker
     spec:
       # Enforces dependency order like compose depends_on:
-      # redis healthy -> session-keeper healthy (EXISTS EDU_PHPSESSID) -> playwright started
+      # redis healthy -> session-keeper healthy (EXISTS EDU_PHPSESSID)
       initContainers:
         - name: wait-deps
           image: redis:8.10.2-alpine
+          env:
+            - name: REDISCLI_AUTH
+              valueFrom:
+                secretKeyRef:
+                  name: edu-master-secrets
+                  key: REDIS_PASSWORD
           command:
             - /bin/sh
             - -ec
@@ -41,15 +49,9 @@ spec:
                 sleep 2
               done
               echo "PHPSESSID ok"
-              until nc -z playwright-service 3000; do
-                i=$((i+1))
-                [ "$i" -ge 300 ] && echo "TIMEOUT: playwright-service not reachable" && exit 1
-                sleep 2
-              done
-              echo "playwright ok"
       containers:
         - name: webinar-checker
-          image: gcr.forust.xyz/forust/webinar-checker:prod
+          image: gcr.forust.xyz/forust/webinar-checker@sha256:66c146f7b43cb9f0dc31ba9aa36d217e01df42ddafba5971b79c12ec215b2c01
           ports:
             - name: metrics
               containerPort: 8000
@@ -62,6 +64,14 @@ spec:
             timeoutSeconds: 3
             failureThreshold: 12
             initialDelaySeconds: 10
+          livenessProbe:
+            httpGet:
+              path: /live
+              port: metrics
+            initialDelaySeconds: 60
+            periodSeconds: 15
+            timeoutSeconds: 3
+            failureThreshold: 4
           envFrom:
             - secretRef:
                 name: edu-master-secrets

prometheus-stack/k8s/grafana-values.yaml

@@ -60,6 +60,10 @@ grafana:
 
 prometheus:
   prometheusSpec:
+    # VM trial: vmagent scrapes and remote-writes to VictoriaMetrics, so the
+    # Prometheus server itself stands down. Encoded here (not a kubectl patch)
+    # so helm keeps owning spec.replicas and upgrades do not conflict on it.
+    replicas: 0
     retention: 60d
     retentionSize: 32GB
     storageSpec:

renovate/k8s/configmap.yaml

@@ -63,6 +63,15 @@ data:
           "depNameTemplate": "kube-prometheus-stack",
           "registryUrlTemplate": "https://prometheus-community.github.io/helm-charts"
         },
+        {
+          "customType": "regex",
+          "description": "VictoriaMetrics Operator chart version pinned in the deploy workflow",
+          "managerFilePatterns": [".gitea/workflows/deploy-lib.sh"],
+          "matchStrings": ["\\|victoriametrics/victoria-metrics-operator\\|prometheus\\|(?<currentValue>[0-9.]+)\\|"],
+          "datasourceTemplate": "helm",
+          "depNameTemplate": "victoria-metrics-operator",
+          "registryUrlTemplate": "https://victoriametrics.github.io/helm-charts"
+        },
         {
           "customType": "regex",
           "description": "grafana/loki chart version pinned in the deploy workflow",

renovate/k8s/cronjob.yaml

@@ -19,7 +19,7 @@ spec:
           restartPolicy: Never
           containers:
             - name: renovate
-              image: renovate/renovate:44.139.0
+              image: renovate/renovate:44.140.0
               env:
                 - name: RENOVATE_PLATFORM
                   value: gitea

streaming/compose.yaml

@@ -19,7 +19,7 @@ services:
       - streaming
 
   qbittorrent:
-    image: lscr.io/linuxserver/qbittorrent:5.2.4
+    image: lscr.io/linuxserver/qbittorrent:20.04.1
     container_name: qbittorrent
     restart: unless-stopped
     environment: