cojedzie: Per-image versions, replace cron with scheduler worker

- Split cojedzie_version into front/api/worker versions so CI can pin each by digest
- Replace the cron service with a worker consuming the scheduler queues
- Pull images from registry.kadet.net, fall back to latest on full runs
- Drop pinned serverVersion from DATABASE_URL

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

services/cojedzie/stack.yml

@@ -1,8 +1,19 @@
 version: "{{ compose_version }}"
 
+x-defaults: 
+  worker: &worker
+    image: {{ cojedzie_image_base }}/worker:{{ cojedzie_worker_version }}
+    env_file:
+      - ./api.env
+      - ./sentry.env
+    volumes:
+      - db_data:/var/db
+    depends_on:
+      - api
+
 services:
   api:
-    image: {{ cojedzie_image_base }}/api:{{ cojedzie_version }}
+    image: {{ cojedzie_image_base }}/api:{{ cojedzie_api_version }}
     networks:
       - "{{ ingress_network }}"
       - default
@@ -27,25 +38,14 @@ services:
         - traefik.http.routers.{{ service }}-api.tls.certresolver=lets-encrypt
         - traefik.http.services.{{ service }}-api.loadbalancer.server.port=8080
 
-  cron:
-    image: {{ cojedzie_image_base }}/cron:{{ cojedzie_version }}
-    env_file:
-      - ./api.env
-      - ./sentry.env
-    volumes:
-      - db_data:/var/db
-    depends_on:
-      - api
+  schedule:
+    <<: *worker
+    environment:
+      COJEDZIE_WORKER_OPTS: '-vv'
+      COJEDZIE_WORKER_QUEUES: 'scheduler_default scheduler_hub'
 
   worker:
-    image: {{ cojedzie_image_base }}/worker:{{ cojedzie_version }}
-    env_file:
-      - ./api.env
-      - ./sentry.env
-    volumes:
-      - db_data:/var/db
-    depends_on:
-      - api
+    <<: *worker
 
   mercure:
     image: dunglas/mercure:{{ cojedzie_mercure_version|default('latest') }}
@@ -71,7 +71,7 @@ services:
         - traefik.http.services.{{ service }}-mercure.loadbalancer.server.port=80
 
   front:
-    image: {{ cojedzie_image_base }}/front:{{ cojedzie_version }}
+    image: {{ cojedzie_image_base }}/front:{{ cojedzie_front_version }}
     networks:
       - "{{ ingress_network }}"
       - default

services/cojedzie/tasks/pre-deploy.yaml

@@ -6,10 +6,9 @@
     source: pull
     force_source: yes
   with_items:
-    - "{{ cojedzie_image_base }}/front:{{ cojedzie_version }}"
-    - "{{ cojedzie_image_base }}/api:{{ cojedzie_version }}"
-    - "{{ cojedzie_image_base }}/worker:{{ cojedzie_version }}"
-    - "{{ cojedzie_image_base }}/cron:{{ cojedzie_version }}"
+    - "{{ cojedzie_image_base }}/front:{{ cojedzie_front_version }}"
+    - "{{ cojedzie_image_base }}/api:{{ cojedzie_api_version }}"
+    - "{{ cojedzie_image_base }}/worker:{{ cojedzie_worker_version }}"
   loop_control:
     loop_var: image
   notify:

services/cojedzie/templates/api.env

@@ -2,7 +2,7 @@ MERCURE_URL=http://mercure/.well-known/mercure
 MERCURE_PUBLIC_URL=https://{{ cojedzie_domain }}/.well-known/mercure
 MERCURE_JWT_SECRET={{ cojedzie_mercure_jwt_key }}
 
-DATABASE_URL=mysql://{{ cojedzie_database.user }}:{{ cojedzie_database.password }}@{{ database_mysql_host }}/{{ cojedzie_database.name }}?serverVersion=mariadb-10.7.1
+DATABASE_URL=mysql://{{ cojedzie_database.user }}:{{ cojedzie_database.password }}@{{ database_mysql_host }}/{{ cojedzie_database.name }}
 
 SENTRY_DSN={{ sentry_dsn_api }}
 SENTRY_SAMPLE_RATE={{ sentry_sample_rate_api }}

services/cojedzie/vars/main.yml

@@ -13,6 +13,9 @@ cojedzie_mercure_jwt_key: !vault |
 cojedzie_maptiler: 8GX5FRUNgk4lB83GZT8Q
 cojedzie_image_base: docker.io/cojedzie
 cojedzie_version: latest
+cojedzie_front_version: "{{ cojedzie_version }}"
+cojedzie_api_version: "{{ cojedzie_version }}"
+cojedzie_worker_version: "{{ cojedzie_version }}"
 sentry_dsn_api: https://fd114053dd724e0eb16011ac0da16ba1@o4505224124891136.ingest.sentry.io/4505224126332928
 sentry_dsn_front: https://2815d4e0251240fcb9cd8c81c31e86fe@o4505224124891136.ingest.sentry.io/4505224128233472
 sentry_sample_rate_api: 0.05

services/registry/config/config.yml

@@ -11,7 +11,7 @@ storage:
   {{ registry_storage|to_nice_yaml(indent=2, width=140)|indent(2) }}
 
 redis:
-  addr: redis:6379
+  addrs: [redis:6379]
 
 http:
   addr: :5000

services/registry/stack.yml

@@ -9,20 +9,28 @@ services:
           memory: 256M
 
   registry:
-    image: registry:2
+    image: registry:3.0.0
     secrets:
       - source: htpasswd_{{ registry_htpasswd.stat.checksum }}
         target: /etc/docker/registry/htpasswd
     configs:
       - source: registry_{{ registry_config.checksum }}
-        target: /etc/docker/registry/config.yml
+        target: /etc/distribution/config.yml
     environment:
       - REGISTRY_STORAGE_DELETE_ENABLED=true
     deploy:
       placement:
         constraints:
           - node.role == manager
-    networks: ['default']
+      labels:
+        - traefik.enable=true
+        - traefik.http.routers.{{ service }}-api.rule=Host(`{{ service }}.{{ main_domain }}`) && PathPrefix(`/v2`)
+        - traefik.http.routers.{{ service }}-api.priority=100
+        - traefik.http.routers.{{ service }}-api.tls=true
+        - traefik.http.routers.{{ service }}-api.tls.certresolver=lets-encrypt
+        - traefik.http.routers.{{ service }}-api.service={{ service }}-api
+        - traefik.http.services.{{ service }}-api.loadbalancer.server.port=5000
+    networks: ['{{ ingress_network }}', 'default']
 
   ui:
     image: joxit/docker-registry-ui:2.5.6
@@ -42,14 +50,14 @@ services:
     networks: ['{{ ingress_network }}', 'default']
 
   image-cleanup-job:
-    image: registry:2
-    command: ["registry", "garbage-collect", "/etc/docker/registry/config.yml", "-m"]
+    image: registry:3.0.0
+    command: ["registry", "garbage-collect", "/etc/distribution/config.yml", "-m"]
     secrets:
       - source: htpasswd_{{ registry_htpasswd.stat.checksum }}
         target: /etc/docker/registry/htpasswd
     configs:
       - source: registry_{{ registry_config.checksum }}
-        target: /etc/docker/registry/config.yml
+        target: /etc/distribution/config.yml
     deploy:
       placement:
         constraints:

services/registry/tasks/config.yml

@@ -7,16 +7,17 @@
   tags:
     - config
 
+# Registry checks the bcrypt hash on every request, so a low cost keeps it fast.
+# Salt is derived from the user name to keep the file stable between runs.
 - name: 'Generate passwords file for "{{ service }}"'
-  community.general.htpasswd:
-    path: "{{ remote_service_path }}/config/htpasswd"
-    name: "{{ registry_user.name }}"
-    crypt_scheme: bcrypt
-    password: "{{ registry_user.password }}"
-  loop: "{{ registry_users }}"
-  loop_control:
-    loop_var: registry_user
-    label: "{{ registry_user.name }}"
+  ansible.builtin.copy:
+    dest: "{{ remote_service_path }}/config/htpasswd"
+    content: |
+      {% for registry_user in registry_users %}
+      {{ registry_user.name }}:{{ registry_user.password | password_hash('bcrypt', salt=((service ~ ':' ~ registry_user.name) | hash('sha256'))[:22], rounds=registry_bcrypt_rounds) }}
+      {% endfor %}
+    mode: "0600"
+  no_log: true
   tags:
     - config
 

services/registry/vars/main.yml

@@ -0,0 +1,2 @@
+---
+registry_bcrypt_rounds: 5

vars/services.yml

@@ -180,7 +180,10 @@ service_config:
       62643132313336356365313465353263626565616434633963343764653330316566613633633638
       623838613832393239343036396439383561
   cojedzie:
-    cojedzie_version: "2023.1.5"
+    # releases are deployed by CI pinned by digest, see the Release workflow in cojedzie/cojedzie;
+    # full playbook runs fall back to the latest release
+    cojedzie_version: latest
+    cojedzie_image_base: registry.kadet.net/cojedzie
     cojedzie_gtm: GTM-TQNX386
 
     cojedzie_database: