ca266e9391
"Up to date" answers one question — has the tag I track moved? — and an abandoned project answers it reassuringly forever. The tag stays put, the digest never changes, and the app reports as current while receiving no security patches at all. Nothing in the UI could tell a healthy stable app from a dead one. An audit of all 34 anchor images found five in exactly that state: speedtest (4.4y since rebuild), focalboard (2.8y — Mattermost dropped support in 2023), pihole-unbound (2.3y), trilium (2.2y), unbound (1.8y). The scan now records image_updated_at per app (one cheap Hub call inside the existing registry window, cached between windows like everything else) and emits stale_after_days from CFG_UPDATER_STALE_DAYS (365, 0 disables) so the UI and the config agree on one number. Surfaced as an "unmaintained?" severity chip on the fleet row and a dated explanation in the app detail. Phrased as an observation rather than an accusation — plenty of small tools are simply finished — but it does spell out the security consequence, because that is the part a user cannot infer from "up to date". Deliberately NOT a "needs action" row on the Overview board: it is not fixable by pressing anything, and a permanently amber board teaches people to ignore the board. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
12 lines
2.3 KiB
Plaintext
12 lines
2.3 KiB
Plaintext
# ================================================================================
|
|
# WebUI Updater - Automatic app update, CVE & improvement scanning **ADVANCED**
|
|
# @icon 🔄
|
|
# ================================================================================
|
|
CFG_UPDATER_SCAN_INTERVAL=30 # App Scan Interval - Minutes between automatic app update/CVE/improvement scans. 0 disables.
|
|
CFG_UPDATER_REGISTRY_INTERVAL=360 # Registry Check Interval - Minutes between registry lookups for new image builds (the expensive step; the local scan still refreshes every scan). 0 = only when you press Check now.
|
|
CFG_HOTFIX_AUTO=security-breakage # Hotfix Auto-Apply - Which signed hotfix severities apply automatically on the update check [security-breakage|all|off]
|
|
CFG_UPDATER_AUTO=true # Automatic App Updates - Master switch for per-app automatic updates. Each app's own Update Type decides individually; turning this off makes every app manual. Every update snapshots the app first and rolls back on failure. [true:On|false:Off]
|
|
CFG_UPDATER_STALE_DAYS=365 # Unmaintained Warning After - Days without an upstream rebuild before an app is flagged as possibly unmaintained. "Up to date" only means the version you track has not moved — if nobody has rebuilt that image in a year, it has had no security patches either, and nothing else would tell you. 0 disables the warning.
|
|
CFG_UPDATER_UPGRADE_PRUNE=true # Clean Up After Version Upgrades - After a successful stepped upgrade (e.g. Nextcloud 31→34), delete the images it stepped through. Each one can be well over a gigabyte and nothing else removes them, since every step is a real tag rather than a dangling image. The version immediately before the current one is always kept so a roll-back needs no download. [true:On|false:Off]
|
|
CFG_UPDATER_WINDOW=06:00-08:00 # Automatic Update Window - When automatic updates are allowed to install, in the host's local time (HH:MM-HH:MM; crosses midnight when start > end; 'always' = any time). Checks still run all day so the Updates page stays current — found updates simply wait for the window. Pressing Update yourself always works.
|