Docker Swarm configs are IMMUTABLE — only labels can be updated. The config is
named ${STACK_NAME}_app_ini_${APP_INI_VERSION}, so when app.ini.tmpl's rendered
content changes the version suffix MUST be bumped, otherwise abra tries to mutate
the existing object and the deploy aborts:
FATA failed to update config <stack>_app_ini_v22: Error response from daemon:
rpc error: code = InvalidArgument desc = only updates to Labels are allowed
'BREAKING CHANGE: remove forgejo' (6a0339d) edited app.ini.tmpl —
-{{ if or (eq (env "FORGE") "forgejo") (eq (env "GITEA_LFS_START_SERVER") "true") }}
+{{ if (eq (env "GITEA_LFS_START_SERVER") "true") }}
— but left APP_INI_VERSION at v22 (unchanged since the LFS commit 357926f), and
3.6.2+1.27.1-rootless shipped that way. Every existing deployment upgrading ACROSS
the forgejo removal therefore fails at 'initialising deployment'; reproduced on a
live 3.6.1+1.26.2-rootless -> 3.6.2+1.27.1-rootless upgrade.
Bumping to v23 makes Swarm create a NEW config object instead of mutating v22. The
orphaned v22 object can be pruned after the rollout. Only app.ini.tmpl changed, so
DOCKER_SETUP_SH_VERSION and PG_BACKUP_VERSION stay put.
Note: cc-ci's upgrade tier did not catch this because it resolved the upgrade base
to main-tip, which ALREADY contains the forgejo removal — base and head then render
identical app.ini and no config update is attempted. Real deployments upgrade from
the last published RELEASE (3.6.1+1.26.2), which is where the break appears.
Add an opt-in compose.lfs.yml that mounts the lfs_jwt_secret secret and
enables GITEA_LFS_START_SERVER for plain gitea (forgejo already bundles
LFS). Emit LFS_JWT_SECRET in app.ini whenever the LFS server is on so the
JWT secret is stable across redeploys instead of being regenerated on
every restart (app.ini is a read-only config mount).
Bump version 3.5.2 -> 3.6.0.
autonomic-bot
notplants
f
3wordchant
Moritz
decentral1se
cas
javielico
appletalk
decentral1se
3wc
Luke Murphy