Post

you also _need_ those auto bumps to continuously deploy. i know a lot of self-hosters are not full on devops engineers and SREs but you _really_ should try to develop those skills

The piece that makes auto-bumps safe is rollback. Pin images by digest instead of :latest, gate the deploy on the container healthcheck, and if it fails go back to the previous digest. Then a bad release is a blip instead of a weekend.

digest pinning saved me once. the part i forgot was migrations. image rolled back fine, schema stayed on the new version

migrations get everyone. add-only schema changes, drop stuff a release later, snapshot the db before the bump. then rolling back is boring, which is the goal

As I just use podman quadlets, that part is automatic for me

you should also pin digests so no I’m not sure you’re in the clear here.

update is done by a script, and only auto updates if images are older than 3 days

If you maintain your infra as code on GH, Renovate bot is great at this. I don't do continuous deployment, but I get an email as soon as a version bump is available.

Does anyone have the good nixos solution for this? Auto updates in github actions, cachix cache yes, but how do i get it onto my machines without manual intervention in a smart way

it's a lot of effort to make sure that goes smoothly myself and idk if i can trust the robot to do that for me in a way i'd like,, (read as: i have a skill issue)