From 64850995ecda9f2fdefad913ac6209f667427af8 Mon Sep 17 00:00:00 2001
From: Bastian de Byl <bastian@debyl.io>
Date: Tue, 22 Sep 2026 11:06:31 -0400
Subject: [PATCH] chore(gitea): bump git.debyl.io to 1.27.3, pin the two
 instances separately

1.26.1 -> 1.27.3 picks up the security fixes in 1.27.0 through 1.27.3.
The image was one shared variable, so the two instances could only move
together; split it into gitea_debyl_image / gitea_skudak_image and tag
the debyl tasks gitea-debyl so each can be upgraded and verified on its
own. Skudak stays on 1.26.1 in this commit.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
---
 ansible/roles/git/defaults/main.yml      |  4 +++-
 ansible/roles/git/tasks/gitea-skudak.yml |  2 +-
 ansible/roles/git/tasks/gitea.yml        | 12 ++++++------
 3 files changed, 10 insertions(+), 8 deletions(-)

diff --git a/ansible/roles/git/defaults/main.yml b/ansible/roles/git/defaults/main.yml
index ac7f150..daa005d 100644
--- a/ansible/roles/git/defaults/main.yml
+++ b/ansible/roles/git/defaults/main.yml
@@ -4,9 +4,11 @@ git_home: "/srv/{{ git_user }}"
 
 # Gitea configuration
 gitea_debyl_server_name: git.debyl.io
-gitea_image: docker.gitea.com/gitea:1.26.1
+# Pinned per instance so one can be upgraded (and verified) before the other.
+gitea_debyl_image: docker.gitea.com/gitea:1.27.3
 gitea_db_image: docker.io/library/postgres:14-alpine
 
 # Skudak Gitea configuration
 gitea_skudak_server_name: git.skudak.com
 gitea_skudak_ssh_port: 2222
+gitea_skudak_image: docker.gitea.com/gitea:1.26.1
diff --git a/ansible/roles/git/tasks/gitea-skudak.yml b/ansible/roles/git/tasks/gitea-skudak.yml
index ce4b174..827f6c9 100644
--- a/ansible/roles/git/tasks/gitea-skudak.yml
+++ b/ansible/roles/git/tasks/gitea-skudak.yml
@@ -43,7 +43,7 @@
   become_user: "{{ git_user }}"
   containers.podman.podman_container:
     name: gitea-skudak
-    image: "{{ gitea_image }}"
+    image: "{{ gitea_skudak_image }}"
     pod: gitea-skudak-pod
     restart_policy: on-failure:3
     log_driver: journald
diff --git a/ansible/roles/git/tasks/gitea.yml b/ansible/roles/git/tasks/gitea.yml
index b0cc991..094d80c 100644
--- a/ansible/roles/git/tasks/gitea.yml
+++ b/ansible/roles/git/tasks/gitea.yml
@@ -10,7 +10,7 @@
     state: started
     ports:
       - "3100:3000"
-  tags: gitea
+  tags: gitea, gitea-debyl
 
 # PostgreSQL container in pod
 - name: create gitea-debyl-postgres container
@@ -28,7 +28,7 @@
       POSTGRES_PASSWORD: "{{ gitea_debyl_db_pass }}"
     volumes:
       - "{{ git_home }}/volumes/gitea/psql:/var/lib/postgresql/data"
-  tags: gitea
+  tags: gitea, gitea-debyl
 
 # Gitea container in pod
 - name: create gitea-debyl container
@@ -36,7 +36,7 @@
   become_user: "{{ git_user }}"
   containers.podman.podman_container:
     name: gitea-debyl
-    image: "{{ gitea_image }}"
+    image: "{{ gitea_debyl_image }}"
     pod: gitea-debyl-pod
     restart_policy: on-failure:3
     log_driver: journald
@@ -66,7 +66,7 @@
     volumes:
       - "{{ git_home }}/volumes/gitea/data:/data"
       - /etc/localtime:/etc/localtime:ro
-  tags: gitea
+  tags: gitea, gitea-debyl
 
 # Generate systemd service for the pod
 - name: create systemd job for gitea-debyl-pod
@@ -80,7 +80,7 @@
   args:
     chdir: "{{ git_home }}"
   changed_when: false
-  tags: gitea
+  tags: gitea, gitea-debyl
 
 - name: enable gitea-debyl-pod service
   become: true
@@ -91,4 +91,4 @@
     enabled: true
     state: started
     scope: user
-  tags: gitea
+  tags: gitea, gitea-debyl