fix(release): stabilize upstream pinning and align AIO package tags (#41)

* fix(template): expose remaining upstream runtime env options

* build(image): reduce runtime footprint and harden service startup

* fix(sync): pin stable upstream digest resolution

* ci(build): add explicit upstream and aio image labels

* build(tags): derive aio line tag from release revision

Author: JSONbored

.github/workflows/build.yml

@@ -296,10 +296,27 @@ jobs:
           sha_tag="${image}:sha-${GITHUB_SHA}"
           raw_version="$(sed -n 's/^ARG UPSTREAM_VERSION=//p' Dockerfile | head -n1)"
           upstream_version="${raw_version%%@*}"
-          aio_track="aio-v1"
+          upstream_digest="$(sed -n 's/^ARG UPSTREAM_IMAGE_DIGEST=//p' Dockerfile | head -n1)"
+          changelog_version="$(python3 scripts/release.py latest-changelog-version 2>/dev/null || true)"
+          aio_revision=""
+          case "${changelog_version}" in
+            "${upstream_version}"-aio.*)
+              candidate_revision="${changelog_version##*.}"
+              if [[ "${candidate_revision}" =~ ^[0-9]+$ ]]; then
+                aio_revision="${candidate_revision}"
+              fi
+              ;;
+          esac
+          if [[ -n "${aio_revision}" ]]; then
+            aio_track="aio-v${aio_revision}"
+          else
+            aio_track="aio-v1"
+          fi
 
           {
             echo "upstream_version=${upstream_version}"
+            echo "upstream_digest=${upstream_digest}"
+            echo "aio_track=${aio_track}"
             echo "tags<<EOF"
             echo "${image}:latest"
             if [[ -n "${upstream_version}" ]]; then
@@ -324,7 +341,13 @@ jobs:
             org.opencontainers.image.source=https://github.com/JSONbored/sure-aio
             org.opencontainers.image.title=sure-aio
             org.opencontainers.image.version=${{ steps.prep.outputs.upstream_version || '' }}
+            org.opencontainers.image.description=Unraid-first AIO wrapper image for Sure (web, worker, postgres, redis)
             io.jsonbored.upstream.name=Sure
+            io.jsonbored.upstream.version=${{ steps.prep.outputs.upstream_version || '' }}
+            io.jsonbored.upstream.digest=${{ steps.prep.outputs.upstream_digest || '' }}
+            io.jsonbored.wrapper.name=sure-aio
+            io.jsonbored.wrapper.type=unraid-aio
+            io.jsonbored.wrapper.track=aio-v1
           load: false
 
   sync-awesome-unraid:

.github/workflows/check-upstream.yml

@@ -36,47 +36,44 @@ jobs:
           chmod +x scripts/check-upstream.py
           ./scripts/check-upstream.py
 
-      - name: Stop if no stable version bump is available
-        if: ${{ steps.upstream.outputs.version_update_available != 'true' }}
+      - name: Stop if no stable upstream updates are available
+        if: ${{ steps.upstream.outputs.updates_available != 'true' }}
         run: |
-          echo "No newer stable upstream Sure tag is available."
-          if [[ "${{ steps.upstream.outputs.digest_update_available }}" == "true" ]]; then
-            echo "Digest-only drift detected; leave that to Renovate or manual dependency refresh."
-          fi
+          echo "No stable upstream version or digest updates are available."
 
       - name: Create update branch
-        if: ${{ steps.upstream.outputs.version_update_available == 'true' && steps.upstream.outputs.strategy == 'pr' }}
-        run: git checkout -B "codex/upstream-${{ steps.upstream.outputs.latest_version }}"
+        if: ${{ steps.upstream.outputs.updates_available == 'true' && steps.upstream.outputs.strategy == 'pr' }}
+        run: git checkout -B "${{ steps.upstream.outputs.branch_name }}"
 
       - name: Apply upstream version bump
-        if: ${{ steps.upstream.outputs.version_update_available == 'true' && steps.upstream.outputs.strategy == 'pr' }}
+        if: ${{ steps.upstream.outputs.updates_available == 'true' && steps.upstream.outputs.strategy == 'pr' }}
         env:
           WRITE_UPSTREAM_VERSION: "true"
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
         run: ./scripts/check-upstream.py
 
-      - name: Commit upstream version bump
-        if: ${{ steps.upstream.outputs.version_update_available == 'true' && steps.upstream.outputs.strategy == 'pr' }}
+      - name: Commit upstream update
+        if: ${{ steps.upstream.outputs.updates_available == 'true' && steps.upstream.outputs.strategy == 'pr' }}
         run: |
           git config user.name "github-actions[bot]"
           git config user.email "41898282+github-actions[bot]@users.noreply.github.com"
           git add Dockerfile
-          git commit -m "chore(sync): bump upstream sure to ${{ steps.upstream.outputs.latest_version }}"
+          git commit -m "${{ steps.upstream.outputs.pr_title }}"
 
       - name: Push update branch
-        if: ${{ steps.upstream.outputs.version_update_available == 'true' && steps.upstream.outputs.strategy == 'pr' }}
+        if: ${{ steps.upstream.outputs.updates_available == 'true' && steps.upstream.outputs.strategy == 'pr' }}
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-        run: git push --force --set-upstream origin "codex/upstream-${{ steps.upstream.outputs.latest_version }}"
+        run: git push --force --set-upstream origin "${{ steps.upstream.outputs.branch_name }}"
 
       - name: Open or update pull request
-        if: ${{ steps.upstream.outputs.version_update_available == 'true' && steps.upstream.outputs.strategy == 'pr' }}
+        if: ${{ steps.upstream.outputs.updates_available == 'true' && steps.upstream.outputs.strategy == 'pr' }}
         env:
           GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
         run: |
           body_file="$(mktemp)"
           cat > "${body_file}" <<EOF
-          Sure upstream has a newer stable version.
+          Sure upstream has stable updates available.
 
           - Current pinned upstream version: \`${{ steps.upstream.outputs.current_version }}\`
           - Latest upstream version: \`${{ steps.upstream.outputs.latest_version }}\`
@@ -87,15 +84,15 @@ jobs:
           This PR was opened automatically by the upstream monitor workflow.
           EOF
 
-          existing_pr="$(gh pr list --head "codex/upstream-${{ steps.upstream.outputs.latest_version }}" --base main --json number --jq '.[0].number')"
+          existing_pr="$(gh pr list --head "${{ steps.upstream.outputs.branch_name }}" --base main --json number --jq '.[0].number')"
           if [[ -n "${existing_pr}" ]]; then
             gh pr edit "${existing_pr}" \
-              --title "chore(sync): bump upstream sure to ${{ steps.upstream.outputs.latest_version }}" \
+              --title "${{ steps.upstream.outputs.pr_title }}" \
               --body-file "${body_file}"
           else
             gh pr create \
               --base main \
-              --head "codex/upstream-${{ steps.upstream.outputs.latest_version }}" \
-              --title "chore(sync): bump upstream sure to ${{ steps.upstream.outputs.latest_version }}" \
+              --head "${{ steps.upstream.outputs.branch_name }}" \
+              --title "${{ steps.upstream.outputs.pr_title }}" \
               --body-file "${body_file}"
           fi

Dockerfile

@@ -1,39 +1,48 @@
 # syntax=docker/dockerfile:1@sha256:2780b5c3bab67f1f76c781860de469442999ed1a0d7992a5efdf2cffc0e3d769
 
 ARG UPSTREAM_VERSION=v0.6.9
-ARG UPSTREAM_IMAGE_DIGEST=sha256:f415c4085489b4e154f2374786fd604b41ff11d3f56b6d1050fa28fa214f1130
+ARG UPSTREAM_IMAGE_DIGEST=sha256:3d899b3eced520d8d3166a3d53184cbb1356670fb52d050f94f8e62e59754d70
 ARG PGVECTOR_VERSION=0.8.2
 FROM ghcr.io/we-promise/sure@${UPSTREAM_IMAGE_DIGEST}
 
 ARG PGVECTOR_VERSION
 ARG S6_OVERLAY_VERSION=3.1.6.2
+ARG S6_OVERLAY_NOARCH_SHA256=05af2536ec4fb23f087a43ce305f8962512890d7c71572ed88852ab91d1434e3
+ARG S6_OVERLAY_AARCH64_SHA256=3fc0bae418a0e3811b3deeadfca9cc2f0869fb2f4787ab8a53f6944067d140ee
+ARG S6_OVERLAY_X86_64_SHA256=95081f11c56e5a351e9ccab4e70c2b1c3d7d056d82b72502b942762112c03d1c
 ARG TARGETARCH
 
 USER root
 
 # 1. Install prerequisites, s6-overlay, Redis, and pgvector support
 # We use standard PATH binaries for Postgres (it's installed as postgresql)
 RUN apt-get update && apt-get install -y --no-install-recommends \
-    build-essential ca-certificates curl git xz-utils sudo \
-    postgresql postgresql-client postgresql-server-dev-all redis-server && \
+    build-essential ca-certificates curl git xz-utils \
+    postgresql postgresql-client postgresql-server-dev-17 redis-server && \
     git clone --branch "v${PGVECTOR_VERSION}" --depth 1 https://github.com/pgvector/pgvector.git /tmp/pgvector && \
     make -C /tmp/pgvector OPTFLAGS="" && \
     make -C /tmp/pgvector install && \
-    apt-get purge -y --auto-remove build-essential git postgresql-server-dev-all && \
+    apt-get purge -y --auto-remove \
+      build-essential git postgresql-server-dev-17 \
+      clang-19 llvm-19 llvm-19-dev llvm-19-linker-tools llvm-19-runtime llvm-19-tools && \
     curl -L -o /tmp/s6-overlay-noarch.tar.xz https://github.com/just-containers/s6-overlay/releases/download/v${S6_OVERLAY_VERSION}/s6-overlay-noarch.tar.xz && \
+    echo "${S6_OVERLAY_NOARCH_SHA256}  /tmp/s6-overlay-noarch.tar.xz" | sha256sum -c - && \
     tar -C / -Jxpf /tmp/s6-overlay-noarch.tar.xz && \
     case "${TARGETARCH}" in \
-      amd64) s6_arch="x86_64" ;; \
-      arm64) s6_arch="aarch64" ;; \
+      amd64) s6_arch="x86_64"; s6_sha="${S6_OVERLAY_X86_64_SHA256}" ;; \
+      arm64) s6_arch="aarch64"; s6_sha="${S6_OVERLAY_AARCH64_SHA256}" ;; \
       *) echo "Unsupported TARGETARCH: ${TARGETARCH}" >&2; exit 1 ;; \
     esac && \
     curl -L -o /tmp/s6-overlay-arch.tar.xz https://github.com/just-containers/s6-overlay/releases/download/v${S6_OVERLAY_VERSION}/s6-overlay-${s6_arch}.tar.xz && \
+    echo "${s6_sha}  /tmp/s6-overlay-arch.tar.xz" | sha256sum -c - && \
     tar -C / -Jxpf /tmp/s6-overlay-arch.tar.xz && \
+    rm -f /etc/ssl/private/ssl-cert-snakeoil.key /etc/ssl/certs/ssl-cert-snakeoil.pem && \
     rm -rf /tmp/* /var/lib/apt/lists/*
 
 # 2. Setup persistent internal storage paths
 RUN mkdir -p /var/lib/postgresql/data /var/lib/redis /rails/storage /run/postgresql && \
-    chown -R postgres:postgres /var/lib/postgresql /run/postgresql /etc/postgresql && \
+    chown -R postgres:postgres /var/lib/postgresql /run/postgresql && \
+    if [ -d /etc/postgresql ]; then chown -R postgres:postgres /etc/postgresql; fi && \
     chown -R redis:redis /var/lib/redis
 
 # 3. Apply S6 Root Filesystem logic
@@ -55,7 +64,7 @@ VOLUME ["/rails/storage", "/var/lib/postgresql/data", "/var/lib/redis"]
 
 ENV SKYLIGHT_ENABLED=false
 
-HEALTHCHECK --interval=30s --timeout=10s --start-period=60s --retries=3 \
+HEALTHCHECK --interval=30s --timeout=10s --start-period=180s --retries=3 \
   CMD curl -f http://localhost:3000/up || exit 1
 
 ENTRYPOINT ["/init"]

README.md

@@ -68,6 +68,9 @@ Just make sure `/mnt/user/appdata/sure-aio` is covered by your standard Unraid C
 - The repo monitors stable upstream Sure tags and opens a PR when a newer stable version is released.
 - Upstream image digest drift is tracked separately so digest-only refreshes do not masquerade as version-bump PRs.
 - Every `main` package publish now ships the exact upstream version tag, an explicit AIO packaging line tag, `latest`, and `sha-<commit>`.
+- Published images include explicit metadata labels for both layers:
+  - upstream app: `io.jsonbored.upstream.version`, `io.jsonbored.upstream.digest`
+  - wrapper identity: `io.jsonbored.wrapper.name`, `io.jsonbored.wrapper.type`, `io.jsonbored.wrapper.track`
 - Formal wrapper releases follow the upstream version plus an AIO revision, such as `v0.6.8-aio.1`.
 - See the release workflow details in [docs/releases.md](docs/releases.md).
 

docs/power-user.md

@@ -82,11 +82,12 @@ Avoid filling your Unraid cache drive by piping PDFs/receipts straight to object
 ## 5. Free vs Paid External Data Providers
 Sure relies on upstream providers for currency exchange rates and stock logos.
 
-*   **Free (Default):** The template defaults both exchange-rate and securities data to `yahoo_finance` so a first boot works without extra accounts.
+*   **Free (Default):** If you leave provider overrides blank, upstream Sure defaults to `yahoo_finance` for first-boot friendliness.
 *   **Paid API Keys (Optional):** If you prefer Twelve Data, add your API key and change **[API] Exchange Rate Provider** and **[API] Securities Provider** to `twelve_data`.
 *   **Logos:** Provide a **[API] Brandfetch Client ID** to automatically scrape high-res logos for your bank names and merchants.
 *   **High-res logos:** Set `BRAND_FETCH_HIGH_RES_LOGOS=true` if you want Sure to prefer larger Brandfetch logo assets where available.
-*   **Important override behavior:** If you set these provider and logo values in the Unraid template, upstream Sure treats them as env overrides and disables the matching controls in the self-hosting UI. In `sure-aio`, that is deliberate: the template is the power-user control plane.
+*   **Indexa token path:** If you use Indexa Capital and want a single global token fallback, set `INDEXA_API_TOKEN`.
+*   **Important override behavior:** Upstream only locks matching settings UI controls when the related env var is present. Leaving provider/logo env fields blank keeps the UI controls interactive.
 *   **Advanced provider tuning:** The template also exposes `TWELVE_DATA_URL`, `YAHOO_FINANCE_URL`, `YAHOO_FINANCE_MAX_RETRIES`, `YAHOO_FINANCE_RETRY_INTERVAL`, and `YAHOO_FINANCE_MIN_REQUEST_INTERVAL` if you need proxying or retry tuning.
 
 ---
@@ -193,6 +194,10 @@ The template now exposes the main upstream runtime toggles that were previously
 2. **Pending transaction behavior**
    - `SIMPLEFIN_INCLUDE_PENDING`
    - `PLAID_INCLUDE_PENDING`
+   - `LUNCHFLOW_INCLUDE_PENDING`
+   - `SIMPLEFIN_DEBUG_RAW`
+   - `LUNCHFLOW_DEBUG_RAW`
+   - `SIMPLEFIN_CC_OVERPAYMENT_HEURISTIC`
    - Just like provider selection, these env overrides lock the matching Sync control in Sure's UI when set.
 3. **Plaid credentials**
    - `PLAID_CLIENT_ID`
@@ -208,11 +213,18 @@ The template now exposes the main upstream runtime toggles that were previously
    - `CHAT_PROVIDER` / `CHAT_MODEL`
 5. **Auth and onboarding behavior**
    - `REQUIRE_EMAIL_CONFIRMATION`
+   - `REQUIRE_INVITE_CODE`
    - `AUTH_PROVIDERS_SOURCE`
 6. **Database and SSL edge cases**
    - `POSTGRES_DB`
    - `SSL_CERT_FILE`
-7. **Advanced outbound networking**
+   - `SELF_HOSTING_ENABLED` (legacy alias; keep `SELF_HOSTED=true` as the main switch)
+7. **Runtime/process tuning**
+   - `RAILS_MAX_THREADS`
+   - `WEB_CONCURRENCY`
+   - `SIDEKIQ_WEB_USERNAME`
+   - `SIDEKIQ_WEB_PASSWORD`
+8. **Advanced outbound networking**
    - `HTTPS_PROXY`
    - `HTTP_PROXY`
    - `NO_PROXY`

docs/releases.md

@@ -16,7 +16,7 @@ Every `main` build publishes:
 
 - `latest`
 - the exact pinned upstream version
-- an explicit packaging line tag like `v0.6.8-aio-v1`
+- an explicit packaging line tag like `v0.6.9-aio-v3` (derived from the latest released `v0.6.9-aio.3`)
 - `sha-<commit>`
 
 ## Release flow

rootfs/etc/cont-init.d/01-setup-db.sh

@@ -1,8 +1,19 @@
 #!/command/with-contenv sh
+set -eu
+
 PGDATA="/var/lib/postgresql/data"
 mkdir -p "$PGDATA" /var/lib/redis /run/postgresql
-chown -R postgres:postgres "$PGDATA" /run/postgresql /etc/postgresql
-chown -R redis:redis /var/lib/redis
+# Avoid recursive ownership fixes on every boot for better restart performance.
+# Full recursive chown is only needed before first database initialization.
+if [ -s "$PGDATA/PG_VERSION" ]; then
+    chown postgres:postgres "$PGDATA" /run/postgresql
+else
+    chown -R postgres:postgres "$PGDATA" /run/postgresql
+    if [ -d /etc/postgresql ]; then
+        chown -R postgres:postgres /etc/postgresql
+    fi
+fi
+chown redis:redis /var/lib/redis
 chmod 700 "$PGDATA"
 chmod 770 /var/lib/redis
 

rootfs/etc/s6-overlay/s6-rc.d/postgres/run

@@ -6,7 +6,7 @@ PGDATA="/var/lib/postgresql/data"
 PGBIN="/usr/lib/postgresql/${PG_VERSION}/bin"
 
 mkdir -p "$PGDATA" /run/postgresql
-chown -R postgres:postgres "$PGDATA" /run/postgresql
+chown postgres:postgres "$PGDATA" /run/postgresql
 chmod 700 "$PGDATA"
 
 if [ ! -s "$PGDATA/PG_VERSION" ]; then

rootfs/etc/s6-overlay/s6-rc.d/redis/run

@@ -2,7 +2,7 @@
 set -eu
 
 mkdir -p /var/lib/redis
-chown -R redis:redis /var/lib/redis
+chown redis:redis /var/lib/redis
 chmod 770 /var/lib/redis
 
-exec sudo -u redis redis-server /etc/redis/redis.conf --dir /var/lib/redis
+exec s6-setuidgid redis redis-server /etc/redis/redis.conf --dir /var/lib/redis

scripts/check-upstream.py

@@ -108,7 +108,7 @@ def latest_github_tag(repo: str, stable_only: bool) -> str:
     return sorted(candidates, key=version_sort_key)[-1]
 
 
-def latest_ghcr_digest(image: str, tag: str = "latest") -> str:
+def try_ghcr_digest_for_tag(image: str, tag: str) -> str | None:
     token_data = http_json(f"https://ghcr.io/token?scope=repository:{image}:pull")
     if not isinstance(token_data, dict) or not token_data.get("token"):
         fail(f"Could not get GHCR token for {image}")
@@ -131,14 +131,25 @@ def latest_ghcr_digest(image: str, tag: str = "latest") -> str:
     )
     try:
         with urllib.request.urlopen(request, timeout=30) as response:
-            digest = response.headers.get("docker-content-digest", "").strip()
+            return response.headers.get("docker-content-digest", "").strip() or None
     except urllib.error.HTTPError as exc:
+        if exc.code == 404:
+            return None
         fail(f"HTTP error while requesting GHCR manifest for {image}:{tag}: {exc.code} {exc.reason}")
     except urllib.error.URLError as exc:
         fail(f"Network error while requesting GHCR manifest for {image}:{tag}: {exc.reason}")
-    if not digest:
-        fail(f"Could not determine digest for GHCR image {image}:{tag}")
-    return digest
+    return None
+
+
+def ghcr_digest_for_version(image: str, version: str) -> str:
+    candidates = [version]
+    if version.startswith("v"):
+        candidates.append(version[1:])
+    for tag in candidates:
+        digest = try_ghcr_digest_for_tag(image, tag)
+        if digest:
+            return digest
+    fail(f"Could not determine digest for GHCR image {image} using version tags: {', '.join(candidates)}")
 
 
 def read_local_version(config: dict[str, object]) -> str:
@@ -250,14 +261,27 @@ def main() -> None:
     current_version = read_local_version(upstream)
     current_digest = read_local_digest(upstream)
     latest_version = latest_github_tag(str(upstream.get("repo", "")).strip(), stable_only)
-    latest_digest = latest_ghcr_digest(str(upstream.get("image", "")).strip(), "latest")
+    latest_digest = ghcr_digest_for_version(str(upstream.get("image", "")).strip(), latest_version)
     version_update_available = latest_version != current_version
     digest_update_available = latest_digest != current_digest
-    updates_available = version_update_available
-
-    if os.environ.get("WRITE_UPSTREAM_VERSION") == "true" and version_update_available:
-        write_local_version(upstream, latest_version)
-        write_local_digest(upstream, latest_digest)
+    updates_available = version_update_available or digest_update_available
+
+    if os.environ.get("WRITE_UPSTREAM_VERSION") == "true" and updates_available:
+        if version_update_available:
+            write_local_version(upstream, latest_version)
+        if digest_update_available:
+            write_local_digest(upstream, latest_digest)
+
+    branch_version = latest_version.replace("/", "-")
+    if version_update_available:
+        branch_name = f"codex/upstream-{branch_version}"
+        pr_title = f"chore(sync): bump upstream sure to {latest_version}"
+    elif digest_update_available:
+        branch_name = f"codex/upstream-digest-{branch_version}"
+        pr_title = f"chore(sync): refresh upstream sure digest for {latest_version}"
+    else:
+        branch_name = f"codex/upstream-{branch_version}"
+        pr_title = f"chore(sync): bump upstream sure to {latest_version}"
 
     release_notes = ""
     if isinstance(notifications, dict):
@@ -277,6 +301,8 @@ def main() -> None:
             "strategy": str(upstream.get("strategy", "pr")).strip() or "pr",
             "upstream_name": str(upstream.get("name", "")).strip(),
             "release_notes_url": release_notes,
+            "branch_name": branch_name,
+            "pr_title": pr_title,
         }
     )