cluster

commit e5274b013f30ca75d3c2ad760e9be20081969535
parent 4bf32b25ebfd9a50e34cd2d9d37131b570988b05
Author: MTRNord <MTRNord@users.noreply.github.com>
Date:   Fri, 17 Apr 2026 21:05:03 +0200

maybe fix issues?

Signed-off-by: MTRNord <MTRNord@users.noreply.github.com>

Diffstat:
M
.github/workflows/build-mediawiki.yaml
 | 
11
++++++++++-
M
apps/talos_cluster/mediawiki/configmap.yaml
 | 
9
++++++++-

2 files changed, 18 insertions(+), 2 deletions(-)
diff --git a/.github/workflows/build-mediawiki.yaml b/.github/workflows/build-mediawiki.yaml
@@ -41,7 +41,16 @@ jobs:
           if [ -n "$INPUT_VERSION" ]; then
             NEW="$INPUT_VERSION"
           else
-            NEW=$(gh api repos/wikimedia/mediawiki/releases/latest --jq '.tag_name' | sed 's/^v//')
+            # wikimedia/mediawiki on GitHub is a mirror with no releases; query Docker Hub instead
+            NEW=$(curl -sf "https://hub.docker.com/v2/repositories/library/mediawiki/tags/?page_size=100&ordering=last_updated" \
+              | jq -r '.results[].name' \
+              | grep -E '^[0-9]+\.[0-9]+\.[0-9]+$' \
+              | sort -t. -k1,1n -k2,2n -k3,3n \
+              | tail -1)
+            if [ -z "$NEW" ]; then
+              echo "Could not determine latest MediaWiki version from Docker Hub" >&2
+              exit 1
+            fi
           fi
           echo "new_version=$NEW" >> "$GITHUB_OUTPUT"
 
diff --git a/apps/talos_cluster/mediawiki/configmap.yaml b/apps/talos_cluster/mediawiki/configmap.yaml
@@ -45,12 +45,19 @@ data:
     $wgPasswordSender      = 'support@midnightthoughts.space';
 
     $wgSMTP = [
-        'host'     => 'stalwart-mail.stalwart.svc.cluster.local',
+        'host'     => 'tls://stalwart-mail.stalwart.svc.cluster.local',
         'IDHost'   => 'wiki.mtrnord.blog',
         'port'     => 587,
         'auth'     => true,
         'username' => 'support@midnightthoughts.space',
         'password' => getenv('MW_SMTP_PASSWORD') ?: '',
+        // cert is issued for mail.midnightthoughts.space, not the internal service name
+        'socket_options' => [
+            'ssl' => [
+                'verify_peer'      => false,
+                'verify_peer_name' => false,
+            ],
+        ],
     ];
 
     # Caching — Valkey for shared object/session/parser cache, APCu for localisation