Make every image tag in compose pinnable via .env

Floating tags (`latest`, `main`) made deploys non-deterministic — a
container recreate could pull a newer Open WebUI, Ollama, or Anubis at
any time. Wrapped every image: src in a ${VAR:-default} substitution
and surfaced the full set in .env.example with a header explaining
where to find current versions and bumped COMFYUI_IMAGE_TAG default
to 0.2.1 (the just-tagged version with the transformers pin).

Vars added: CADDY_TAG, OLLAMA_TAG, OPEN_WEBUI_TAG, ALPINE_TAG,
ANUBIS_TAG (COMFYUI_IMAGE_TAG already existed). Defaults match the
previous floating-tag behaviour for ones I'm not confident which
specific version to pin (Ollama, Open WebUI, Anubis) — operator should
update those to verified versions for production deploys.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

deployments/ai-stack/.env.example

@@ -19,9 +19,26 @@ WEBUI_SECRET_KEY=replace-with-32-byte-hex
 # Only needed if you uncomment the anubis-owui service in docker-compose.yml.
 ANUBIS_OWUI_KEY=replace-with-32-byte-hex
 
-# ComfyUI image tag to deploy. `latest` tracks whatever the release workflow
-# last pushed; pin to a v* tag (e.g. 0.1.0) for reproducible deploys.
-COMFYUI_IMAGE_TAG=latest
+# ─── Image tags ─────────────────────────────────────────────────────────────
+# Pin to specific versions for reproducible deploys. The defaults below are
+# the last set verified to work end-to-end for this stack — change only when
+# you've tested a newer combination. `latest` / `main` is fine for local
+# experimentation but means deploys are non-deterministic.
+#
+# Find current tags at:
+#   ComfyUI         git.anomalous.dev/alphacentri/comfyui-nvidia/-/tags
+#   Caddy           https://hub.docker.com/_/caddy/tags
+#   Ollama          https://hub.docker.com/r/ollama/ollama/tags
+#   Open WebUI      https://github.com/open-webui/open-webui/pkgs/container/open-webui
+#   Alpine          https://hub.docker.com/_/alpine/tags
+#   Anubis          https://github.com/TecharoHQ/anubis/pkgs/container/anubis
+
+COMFYUI_IMAGE_TAG=0.2.1
+CADDY_TAG=2-alpine
+OLLAMA_TAG=latest
+OPEN_WEBUI_TAG=main
+ALPINE_TAG=3.20
+ANUBIS_TAG=latest
 
 # HuggingFace access token. Only needed if comfyui-init-models.sh references
 # gated repos (Flux-dev, SD3, etc.). Generate a read token at

deployments/ai-stack/docker-compose.yml

@@ -24,7 +24,7 @@ services:
   # Encrypt), reverse-proxies to the in-compose services by name.
   # ---------------------------------------------------------------------------
   caddy:
-    image: caddy:2-alpine
+    image: caddy:${CADDY_TAG:-2-alpine}
     container_name: caddy
     restart: unless-stopped
     ports:
@@ -49,7 +49,7 @@ services:
   # Ollama — LLM daemon, GPU-backed.
   # ---------------------------------------------------------------------------
   ollama:
-    image: ollama/ollama:latest
+    image: ollama/ollama:${OLLAMA_TAG:-latest}
     container_name: ollama
     restart: unless-stopped
     # 11434 only published if you want direct access from the VM host.
@@ -84,7 +84,7 @@ services:
   # mirror (set S3_OLLAMA_BASE in .env; create tarballs with
   # mirror-ollama-model.sh).
   model-init:
-    image: ollama/ollama:latest
+    image: ollama/ollama:${OLLAMA_TAG:-latest}
     container_name: ollama-model-init
     depends_on:
       ollama:
@@ -108,7 +108,7 @@ services:
   # (install via ComfyUI-Manager) instead of as a separate sidecar.
   # ---------------------------------------------------------------------------
   comfyui:
-    image: git.anomalous.dev/alphacentri/comfyui-nvidia:${COMFYUI_IMAGE_TAG:-latest}
+    image: git.anomalous.dev/alphacentri/comfyui-nvidia:${COMFYUI_IMAGE_TAG:-0.2.1}
     pull_policy: always
     container_name: comfyui
     restart: unless-stopped
@@ -139,7 +139,7 @@ services:
   # need to be running for this — files just land on the volume; ComfyUI
   # picks them up next time it scans (or on a restart).
   comfyui-model-init:
-    image: alpine:latest
+    image: alpine:${ALPINE_TAG:-3.20}
     container_name: comfyui-model-init
     volumes:
       - comfyui-models:/models
@@ -155,7 +155,7 @@ services:
   # Open WebUI — multi-user chat.
   # ---------------------------------------------------------------------------
   open-webui:
-    image: ghcr.io/open-webui/open-webui:main
+    image: ghcr.io/open-webui/open-webui:${OPEN_WEBUI_TAG:-main}
     container_name: open-webui
     restart: unless-stopped
     # ports: not published; Caddy fronts it
@@ -197,7 +197,7 @@ services:
   # `open-webui:8080` → `anubis-owui:8923`.
   # ---------------------------------------------------------------------------
   anubis-owui:
-    image: ghcr.io/techarohq/anubis:latest
+    image: ghcr.io/techarohq/anubis:${ANUBIS_TAG:-latest}
     container_name: anubis-owui
     restart: unless-stopped
     environment: