user-data.sh now installs docker-compose v5.5.1 rather than latest, and checks the download against its published sha256 for aarch64 or x86_64 before installing it. Any other architecture stops the boot. The Caddy image (2.11.4-alpine) and the Dockerfile's rust (1.98.1-slim-bookworm) and debian (bookworm-slim) bases are pinned by digest. The ECR repositories use IMMUTABLE_WITH_EXCLUSION, so a pushed tag never moves except cache, which every build rewrites. tofu validate passes.
Two parts of 3mwixdmc7tg2v are left for the owner and not changed here: the LICENSE file, which needs a copyright holder, and where scripts/ci.sh runs. Fixes the pinning half of 3mwixdmc7tg2v (https://tangled.org/permadeath.com/vibescrobble.com/issues).
🤖 Generated with Claude Code