Initial implementation: aptly container image, Compose stacks, Helm chart, and Gitea Actions pipelines

Provides a self-contained, containerized aptly (Debian repo manager) stack with independently releasable image and Helm chart versions. - images/: aptly-server (aptly built from source, cross-compiled) and aptly-deb-builder (nfpm + dpkg-buildpackage) container images - rootfs/: shared aptly-init/aptly-reconcile/aptly-push/aptly-pack scripts consumed identically by Compose and the Helm chart, driven by one declarative state.yaml contract - compose/: test (ephemeral, open) and production docker-compose stacks with an nginx read/auth sidecar - charts/aptly/: aptly-native Helm chart covering every security posture from fully open to authenticated read+write, Ingress and Gateway API support (usable in parallel for migration scenarios), metrics, and declarative repo/mirror/publish reconciliation via a Helm hook - .gitea/workflows/: CI (lint, template, kubeconform, E2E smoke test) plus separately tagged image (image/v*) and chart (chart/v*) releases, weekly rebuilds, and a preflight workflow validating the runner's Docker/Helm-OCI capabilities - pubkeys/: RSA chart-signing key for Helm --sign / Artifact Hub's signKey annotation (Helm can't verify Ed25519 keys) - docs/, README.md, charts/aptly/README.md: usage, security, and versioning documentation
2026-08-12 12:21:08 +02:00
commit 103ad311b7
71 changed files with 4843 additions and 0 deletions
@@ -0,0 +1,50 @@
+# syntax=docker/dockerfile:1
+#
+# aptly-deb-builder — turns a source tree into a signed-and-pushable .deb in
+# one command (aptly-release). Ships both packaging paths:
+#   - nfpm, for projects with no debian/ directory (a plain YAML descriptor)
+#   - the real Debian toolchain, for projects that already have a debian/ dir
+#
+# renovate: datasource=github-releases depName=goreleaser/nfpm
+ARG NFPM_VERSION=2.47.0
+ARG NFPM_SHA256_AMD64=3f1cf344bd0b57373ca55636a78c08b0491f7293d609a456a9ac3b0b150fda97
+ARG NFPM_SHA256_ARM64=27419eb382695a7942be8ad52259f3ec1854fad001b3ae4baed34ce39a223b97
+ARG RUNTIME_IMAGE=debian:trixie-slim
+
+FROM ${RUNTIME_IMAGE}
+ARG TARGETARCH
+ARG NFPM_VERSION
+ARG NFPM_SHA256_AMD64
+ARG NFPM_SHA256_ARM64
+
+LABEL org.opencontainers.image.title="aptly-deb-builder" \
+      org.opencontainers.image.description="Package, build and push .deb packages into an aptly repository in one step" \
+      org.opencontainers.image.source="https://git.morlana.online/f.weber/aptly-containerized" \
+      org.opencontainers.image.licenses="MIT"
+
+# hadolint ignore=DL3008
+RUN --mount=type=cache,target=/var/cache/apt,sharing=locked \
+    --mount=type=cache,target=/var/lib/apt,sharing=locked \
+    apt-get update && apt-get install -y --no-install-recommends \
+      ca-certificates curl jq gnupg \
+      build-essential debhelper devscripts dpkg-dev fakeroot equivs \
+    && rm -rf /var/lib/apt/lists/*
+
+SHELL ["/bin/bash", "-o", "pipefail", "-c"]
+RUN set -eux; \
+    case "${TARGETARCH}" in \
+      amd64) sha256="${NFPM_SHA256_AMD64}" ;; \
+      arm64) sha256="${NFPM_SHA256_ARM64}" ;; \
+      *) echo "unsupported TARGETARCH: ${TARGETARCH}" >&2; exit 1 ;; \
+    esac; \
+    curl -fsSL -o /tmp/nfpm.deb "https://github.com/goreleaser/nfpm/releases/download/v${NFPM_VERSION}/nfpm_${NFPM_VERSION}_${TARGETARCH}.deb"; \
+    echo "${sha256}  /tmp/nfpm.deb" | sha256sum -c -; \
+    dpkg -i /tmp/nfpm.deb; \
+    rm -f /tmp/nfpm.deb
+
+COPY rootfs/usr/local/bin/aptly-pack rootfs/usr/local/bin/aptly-push rootfs/usr/local/bin/aptly-release /usr/local/bin/
+COPY rootfs/usr/local/bin/lib/ /usr/local/bin/lib/
+
+WORKDIR /work
+ENTRYPOINT []
+CMD ["bash"]
@@ -0,0 +1,91 @@
+# syntax=docker/dockerfile:1
+#
+# aptly-server — aptly built from source, cross-compiled, plus the tools its
+# own entrypoint/reconcile scripts need (jq, yq, envsubst, gpg). Doubles as
+# the CLI/debug image: `docker run --rm aptly-server aptly version`.
+#
+# Built from source rather than the upstream .deb or release zip because:
+#   - the aptly release assets ship no checksums file, so a zip download can
+#     only ever be "trust the network", never "verify the bytes";
+#   - cross-compiling is native on an arm64 build host (the expensive part
+#     needs no QEMU — only the tiny runtime stage below does), which matters
+#     because there is no amd64 runner in this project's CI;
+#   - it removes any dependency on repo.aptly.info having published a build
+#     for this exact Debian release/arch combination in time for a rebuild.
+#
+# renovate: datasource=github-releases depName=aptly-dev/aptly
+ARG APTLY_VERSION=1.6.3
+ARG GO_IMAGE=golang:1.25-trixie
+ARG RUNTIME_IMAGE=debian:trixie-slim
+
+# renovate: datasource=github-releases depName=mikefarah/yq
+ARG YQ_VERSION=4.53.3
+ARG YQ_SHA256_AMD64=fa52a4e758c63d38299163fbdd1edfb4c4963247918bf9c1c5d31d84789eded4
+ARG YQ_SHA256_ARM64=578648e463a11c1b6db6010cbf41eafed6bee79466fcffa1bb446672cf7945ea
+
+FROM --platform=$BUILDPLATFORM ${GO_IMAGE} AS build
+ARG APTLY_VERSION
+ARG TARGETARCH
+WORKDIR /src
+RUN --mount=type=cache,target=/root/.cache/go-build \
+    --mount=type=cache,target=/go/pkg/mod \
+    git clone --depth 1 --branch "v${APTLY_VERSION}" https://github.com/aptly-dev/aptly . \
+ && printf '%s' "${APTLY_VERSION}" > VERSION \
+ && CGO_ENABLED=0 GOOS=linux GOARCH="${TARGETARCH}" \
+    go build -trimpath -ldflags="-s -w" -o /out/aptly .
+
+FROM --platform=$BUILDPLATFORM ${GO_IMAGE} AS build-tools
+# Runs once for BUILDPLATFORM, not per target arch — cheap even on an
+# emulated runtime stage below, since we just copy the right binary in.
+ARG YQ_VERSION
+ARG YQ_SHA256_AMD64
+ARG YQ_SHA256_ARM64
+WORKDIR /out
+SHELL ["/bin/bash", "-o", "pipefail", "-c"]
+RUN set -eux; \
+    curl -fsSL -o yq_linux_amd64 "https://github.com/mikefarah/yq/releases/download/v${YQ_VERSION}/yq_linux_amd64"; \
+    curl -fsSL -o yq_linux_arm64 "https://github.com/mikefarah/yq/releases/download/v${YQ_VERSION}/yq_linux_arm64"; \
+    echo "${YQ_SHA256_AMD64}  yq_linux_amd64" | sha256sum -c -; \
+    echo "${YQ_SHA256_ARM64}  yq_linux_arm64" | sha256sum -c -; \
+    chmod +x yq_linux_amd64 yq_linux_arm64
+
+FROM ${RUNTIME_IMAGE}
+ARG TARGETARCH
+ARG APTLY_VERSION
+ARG APTLY_REVISION=1
+
+LABEL org.opencontainers.image.title="aptly-server" \
+      org.opencontainers.image.description="aptly (Debian repository management tool), containerized: REST API + non-root runtime" \
+      org.opencontainers.image.source="https://git.morlana.online/f.weber/aptly-containerized" \
+      org.opencontainers.image.licenses="MIT" \
+      org.opencontainers.image.version="${APTLY_VERSION}-${APTLY_REVISION}"
+
+# hadolint ignore=DL3008
+RUN --mount=type=cache,target=/var/cache/apt,sharing=locked \
+    --mount=type=cache,target=/var/lib/apt,sharing=locked \
+    apt-get update && apt-get install -y --no-install-recommends \
+      ca-certificates gnupg bzip2 xz-utils curl jq gettext-base openssl \
+    && rm -rf /var/lib/apt/lists/* \
+    && addgroup --system --gid 10001 aptly \
+    && adduser --system --uid 10001 --ingroup aptly --home /var/lib/aptly --disabled-password aptly \
+    && mkdir -p /var/lib/aptly/public /run/aptly /etc/aptly-src \
+    && chown -R aptly:aptly /var/lib/aptly /run/aptly
+
+COPY --from=build /out/aptly /usr/local/bin/aptly
+COPY --from=build-tools /out/yq_linux_${TARGETARCH} /usr/local/bin/yq
+COPY rootfs/ /
+
+ENV APTLY_ROOT_DIR=/var/lib/aptly \
+    APTLY_RUN_DIR=/run/aptly \
+    APTLY_CONFIG=/run/aptly/aptly.yaml \
+    APTLY_CONFIG_SRC=/etc/aptly-src/aptly.yaml \
+    APTLY_CONFIG_DST=/run/aptly/aptly.yaml \
+    APTLY_API_LISTEN=127.0.0.1:8080
+
+USER 10001:10001
+WORKDIR /var/lib/aptly
+
+HEALTHCHECK --interval=30s --timeout=5s --start-period=30s --retries=3 \
+  CMD ["curl", "-fsS", "http://127.0.0.1:8080/api/healthy"]
+
+ENTRYPOINT ["/usr/local/bin/aptly-entrypoint"]