Public Access
f.weber
103ad311b7
Provides a self-contained, containerized aptly (Debian repo manager) stack with independently releasable image and Helm chart versions. - images/: aptly-server (aptly built from source, cross-compiled) and aptly-deb-builder (nfpm + dpkg-buildpackage) container images - rootfs/: shared aptly-init/aptly-reconcile/aptly-push/aptly-pack scripts consumed identically by Compose and the Helm chart, driven by one declarative state.yaml contract - compose/: test (ephemeral, open) and production docker-compose stacks with an nginx read/auth sidecar - charts/aptly/: aptly-native Helm chart covering every security posture from fully open to authenticated read+write, Ingress and Gateway API support (usable in parallel for migration scenarios), metrics, and declarative repo/mirror/publish reconciliation via a Helm hook - .gitea/workflows/: CI (lint, template, kubeconform, E2E smoke test) plus separately tagged image (image/v*) and chart (chart/v*) releases, weekly rebuilds, and a preflight workflow validating the runner's Docker/Helm-OCI capabilities - pubkeys/: RSA chart-signing key for Helm --sign / Artifact Hub's signKey annotation (Helm can't verify Ed25519 keys) - docs/, README.md, charts/aptly/README.md: usage, security, and versioning documentation
83 lines
1.8 KiB
YAML
83 lines
1.8 KiB
YAML
# Exercises: existingClaim, existingSecret (auth + gpg), metrics + ServiceMonitor,
|
|
# networkPolicy, PDB, declarative state (gpgKeys/localRepos/mirrors/publish),
|
|
# configOverrides passthrough, extra* escape hatches.
|
|
persistence:
|
|
existingClaim: my-existing-pvc
|
|
|
|
security:
|
|
preset: authenticated
|
|
auth:
|
|
existingSecret: my-htpasswd-secret
|
|
trustedProxies: ["10.0.0.0/8"]
|
|
write:
|
|
allowCIDRs: ["10.42.0.0/16"]
|
|
|
|
aptly:
|
|
architectures: [amd64, arm64]
|
|
metrics:
|
|
enabled: true
|
|
gpg:
|
|
signingKey:
|
|
existingSecret: my-signing-key-secret
|
|
gpgKeys:
|
|
- name: debian-archive
|
|
armored: |
|
|
-----BEGIN PGP PUBLIC KEY BLOCK-----
|
|
dGVzdA==
|
|
-----END PGP PUBLIC KEY BLOCK-----
|
|
localRepos:
|
|
- name: stable
|
|
comment: "Production repo"
|
|
defaultDistribution: stable
|
|
defaultComponent: main
|
|
mirrors:
|
|
- name: debian-security
|
|
archiveURL: http://security.debian.org/debian-security
|
|
distribution: trixie-security
|
|
components: [main]
|
|
architectures: [amd64, arm64]
|
|
publish:
|
|
- name: stable-root
|
|
prefix: ""
|
|
distribution: stable
|
|
sourceKind: local
|
|
sources: [{ name: stable, component: main }]
|
|
architectures: [amd64, arm64]
|
|
acquireByHash: true
|
|
configOverrides:
|
|
download_concurrency: 8
|
|
existingSecretEnv: ["some-other-secret"]
|
|
|
|
metrics:
|
|
service:
|
|
enabled: true
|
|
serviceMonitor:
|
|
enabled: true
|
|
|
|
networkPolicy:
|
|
enabled: true
|
|
allowedNamespaces: ["ci", "monitoring"]
|
|
|
|
podDisruptionBudget:
|
|
enabled: true
|
|
maxUnavailable: 1
|
|
|
|
reconcile:
|
|
mode: job
|
|
|
|
extraEnv:
|
|
- name: FOO
|
|
value: bar
|
|
extraVolumes:
|
|
- name: extra
|
|
emptyDir: {}
|
|
extraVolumeMounts:
|
|
- name: extra
|
|
mountPath: /extra
|
|
nodeSelector:
|
|
kubernetes.io/os: linux
|
|
tolerations:
|
|
- key: "example"
|
|
operator: "Exists"
|
|
priorityClassName: "high-priority"
|