Public Access
f.weber
103ad311b7
Provides a self-contained, containerized aptly (Debian repo manager) stack with independently releasable image and Helm chart versions. - images/: aptly-server (aptly built from source, cross-compiled) and aptly-deb-builder (nfpm + dpkg-buildpackage) container images - rootfs/: shared aptly-init/aptly-reconcile/aptly-push/aptly-pack scripts consumed identically by Compose and the Helm chart, driven by one declarative state.yaml contract - compose/: test (ephemeral, open) and production docker-compose stacks with an nginx read/auth sidecar - charts/aptly/: aptly-native Helm chart covering every security posture from fully open to authenticated read+write, Ingress and Gateway API support (usable in parallel for migration scenarios), metrics, and declarative repo/mirror/publish reconciliation via a Helm hook - .gitea/workflows/: CI (lint, template, kubeconform, E2E smoke test) plus separately tagged image (image/v*) and chart (chart/v*) releases, weekly rebuilds, and a preflight workflow validating the runner's Docker/Helm-OCI capabilities - pubkeys/: RSA chart-signing key for Helm --sign / Artifact Hub's signKey annotation (Helm can't verify Ed25519 keys) - docs/, README.md, charts/aptly/README.md: usage, security, and versioning documentation
66 lines
2.3 KiB
YAML
66 lines
2.3 KiB
YAML
{{- include "aptly.exposureGuard" . -}}
|
|
{{- if .Values.gateway.enabled }}
|
|
{{- $fullname := include "aptly.fullname" . -}}
|
|
{{- $svcName := $fullname -}}
|
|
{{- if not .Values.gateway.parentRefs }}
|
|
{{- fail "gateway.enabled=true requires gateway.parentRefs to reference at least one existing Gateway — this chart never creates a Gateway itself." -}}
|
|
{{- end }}
|
|
---
|
|
# Repo HTTPRoute — apt clients. In `single` mode this is also where /api/
|
|
# traffic arrives; nginx does the read/write split internally (see
|
|
# templates/_helpers.tpl's aptly.nginxConf). In `split` mode, note that this
|
|
# is a route-level split only: nginx does not itself reject /api/ requests
|
|
# that arrive via this hostname, so combine `split` mode with
|
|
# security.write.inClusterOnly or a NetworkPolicy if you need that enforced.
|
|
# TLS is configured on the referenced Gateway's listener, not here.
|
|
apiVersion: {{ .Values.gateway.apiVersion }}
|
|
kind: HTTPRoute
|
|
metadata:
|
|
name: {{ $fullname }}
|
|
labels:
|
|
{{- include "aptly.labels" . | nindent 4 }}
|
|
spec:
|
|
parentRefs:
|
|
{{- toYaml .Values.gateway.parentRefs | nindent 4 }}
|
|
{{- with .Values.gateway.repo.hostnames }}
|
|
hostnames:
|
|
{{- toYaml . | nindent 4 }}
|
|
{{- end }}
|
|
rules:
|
|
- matches:
|
|
- path:
|
|
type: {{ .Values.gateway.repo.pathType }}
|
|
value: {{ .Values.gateway.repo.path }}
|
|
backendRefs:
|
|
- name: {{ $svcName }}
|
|
port: {{ .Values.service.port }}
|
|
{{- if and (eq .Values.gateway.mode "split") .Values.gateway.api.enabled (not .Values.security.write.inClusterOnly) }}
|
|
---
|
|
# API HTTPRoute (split mode) — a separate hostname/Gateway so you can put a
|
|
# different Gateway, mTLS, or WAF policy in front of the mutating API than
|
|
# the public read path gets.
|
|
apiVersion: {{ .Values.gateway.apiVersion }}
|
|
kind: HTTPRoute
|
|
metadata:
|
|
name: {{ $fullname }}-api
|
|
labels:
|
|
{{- include "aptly.labels" . | nindent 4 }}
|
|
spec:
|
|
{{- $apiParentRefs := .Values.gateway.api.parentRefs | default .Values.gateway.parentRefs }}
|
|
parentRefs:
|
|
{{- toYaml $apiParentRefs | nindent 4 }}
|
|
{{- with .Values.gateway.api.hostnames }}
|
|
hostnames:
|
|
{{- toYaml . | nindent 4 }}
|
|
{{- end }}
|
|
rules:
|
|
- matches:
|
|
- path:
|
|
type: PathPrefix
|
|
value: /
|
|
backendRefs:
|
|
- name: {{ $svcName }}
|
|
port: {{ .Values.service.port }}
|
|
{{- end }}
|
|
{{- end }}
|