Public Access
f.weber
103ad311b7
Provides a self-contained, containerized aptly (Debian repo manager) stack with independently releasable image and Helm chart versions. - images/: aptly-server (aptly built from source, cross-compiled) and aptly-deb-builder (nfpm + dpkg-buildpackage) container images - rootfs/: shared aptly-init/aptly-reconcile/aptly-push/aptly-pack scripts consumed identically by Compose and the Helm chart, driven by one declarative state.yaml contract - compose/: test (ephemeral, open) and production docker-compose stacks with an nginx read/auth sidecar - charts/aptly/: aptly-native Helm chart covering every security posture from fully open to authenticated read+write, Ingress and Gateway API support (usable in parallel for migration scenarios), metrics, and declarative repo/mirror/publish reconciliation via a Helm hook - .gitea/workflows/: CI (lint, template, kubeconform, E2E smoke test) plus separately tagged image (image/v*) and chart (chart/v*) releases, weekly rebuilds, and a preflight workflow validating the runner's Docker/Helm-OCI capabilities - pubkeys/: RSA chart-signing key for Helm --sign / Artifact Hub's signKey annotation (Helm can't verify Ed25519 keys) - docs/, README.md, charts/aptly/README.md: usage, security, and versioning documentation
2.5 KiB
2.5 KiB
aptly-containerized
aptly (Debian repository management) as a container image, Docker Compose stacks (test + production), and a Helm chart — built so that aptly can be configured through Helm especially easily and deployed at any security level, from completely open to fully authenticated.
What's in here
images/aptly-server/ |
aptly, cross-compiled from source, non-root, minimal footprint |
images/aptly-deb-builder/ |
packaging image: build a .deb (nfpm or dpkg-buildpackage) and push it, in one step |
compose/ |
test stack (one command, wide open) and a production stack (auth, healthchecks, backup) |
charts/aptly/ |
Helm chart, aptly-native (no library-chart dependency) |
rootfs/usr/local/bin/ |
the scripts shared by both worlds (Compose + Helm) — config rendering, declarative state, push helpers |
action.yaml |
reusable Gitea Action: build + push a package in three lines |
.gitea/workflows/ |
CI, independent image/chart releases, weekly CVE rebuild |
Quickstart
docker compose -f compose/docker-compose.test.yaml up -d --build
curl http://localhost:8080/api/ready
Details and the production path: docs/quickstart-compose.md.
helm install aptly oci://git.morlana.online/f.weber/aptly --version <version>
Details: docs/quickstart-helm.md.
Docs
- Security modes — the four presets, the Ingress split, the CIDR pitfall, unsigned mode
- Packaging & declarative state —
aptly-pack/push/release, thestate.yamlreference, the prefix-escaping pitfall - Versioning — tagging and releasing the image and the chart independently
- Operations — storage resizing, backup/restore, GPG rotation, runner preflight
Keeping itself current
renovate.json tracks aptly-dev/aptly, mikefarah/yq, goreleaser/nfpm, and the
base images via PR. .gitea/workflows/rebuild.yaml rebuilds weekly (Debian CVEs in
the base images) even when aptly itself hasn't changed, and reports on itself (a
Gitea issue) if a run goes missing.
Verification
make lint # hadolint, shellcheck, helm lint, helm template over every ci/*.yaml
make test # tests/smoke-test.sh — pack -> push -> publish -> a real apt-get, the merge gate
License
MIT, see LICENSE. Includes/uses aptly, nginx, and nFPM — see NOTICE.md.