Public Access
f.weber
103ad311b7
Provides a self-contained, containerized aptly (Debian repo manager) stack with independently releasable image and Helm chart versions. - images/: aptly-server (aptly built from source, cross-compiled) and aptly-deb-builder (nfpm + dpkg-buildpackage) container images - rootfs/: shared aptly-init/aptly-reconcile/aptly-push/aptly-pack scripts consumed identically by Compose and the Helm chart, driven by one declarative state.yaml contract - compose/: test (ephemeral, open) and production docker-compose stacks with an nginx read/auth sidecar - charts/aptly/: aptly-native Helm chart covering every security posture from fully open to authenticated read+write, Ingress and Gateway API support (usable in parallel for migration scenarios), metrics, and declarative repo/mirror/publish reconciliation via a Helm hook - .gitea/workflows/: CI (lint, template, kubeconform, E2E smoke test) plus separately tagged image (image/v*) and chart (chart/v*) releases, weekly rebuilds, and a preflight workflow validating the runner's Docker/Helm-OCI capabilities - pubkeys/: RSA chart-signing key for Helm --sign / Artifact Hub's signKey annotation (Helm can't verify Ed25519 keys) - docs/, README.md, charts/aptly/README.md: usage, security, and versioning documentation
90 lines
3.7 KiB
Plaintext
90 lines
3.7 KiB
Plaintext
{{- $fullname := include "aptly.fullname" . -}}
|
|
{{- $sec := include "aptly.security" . | fromJson -}}
|
|
aptly ({{ .Chart.AppVersion }}, chart {{ .Chart.Version }}) is deploying as {{ $fullname }}-0 in {{ .Release.Namespace }}.
|
|
|
|
{{- if eq .Values.security.preset "open" }}
|
|
|
|
*** security.preset: open ***
|
|
Both reading AND writing (the mutating /api/ path) are reachable with NO
|
|
authentication from anything that can reach the Service — this is exactly
|
|
the "komplett unabgesichert" mode, working as configured. Nothing further
|
|
to set up; just make sure this is really what you want before exposing it
|
|
beyond your own network.
|
|
{{- end }}
|
|
|
|
--- Check it's up -------------------------------------------------------
|
|
|
|
kubectl exec -n {{ .Release.Namespace }} {{ $fullname }}-0 -c aptly -- \
|
|
curl -fsS http://127.0.0.1:8080/api/ready
|
|
|
|
kubectl logs -n {{ .Release.Namespace }} job/{{ $fullname }}-reconcile
|
|
# (only present right after install/upgrade in `hook` mode)
|
|
|
|
--- Reach it -------------------------------------------------------------
|
|
|
|
{{- if .Values.ingress.enabled }}
|
|
{{- with .Values.ingress.repo.host }}
|
|
|
|
https://{{ . }}/ (Ingress)
|
|
{{- end }}
|
|
{{- end }}
|
|
{{- if .Values.gateway.enabled }}
|
|
{{- range .Values.gateway.repo.hostnames }}
|
|
|
|
https://{{ . }}/ (Gateway API)
|
|
{{- end }}
|
|
{{- end }}
|
|
{{- if not (or .Values.ingress.enabled .Values.gateway.enabled) }}
|
|
|
|
kubectl port-forward -n {{ .Release.Namespace }} svc/{{ $fullname }} 8080:{{ .Values.service.port }}
|
|
# then use http://127.0.0.1:8080/ below
|
|
{{- end }}
|
|
|
|
--- Configure apt on a client ---------------------------------------------
|
|
|
|
{{- $host := "apt.example.com" }}
|
|
{{- if and .Values.ingress.enabled .Values.ingress.repo.host }}
|
|
{{- $host = .Values.ingress.repo.host }}
|
|
{{- else if and .Values.gateway.enabled .Values.gateway.repo.hostnames }}
|
|
{{- $host = first .Values.gateway.repo.hostnames }}
|
|
{{- end }}
|
|
{{- if .Values.aptly.gpg.enabled }}
|
|
{{- if .Values.aptly.gpg.publishPublicKey.enabled }}
|
|
|
|
curl -fsSL https://{{ $host }}{{ .Values.aptly.gpg.publishPublicKey.path }} \
|
|
| gpg --dearmor | sudo tee /usr/share/keyrings/{{ include "aptly.name" . }}.gpg >/dev/null
|
|
|
|
echo 'deb [signed-by=/usr/share/keyrings/{{ include "aptly.name" . }}.gpg] https://{{ $host }}/ <dist> <component>' \
|
|
| sudo tee /etc/apt/sources.list.d/{{ include "aptly.name" . }}.list
|
|
{{- else }}
|
|
|
|
aptly.gpg.enabled=true but aptly.gpg.publishPublicKey.enabled=false — the
|
|
signing key is not being served; distribute it to clients yourself.
|
|
echo 'deb [signed-by=/path/to/your-key.gpg] https://{{ $host }}/ <dist> <component>' \
|
|
| sudo tee /etc/apt/sources.list.d/{{ include "aptly.name" . }}.list
|
|
{{- end }}
|
|
{{- else }}
|
|
|
|
echo 'deb [trusted=yes] https://{{ $host }}/ <dist> <component>' \
|
|
| sudo tee /etc/apt/sources.list.d/{{ include "aptly.name" . }}.list
|
|
{{- end }}
|
|
{{- if $sec.ra }}
|
|
|
|
Reads require credentials in this preset ({{ .Values.security.preset }}):
|
|
echo 'machine {{ $host }} login <user> password <password>' \
|
|
| sudo tee -a /etc/apt/auth.conf.d/{{ include "aptly.name" . }}.conf
|
|
{{- end }}
|
|
|
|
--- Resizing storage later -------------------------------------------------
|
|
|
|
persistence.size on an already-installed StatefulSet is IMMUTABLE via
|
|
`helm upgrade` (Kubernetes forbids changing volumeClaimTemplates in place).
|
|
For production, set persistence.existingClaim to a PVC you manage yourself
|
|
— resizing that is a plain PVC edit. See docs/operations.md for the
|
|
recovery procedure if you need to resize a chart-managed PVC anyway.
|
|
{{- if and .Values.podDisruptionBudget.enabled (le (int .Values.podDisruptionBudget.maxUnavailable) 0) }}
|
|
|
|
*** podDisruptionBudget.maxUnavailable is 0 with replicas=1 — this blocks
|
|
every voluntary node drain forever. ***
|
|
{{- end }}
|