Public Access
f.weber
103ad311b7
Provides a self-contained, containerized aptly (Debian repo manager) stack with independently releasable image and Helm chart versions. - images/: aptly-server (aptly built from source, cross-compiled) and aptly-deb-builder (nfpm + dpkg-buildpackage) container images - rootfs/: shared aptly-init/aptly-reconcile/aptly-push/aptly-pack scripts consumed identically by Compose and the Helm chart, driven by one declarative state.yaml contract - compose/: test (ephemeral, open) and production docker-compose stacks with an nginx read/auth sidecar - charts/aptly/: aptly-native Helm chart covering every security posture from fully open to authenticated read+write, Ingress and Gateway API support (usable in parallel for migration scenarios), metrics, and declarative repo/mirror/publish reconciliation via a Helm hook - .gitea/workflows/: CI (lint, template, kubeconform, E2E smoke test) plus separately tagged image (image/v*) and chart (chart/v*) releases, weekly rebuilds, and a preflight workflow validating the runner's Docker/Helm-OCI capabilities - pubkeys/: RSA chart-signing key for Helm --sign / Artifact Hub's signKey annotation (Helm can't verify Ed25519 keys) - docs/, README.md, charts/aptly/README.md: usage, security, and versioning documentation
78 lines
2.4 KiB
YAML
78 lines
2.4 KiB
YAML
{{- include "aptly.exposureGuard" . -}}
|
|
{{- if .Values.ingress.enabled }}
|
|
{{- $fullname := include "aptly.fullname" . -}}
|
|
{{- $svcName := $fullname -}}
|
|
---
|
|
# Repo Ingress — apt clients. In `single` mode this is also where /api/
|
|
# traffic arrives; nginx does the read/write split internally (see
|
|
# templates/_helpers.tpl's aptly.nginxConf). In `split` mode, note that this
|
|
# is a DNS/Ingress-level split only: nginx does not itself reject /api/
|
|
# requests that arrive via this host, so combine `split` mode with
|
|
# security.write.inClusterOnly or a NetworkPolicy if you need that enforced.
|
|
apiVersion: networking.k8s.io/v1
|
|
kind: Ingress
|
|
metadata:
|
|
name: {{ $fullname }}
|
|
labels:
|
|
{{- include "aptly.labels" . | nindent 4 }}
|
|
annotations:
|
|
{{- toYaml .Values.ingress.annotations | nindent 4 }}
|
|
spec:
|
|
{{- with .Values.ingress.className }}
|
|
ingressClassName: {{ . }}
|
|
{{- end }}
|
|
{{- with .Values.ingress.repo.tls }}
|
|
tls:
|
|
{{- toYaml . | nindent 4 }}
|
|
{{- end }}
|
|
rules:
|
|
- {{- with .Values.ingress.repo.host }}
|
|
host: {{ . | quote }}
|
|
{{- end }}
|
|
http:
|
|
paths:
|
|
- path: {{ .Values.ingress.repo.path }}
|
|
pathType: {{ .Values.ingress.repo.pathType }}
|
|
backend:
|
|
service:
|
|
name: {{ $svcName }}
|
|
port:
|
|
name: http
|
|
{{- if and (eq .Values.ingress.mode "split") .Values.ingress.api.enabled (not .Values.security.write.inClusterOnly) }}
|
|
---
|
|
# API Ingress (split mode) — a separate host so you can put a different
|
|
# ingressClass, mTLS, or WAF policy in front of the mutating API than the
|
|
# public read path gets.
|
|
apiVersion: networking.k8s.io/v1
|
|
kind: Ingress
|
|
metadata:
|
|
name: {{ $fullname }}-api
|
|
labels:
|
|
{{- include "aptly.labels" . | nindent 4 }}
|
|
annotations:
|
|
{{- toYaml (merge .Values.ingress.api.annotations .Values.ingress.annotations) | nindent 4 }}
|
|
spec:
|
|
{{- $apiClass := .Values.ingress.api.className | default .Values.ingress.className }}
|
|
{{- with $apiClass }}
|
|
ingressClassName: {{ . }}
|
|
{{- end }}
|
|
{{- with .Values.ingress.api.tls }}
|
|
tls:
|
|
{{- toYaml . | nindent 4 }}
|
|
{{- end }}
|
|
rules:
|
|
- {{- with .Values.ingress.api.host }}
|
|
host: {{ . | quote }}
|
|
{{- end }}
|
|
http:
|
|
paths:
|
|
- path: /
|
|
pathType: Prefix
|
|
backend:
|
|
service:
|
|
name: {{ $svcName }}
|
|
port:
|
|
name: http
|
|
{{- end }}
|
|
{{- end }}
|