Public Access
f.weber
103ad311b7
Provides a self-contained, containerized aptly (Debian repo manager) stack with independently releasable image and Helm chart versions. - images/: aptly-server (aptly built from source, cross-compiled) and aptly-deb-builder (nfpm + dpkg-buildpackage) container images - rootfs/: shared aptly-init/aptly-reconcile/aptly-push/aptly-pack scripts consumed identically by Compose and the Helm chart, driven by one declarative state.yaml contract - compose/: test (ephemeral, open) and production docker-compose stacks with an nginx read/auth sidecar - charts/aptly/: aptly-native Helm chart covering every security posture from fully open to authenticated read+write, Ingress and Gateway API support (usable in parallel for migration scenarios), metrics, and declarative repo/mirror/publish reconciliation via a Helm hook - .gitea/workflows/: CI (lint, template, kubeconform, E2E smoke test) plus separately tagged image (image/v*) and chart (chart/v*) releases, weekly rebuilds, and a preflight workflow validating the runner's Docker/Helm-OCI capabilities - pubkeys/: RSA chart-signing key for Helm --sign / Artifact Hub's signKey annotation (Helm can't verify Ed25519 keys) - docs/, README.md, charts/aptly/README.md: usage, security, and versioning documentation
35 lines
1.2 KiB
YAML
35 lines
1.2 KiB
YAML
{{- $fullname := include "aptly.fullname" . -}}
|
|
{{- $secretName := printf "%s-credentials" $fullname -}}
|
|
{{- $existing := lookup "v1" "Secret" .Release.Namespace $secretName -}}
|
|
{{- $internalPassword := "" -}}
|
|
{{- if and $existing (hasKey $existing.data "internal-password") -}}
|
|
{{- $internalPassword = index $existing.data "internal-password" | b64dec -}}
|
|
{{- else -}}
|
|
{{- $internalPassword = randAlphaNum 32 -}}
|
|
{{- end -}}
|
|
{{- $userLines := list -}}
|
|
{{- range $name, $pass := .Values.security.auth.users -}}
|
|
{{- $userLines = append $userLines (printf "%s:%s" $name $pass) -}}
|
|
{{- end -}}
|
|
apiVersion: v1
|
|
kind: Secret
|
|
metadata:
|
|
name: {{ $secretName }}
|
|
labels:
|
|
{{- include "aptly.labels" . | nindent 4 }}
|
|
annotations:
|
|
# Reused across `helm upgrade` (via `lookup` above) and preserved across
|
|
# `helm uninstall` so aptly-reconcile keeps working without a manual step
|
|
# after a reinstall. Never regenerate this key from a template — see
|
|
# rootfs/usr/local/bin/aptly-init for why hashing must not happen here.
|
|
helm.sh/resource-policy: keep
|
|
type: Opaque
|
|
stringData:
|
|
internal-password: {{ $internalPassword | quote }}
|
|
{{- if $userLines }}
|
|
users: |
|
|
{{- range $userLines }}
|
|
{{ . }}
|
|
{{- end }}
|
|
{{- end }}
|