aptly-containerized

aptly (Debian repository management) as a container image, Docker Compose stacks (test + production), and a Helm chart — built so that aptly can be configured through Helm especially easily and deployed at any security level, from completely open to fully authenticated.

What's in here


`images/aptly-server/`	aptly, cross-compiled from source, non-root, minimal footprint
`images/aptly-deb-builder/`	packaging image: build a `.deb` (nfpm or `dpkg-buildpackage`) and push it, in one step
`compose/`	test stack (one command, wide open) and a production stack (auth, healthchecks, backup)
`charts/aptly/`	Helm chart, aptly-native (no library-chart dependency)
`rootfs/usr/local/bin/`	the scripts shared by both worlds (Compose + Helm) — config rendering, declarative state, push helpers
`action.yaml`	reusable Gitea Action: build + push a package in three lines
`.gitea/workflows/`	CI, independent image/chart releases, weekly CVE rebuild

Quickstart

docker compose -f compose/docker-compose.test.yaml up -d --build
curl http://localhost:8080/api/ready

Details and the production path: docs/quickstart-compose.md.

helm install aptly oci://git.morlana.online/f.weber/charts/aptly --version <version>

Details: docs/quickstart-helm.md.

Docs

Security modes — the four presets, the Ingress split, the CIDR pitfall, unsigned mode
Packaging & declarative state — aptly-pack/push/release, the state.yaml reference, the prefix-escaping pitfall
Versioning — tagging and releasing the image and the chart independently
Operations — storage resizing, backup/restore, GPG rotation, runner preflight

Keeping itself current

renovate.json tracks aptly-dev/aptly, mikefarah/yq, goreleaser/nfpm, and the base images via PR. .gitea/workflows/rebuild.yaml rebuilds weekly (Debian CVEs in the base images) even when aptly itself hasn't changed, and reports on itself (a Gitea issue) if a run goes missing.

Verification

make lint   # hadolint, shellcheck, helm lint, helm template over every ci/*.yaml
make test   # tests/smoke-test.sh — pack -> push -> publish -> a real apt-get, the merge gate

License

MIT, see LICENSE. Includes/uses aptly, nginx, and nFPM — see NOTICE.md.

2.5 KiB Raw Blame History