Public Access
f.weber
103ad311b7
Provides a self-contained, containerized aptly (Debian repo manager) stack with independently releasable image and Helm chart versions. - images/: aptly-server (aptly built from source, cross-compiled) and aptly-deb-builder (nfpm + dpkg-buildpackage) container images - rootfs/: shared aptly-init/aptly-reconcile/aptly-push/aptly-pack scripts consumed identically by Compose and the Helm chart, driven by one declarative state.yaml contract - compose/: test (ephemeral, open) and production docker-compose stacks with an nginx read/auth sidecar - charts/aptly/: aptly-native Helm chart covering every security posture from fully open to authenticated read+write, Ingress and Gateway API support (usable in parallel for migration scenarios), metrics, and declarative repo/mirror/publish reconciliation via a Helm hook - .gitea/workflows/: CI (lint, template, kubeconform, E2E smoke test) plus separately tagged image (image/v*) and chart (chart/v*) releases, weekly rebuilds, and a preflight workflow validating the runner's Docker/Helm-OCI capabilities - pubkeys/: RSA chart-signing key for Helm --sign / Artifact Hub's signKey annotation (Helm can't verify Ed25519 keys) - docs/, README.md, charts/aptly/README.md: usage, security, and versioning documentation
39 lines
1.7 KiB
Bash
39 lines
1.7 KiB
Bash
# Copy to .env and edit. See docs/quickstart-compose.md for the full walkthrough.
|
|
|
|
# Image tag to run — set this to a released image/vX.Y.Z-N tag once you have
|
|
# one (see docs/versioning.md); "latest" is fine to try things out with.
|
|
APTLY_IMAGE_TAG=latest
|
|
|
|
# Host port nginx (reads + the auth-gated /api/) is published on.
|
|
APTLY_PUBLISH_PORT=8080
|
|
|
|
# --- Auth (security.preset "publicRead" equivalent) ---
|
|
# Password for the internal user aptly-reconcile/aptly-mirror-refresh use to
|
|
# talk through nginx. Required — has no default, compose refuses to start
|
|
# without it. Any non-trivial value; nothing external ever needs to know it.
|
|
APTLY_INTERNAL_PASSWORD=changeme-generate-a-real-secret
|
|
|
|
# Also edit config/users (copy from config/users.example) with the
|
|
# username:password pairs that external CI/uploaders should use.
|
|
|
|
# --- GPG signing ---
|
|
# true (default): publishing requires a signing key at config/gpg/private.asc
|
|
# (+ config/gpg/passphrase if it's passphrase-protected). Missing key ->
|
|
# aptly-init logs a WARN and publishes unsigned instead of failing to start
|
|
# — check `docker compose logs aptly-init` after first boot.
|
|
# false: explicitly unsigned, no key needed. See docs/security.md.
|
|
APTLY_GPG_ENABLED=true
|
|
|
|
# Directory containing private.asc (and optionally passphrase). Defaults to
|
|
# ./config/gpg, gitignored.
|
|
#APTLY_GPG_DIR=./config/gpg
|
|
|
|
# --- Reconcile ---
|
|
# false (default): an unreachable mirror or malformed state.yaml entry only
|
|
# warns — `docker compose up` still succeeds. Set true in CI to catch
|
|
# mistakes in state.yaml.
|
|
APTLY_RECONCILE_FAIL_ON_ERROR=false
|
|
|
|
# --- Backup (docker compose --profile backup run --rm backup) ---
|
|
#APTLY_BACKUP_DIR=./backup
|