Public Access
f.weber
103ad311b7
Provides a self-contained, containerized aptly (Debian repo manager) stack with independently releasable image and Helm chart versions. - images/: aptly-server (aptly built from source, cross-compiled) and aptly-deb-builder (nfpm + dpkg-buildpackage) container images - rootfs/: shared aptly-init/aptly-reconcile/aptly-push/aptly-pack scripts consumed identically by Compose and the Helm chart, driven by one declarative state.yaml contract - compose/: test (ephemeral, open) and production docker-compose stacks with an nginx read/auth sidecar - charts/aptly/: aptly-native Helm chart covering every security posture from fully open to authenticated read+write, Ingress and Gateway API support (usable in parallel for migration scenarios), metrics, and declarative repo/mirror/publish reconciliation via a Helm hook - .gitea/workflows/: CI (lint, template, kubeconform, E2E smoke test) plus separately tagged image (image/v*) and chart (chart/v*) releases, weekly rebuilds, and a preflight workflow validating the runner's Docker/Helm-OCI capabilities - pubkeys/: RSA chart-signing key for Helm --sign / Artifact Hub's signKey annotation (Helm can't verify Ed25519 keys) - docs/, README.md, charts/aptly/README.md: usage, security, and versioning documentation
40 lines
1.2 KiB
Plaintext
40 lines
1.2 KiB
Plaintext
# Test topology: everything open (security.preset "open" equivalent) — no
|
|
# auth on read OR write. This is what "komplett unabgesichert" looks like.
|
|
# Do not reuse this file for docker-compose.yaml (production).
|
|
#
|
|
# Mounted at /etc/nginx/conf.d/default.conf, which the base image's own
|
|
# nginx.conf already `include`s from inside its own http{} block — so this
|
|
# file must contain ONLY a server{} block (or other http-context directives),
|
|
# never its own http{}/events{}/worker_processes wrapper.
|
|
server {
|
|
listen 8080;
|
|
server_name _;
|
|
client_max_body_size 0;
|
|
absolute_redirect off;
|
|
|
|
location = /healthz { access_log off; return 200 "ok\n"; }
|
|
|
|
location = /api/ready { access_log off; proxy_pass http://aptly:8080; }
|
|
location = /api/healthy { access_log off; proxy_pass http://aptly:8080; }
|
|
|
|
location /api/ {
|
|
proxy_pass http://aptly:8080;
|
|
proxy_http_version 1.1;
|
|
proxy_set_header Host $host;
|
|
proxy_request_buffering off;
|
|
proxy_read_timeout 3600s;
|
|
proxy_send_timeout 3600s;
|
|
}
|
|
|
|
location = /signing-key.asc {
|
|
alias /run/aptly/pub/signing-key.asc;
|
|
default_type text/plain;
|
|
}
|
|
|
|
location / {
|
|
root /var/lib/aptly/public;
|
|
autoindex on;
|
|
autoindex_exact_size off;
|
|
}
|
|
}
|