Require tokens for artifactapi uploads

Bump artifactapi to v3.25.0 (#573 )
Artifactapi v3.25.0 adds github_rpm cache_repodata toggle and general fixes. - Bump artifactapi and artifactapi-ui images to v3.25.0 Reviewed-on: #573 Co-authored-by: unkin-agent <unkin-agent@unkin.net> Co-committed-by: unkin-agent <unkin-agent@unkin.net>
2026-10-26 00:59:43 +11:00 · 2026-10-25 23:45:54 +11:00 · 2026-10-25 20:25:21 +11:00 · 2026-10-24 20:40:34 +11:00 · 2026-10-24 17:28:37 +11:00 · 2026-10-24 17:06:09 +11:00
35 changed files with 161 additions and 323 deletions
@@ -36,7 +36,7 @@ spec:
              mountPath: /combined-certs
      containers:
        - name: api
-          image: artifactapi.k8s.syd1.au.unkin.net/docker-internal/artifactapi:v3.19.0
+          image: artifactapi.k8s.syd1.au.unkin.net/docker-internal/artifactapi:v3.25.0
          imagePullPolicy: IfNotPresent
          ports:
            - containerPort: 8000
@@ -5,6 +5,7 @@ metadata:
  name: api-env
  namespace: artifactapi
 data:
+  ARTIFACTAPI_AUTH_UPLOADS: "true"
  ARTIFACTAPI_OIDC_AUDIENCE: artifactapi
  ARTIFACTAPI_OIDC_ISSUER: https://vault.service.consul:8200/v1/identity/oidc
  DBHOST: postgres-pooler
@@ -49,7 +49,7 @@ spec:
            capabilities:
              drop: ["ALL"]
        - name: api
-          image: artifactapi.k8s.syd1.au.unkin.net/docker-internal/artifactapi:v3.19.0
+          image: artifactapi.k8s.syd1.au.unkin.net/docker-internal/artifactapi:v3.25.0
          imagePullPolicy: IfNotPresent
          command: ["/keeper/true"]
          volumeMounts:
@@ -69,7 +69,7 @@ spec:
            capabilities:
              drop: ["ALL"]
        - name: ui
-          image: artifactapi.k8s.syd1.au.unkin.net/docker-internal/artifactapi-ui:v3.19.0
+          image: artifactapi.k8s.syd1.au.unkin.net/docker-internal/artifactapi-ui:v3.25.0
          imagePullPolicy: IfNotPresent
          command: ["true"]
          resources:
@@ -22,7 +22,7 @@ spec:
      automountServiceAccountToken: true
      containers:
        - name: ui
-          image: artifactapi.k8s.syd1.au.unkin.net/docker-internal/artifactapi-ui:v3.19.0
+          image: artifactapi.k8s.syd1.au.unkin.net/docker-internal/artifactapi-ui:v3.25.0
          imagePullPolicy: IfNotPresent
          ports:
            - containerPort: 80
@@ -1,7 +0,0 @@
---
-apiVersion: kustomize.config.k8s.io/v1beta1
-kind: Kustomization
-
-resources:
-  - mta1.yaml
-  - mta2.yaml
@@ -1,13 +0,0 @@
---
-apiVersion: bind.unkin.net/v1alpha1
-kind: DNSRecord
-metadata:
-  name: edge-mta1-a
-  namespace: bind-external
-spec:
-  zoneRef: edge-unkin-net
-  name: "mta1"
-  type: A
-  ttl: 3600
-  values:
-    - 66.226.148.207
@@ -1,13 +0,0 @@
---
-apiVersion: bind.unkin.net/v1alpha1
-kind: DNSRecord
-metadata:
-  name: edge-mta2-a
-  namespace: bind-external
-spec:
-  zoneRef: edge-unkin-net
-  name: "mta2"
-  type: A
-  ttl: 3600
-  values:
-    - 66.226.149.50
@@ -1,6 +0,0 @@
---
-apiVersion: kustomize.config.k8s.io/v1beta1
-kind: Kustomization
-
-resources:
-  - a
@@ -8,6 +8,4 @@ resources:
  - tsigkey.yaml
  - zones.yaml
  - acme-unkin-net
-  - main-unkin-net
-  - edge-unkin-net
  - agent-dns-rolebinding.yaml
@@ -1,6 +0,0 @@
---
-apiVersion: kustomize.config.k8s.io/v1beta1
-kind: Kustomization
-
-resources:
-  - mail-in.yaml
@@ -1,13 +0,0 @@
---
-apiVersion: bind.unkin.net/v1alpha1
-kind: DNSRecord
-metadata:
-  name: main-mail-in-a
-  namespace: bind-external
-spec:
-  zoneRef: main-unkin-net
-  name: "mail-in"
-  type: A
-  ttl: 3600
-  values:
-    - 103.216.191.185
@@ -1,13 +0,0 @@
---
-apiVersion: bind.unkin.net/v1alpha1
-kind: DNSRecord
-metadata:
-  name: main-acme-challenge-cname
-  namespace: bind-external
-spec:
-  zoneRef: main-unkin-net
-  name: "_acme-challenge"
-  type: CNAME
-  ttl: 3600
-  values:
-    - _acme-challenge.main.acme.unkin.net.
@@ -1,13 +0,0 @@
---
-apiVersion: bind.unkin.net/v1alpha1
-kind: DNSRecord
-metadata:
-  name: main-au-syd1-pve-api-cname
-  namespace: bind-external
-spec:
-  zoneRef: main-unkin-net
-  name: "au-syd1-pve-api"
-  type: CNAME
-  ttl: 3600
-  values:
-    - lb1.unkin.net.
@@ -1,13 +0,0 @@
---
-apiVersion: bind.unkin.net/v1alpha1
-kind: DNSRecord
-metadata:
-  name: main-au-syd1-pve-cname
-  namespace: bind-external
-spec:
-  zoneRef: main-unkin-net
-  name: "au-syd1-pve"
-  type: CNAME
-  ttl: 3600
-  values:
-    - lb1.unkin.net.
@@ -1,13 +0,0 @@
---
-apiVersion: bind.unkin.net/v1alpha1
-kind: DNSRecord
-metadata:
-  name: main-grafana-cname
-  namespace: bind-external
-spec:
-  zoneRef: main-unkin-net
-  name: "grafana"
-  type: CNAME
-  ttl: 3600
-  values:
-    - lb1.unkin.net.
@@ -1,15 +0,0 @@
---
-apiVersion: kustomize.config.k8s.io/v1beta1
-kind: Kustomization
-
-resources:
-  - acme-challenge.yaml
-  - au-syd1-pve.yaml
-  - au-syd1-pve-api.yaml
-  - grafana.yaml
-  - lidarr.yaml
-  - nzbget.yaml
-  - prowlarr.yaml
-  - radarr.yaml
-  - readarr.yaml
-  - sonarr.yaml
@@ -1,13 +0,0 @@
---
-apiVersion: bind.unkin.net/v1alpha1
-kind: DNSRecord
-metadata:
-  name: main-lidarr-cname
-  namespace: bind-external
-spec:
-  zoneRef: main-unkin-net
-  name: "lidarr"
-  type: CNAME
-  ttl: 3600
-  values:
-    - lb1.unkin.net.
@@ -1,13 +0,0 @@
---
-apiVersion: bind.unkin.net/v1alpha1
-kind: DNSRecord
-metadata:
-  name: main-nzbget-cname
-  namespace: bind-external
-spec:
-  zoneRef: main-unkin-net
-  name: "nzbget"
-  type: CNAME
-  ttl: 3600
-  values:
-    - lb1.unkin.net.
@@ -1,13 +0,0 @@
---
-apiVersion: bind.unkin.net/v1alpha1
-kind: DNSRecord
-metadata:
-  name: main-prowlarr-cname
-  namespace: bind-external
-spec:
-  zoneRef: main-unkin-net
-  name: "prowlarr"
-  type: CNAME
-  ttl: 3600
-  values:
-    - lb1.unkin.net.
@@ -1,13 +0,0 @@
---
-apiVersion: bind.unkin.net/v1alpha1
-kind: DNSRecord
-metadata:
-  name: main-radarr-cname
-  namespace: bind-external
-spec:
-  zoneRef: main-unkin-net
-  name: "radarr"
-  type: CNAME
-  ttl: 3600
-  values:
-    - lb1.unkin.net.
@@ -1,13 +0,0 @@
---
-apiVersion: bind.unkin.net/v1alpha1
-kind: DNSRecord
-metadata:
-  name: main-readarr-cname
-  namespace: bind-external
-spec:
-  zoneRef: main-unkin-net
-  name: "readarr"
-  type: CNAME
-  ttl: 3600
-  values:
-    - lb1.unkin.net.
@@ -1,13 +0,0 @@
---
-apiVersion: bind.unkin.net/v1alpha1
-kind: DNSRecord
-metadata:
-  name: main-sonarr-cname
-  namespace: bind-external
-spec:
-  zoneRef: main-unkin-net
-  name: "sonarr"
-  type: CNAME
-  ttl: 3600
-  values:
-    - lb1.unkin.net.
@@ -1,9 +0,0 @@
---
-apiVersion: kustomize.config.k8s.io/v1beta1
-kind: Kustomization
-
-resources:
-  - a
-  - mx
-  - txt
-  - cname
@@ -1,14 +0,0 @@
---
-apiVersion: bind.unkin.net/v1alpha1
-kind: DNSRecord
-metadata:
-  name: main-apex-mx
-  namespace: bind-external
-spec:
-  zoneRef: main-unkin-net
-  name: "@"
-  type: MX
-  ttl: 3600
-  values:
-    - "10 mta1.edge.unkin.net."
-    - "20 mta2.edge.unkin.net."
@@ -1,6 +0,0 @@
---
-apiVersion: kustomize.config.k8s.io/v1beta1
-kind: Kustomization
-
-resources:
-  - apex.yaml
@@ -1,13 +0,0 @@
---
-apiVersion: bind.unkin.net/v1alpha1
-kind: DNSRecord
-metadata:
-  name: main-apex-txt
-  namespace: bind-external
-spec:
-  zoneRef: main-unkin-net
-  name: "@"
-  type: TXT
-  ttl: 3600
-  values:
-    - '"v=spf1 ip4:66.226.148.207 ip4:66.226.149.50 -all"'
@@ -1,13 +0,0 @@
---
-apiVersion: bind.unkin.net/v1alpha1
-kind: DNSRecord
-metadata:
-  name: main-dmarc-txt
-  namespace: bind-external
-spec:
-  zoneRef: main-unkin-net
-  name: "_dmarc"
-  type: TXT
-  ttl: 3600
-  values:
-    - '"v=DMARC1; p=none; rua=mailto:dmarc@unkin.net; adkim=r; aspf=r"'
@@ -1,7 +0,0 @@
---
-apiVersion: kustomize.config.k8s.io/v1beta1
-kind: Kustomization
-
-resources:
-  - apex.yaml
-  - dmarc.yaml
@@ -28,39 +28,3 @@ spec:
      type: A
      ttl: 3600
      values: ["103.216.191.185"]
---
-# Public mail zones, delegated from Google Cloud DNS to acme-ns1.unkin.net like
-# acme.unkin.net. DNSRecords are applied with the zone's update key.
-apiVersion: bind.unkin.net/v1alpha1
-kind: BindZone
-metadata:
-  name: main-unkin-net
-  namespace: bind-external
-spec:
-  clusterRef: bind-external
-  zoneName: main.unkin.net
-  type: primary
-  defaultTTL: 3600
-  dynamicUpdate: true
-  updateKeyRef: certmanager
-  allowTransfer:
-    - key certmanager
-  nameservers:
-    - acme-ns1.unkin.net.
---
-apiVersion: bind.unkin.net/v1alpha1
-kind: BindZone
-metadata:
-  name: edge-unkin-net
-  namespace: bind-external
-spec:
-  clusterRef: bind-external
-  zoneName: edge.unkin.net
-  type: primary
-  defaultTTL: 3600
-  dynamicUpdate: true
-  updateKeyRef: certmanager
-  allowTransfer:
-    - key certmanager
-  nameservers:
-    - acme-ns1.unkin.net.
@@ -7,3 +7,4 @@ resources:
  - acls.yaml
  - view.yaml
  - forward-zones.yaml
+  - rbl-zones.yaml
@@ -0,0 +1,121 @@
+# DNSBLs refuse queries relayed via public resolvers, so these zones resolve directly.
+---
+apiVersion: bind.unkin.net/v1alpha1
+kind: BindZone
+metadata:
+  name: rbl-spamhaus-org
+  namespace: bind-internal
+spec:
+  clusterRef: bind-resolvers
+  viewRef: openforwarder
+  zoneName: spamhaus.org
+  type: forward
+  catalog: false
+---
+apiVersion: bind.unkin.net/v1alpha1
+kind: BindZone
+metadata:
+  name: rbl-mailspike-net
+  namespace: bind-internal
+spec:
+  clusterRef: bind-resolvers
+  viewRef: openforwarder
+  zoneName: mailspike.net
+  type: forward
+  catalog: false
+---
+apiVersion: bind.unkin.net/v1alpha1
+kind: BindZone
+metadata:
+  name: rbl-spameatingmonkey-net
+  namespace: bind-internal
+spec:
+  clusterRef: bind-resolvers
+  viewRef: openforwarder
+  zoneName: spameatingmonkey.net
+  type: forward
+  catalog: false
+---
+apiVersion: bind.unkin.net/v1alpha1
+kind: BindZone
+metadata:
+  name: rbl-dnswl-org
+  namespace: bind-internal
+spec:
+  clusterRef: bind-resolvers
+  viewRef: openforwarder
+  zoneName: dnswl.org
+  type: forward
+  catalog: false
+---
+apiVersion: bind.unkin.net/v1alpha1
+kind: BindZone
+metadata:
+  name: rbl-virusfree-cz
+  namespace: bind-internal
+spec:
+  clusterRef: bind-resolvers
+  viewRef: openforwarder
+  zoneName: virusfree.cz
+  type: forward
+  catalog: false
+---
+apiVersion: bind.unkin.net/v1alpha1
+kind: BindZone
+metadata:
+  name: rbl-blocklist-de
+  namespace: bind-internal
+spec:
+  clusterRef: bind-resolvers
+  viewRef: openforwarder
+  zoneName: blocklist.de
+  type: forward
+  catalog: false
+---
+apiVersion: bind.unkin.net/v1alpha1
+kind: BindZone
+metadata:
+  name: rbl-msbl-org
+  namespace: bind-internal
+spec:
+  clusterRef: bind-resolvers
+  viewRef: openforwarder
+  zoneName: msbl.org
+  type: forward
+  catalog: false
+---
+apiVersion: bind.unkin.net/v1alpha1
+kind: BindZone
+metadata:
+  name: rbl-surbl-org
+  namespace: bind-internal
+spec:
+  clusterRef: bind-resolvers
+  viewRef: openforwarder
+  zoneName: surbl.org
+  type: forward
+  catalog: false
+---
+apiVersion: bind.unkin.net/v1alpha1
+kind: BindZone
+metadata:
+  name: rbl-uribl-com
+  namespace: bind-internal
+spec:
+  clusterRef: bind-resolvers
+  viewRef: openforwarder
+  zoneName: uribl.com
+  type: forward
+  catalog: false
+---
+apiVersion: bind.unkin.net/v1alpha1
+kind: BindZone
+metadata:
+  name: rbl-rspamd-com
+  namespace: bind-internal
+spec:
+  clusterRef: bind-resolvers
+  viewRef: openforwarder
+  zoneName: rspamd.com
+  type: forward
+  catalog: false
@@ -23,14 +23,3 @@ spec:
    - "allow-query-cache { any; }"
    # pods have no IPv6 route; v6 NS attempts burn the recursion-query budget
    - "server ::/0 { bogus yes; }"
-    # RBL zones resolve directly: DNSBLs refuse queries relayed via public resolvers.
-    - 'zone "spamhaus.org" { type forward; forwarders { }; }'
-    - 'zone "mailspike.net" { type forward; forwarders { }; }'
-    - 'zone "spameatingmonkey.net" { type forward; forwarders { }; }'
-    - 'zone "dnswl.org" { type forward; forwarders { }; }'
-    - 'zone "virusfree.cz" { type forward; forwarders { }; }'
-    - 'zone "blocklist.de" { type forward; forwarders { }; }'
-    - 'zone "msbl.org" { type forward; forwarders { }; }'
-    - 'zone "surbl.org" { type forward; forwarders { }; }'
-    - 'zone "uribl.com" { type forward; forwarders { }; }'
-    - 'zone "rspamd.com" { type forward; forwarders { }; }'
@@ -11,3 +11,5 @@ data:
  DBPORT: "5432"
  DBUSER: encapi
  DBSSL: require
+  ENCAPI_OIDC_ISSUER: https://vault.service.consul:8200/v1/identity/oidc
+  SSL_CERT_FILE: /etc/ssl/combined/ca-certificates.crt
@@ -6,6 +6,7 @@ metadata:
  namespace: encapi
  annotations:
    configmap.reloader.stakater.com/auto: "true"
+    secret.reloader.stakater.com/reload: "vault-ca-cert"
 spec:
  replicas: 2
  selector:
@@ -21,9 +22,22 @@ spec:
        app: encapi
    spec:
      automountServiceAccountToken: true
+      initContainers:
+        - name: combine-certs
+          image: alpine:3
+          command:
+            - sh
+            - -c
+            - cat /etc/ssl/certs/ca-certificates.crt /custom-ca/ca.crt > /combined-certs/ca-certificates.crt
+          volumeMounts:
+            - name: vault-ca-cert
+              mountPath: /custom-ca
+              readOnly: true
+            - name: combined-certs
+              mountPath: /combined-certs
      containers:
        - name: encapi
-          image: artifactapi.k8s.syd1.au.unkin.net/docker-internal/encapi:v0.1.2
+          image: artifactapi.k8s.syd1.au.unkin.net/docker-internal/encapi:v0.2.0
          imagePullPolicy: IfNotPresent
          ports:
            - containerPort: 8000
@@ -38,6 +52,10 @@ spec:
            - secretRef:
                name: environment
                optional: false
+          volumeMounts:
+            - name: combined-certs
+              mountPath: /etc/ssl/combined
+              readOnly: true
          livenessProbe:
            httpGet:
              path: /healthz
@@ -61,4 +79,13 @@ spec:
            limits:
              cpu: 500m
              memory: 256Mi
+      volumes:
+        - name: vault-ca-cert
+          secret:
+            secretName: vault-ca-cert
+            items:
+              - key: ca.crt
+                path: ca.crt
+        - name: combined-certs
+          emptyDir: {}
      restartPolicy: Always
@@ -85,7 +85,7 @@ spec:
      archive_mode: "on"
      archive_timeout: 5min
      dynamic_shared_memory_type: posix
-      effective_cache_size: 256MB
+      effective_cache_size: 1GB
      full_page_writes: "on"
      log_destination: csvlog
      log_directory: /controller/log
@@ -98,7 +98,7 @@ spec:
      max_parallel_workers: "16"
      max_replication_slots: "16"
      max_worker_processes: "16"
-      shared_buffers: 128MB
+      shared_buffers: 256MB
      shared_memory_type: mmap
      ssl_max_protocol_version: TLSv1.3
      ssl_min_protocol_version: TLSv1.3
@@ -127,10 +127,10 @@ spec:
  resources:
    limits:
      cpu: 500m
-      memory: 512Mi
+      memory: 2Gi
    requests:
      cpu: 50m
-      memory: 256Mi
+      memory: 1Gi
  smartShutdownTimeout: 180
  startDelay: 3600
  stopDelay: 1800
Author	SHA1	Message	Date
unkin-agent	99551420ea	Require tokens for artifactapi uploads ci/woodpecker/pr/pre-commit Pipeline was successful Details ci/woodpecker/pr/kubeconform Pipeline was successful Details	2026-10-26 00:59:43 +11:00
unkin-agent	0552be6028	Bump artifactapi to v3.25.0 (#573 ) Artifactapi v3.25.0 adds github_rpm cache_repodata toggle and general fixes. - Bump artifactapi and artifactapi-ui images to v3.25.0 Reviewed-on: #573 Co-authored-by: unkin-agent <unkin-agent@unkin.net> Co-committed-by: unkin-agent <unkin-agent@unkin.net>	2026-10-25 23:45:54 +11:00
unkin-agent	4b5d14cf52	Bump artifactapi to v3.24.0 (#572 ) Pull in artifactapi v3.24.0 images (per-remote sync_interval and GitHub sync spreading). - Update artifactapi image from v3.23.0 to v3.24.0 - Update artifactapi-ui image from v3.23.0 to v3.24.0 Reviewed-on: #572 Co-authored-by: unkin-agent <unkin-agent@unkin.net> Co-committed-by: unkin-agent <unkin-agent@unkin.net>	2026-10-25 20:25:21 +11:00
unkin-agent	ec35ef9830	bump artifactapi to v3.23.0 (#571 ) v3.23.0 adds virtual alpine repositories and drops local files and metadata when a repo is deleted. - pin api, ui and image-keeper to v3.23.0 Reviewed-on: #571 Co-authored-by: unkin-agent <unkin-agent@unkin.net> Co-committed-by: unkin-agent <unkin-agent@unkin.net>	2026-10-24 20:40:34 +11:00
unkin-agent	bb0cc51e0a	bump artifactapi to v3.22.0 (#570 ) v3.22.0 adds the vcs remote type for git provider source archives and release assets. - pin api, ui and image-keeper to v3.22.0 Reviewed-on: #570 Co-authored-by: unkin-agent <unkin-agent@unkin.net> Co-committed-by: unkin-agent <unkin-agent@unkin.net>	2026-10-24 17:28:37 +11:00
unkin-agent	bcde44ffab	bind-resolvers: RBL zones as BindZones (#569 ) bind-operator v0.4.0 renders a forward BindZone without forwarders as `forwarders { };`, so the RBL direct-resolution zones no longer need raw zone clauses in the openforwarder view extraOptions. - add rbl-zones.yaml with one forwarder-less forward BindZone per RBL domain - remove the raw RBL zone lines from the openforwarder view Reviewed-on: #569 Co-authored-by: unkin-agent <unkin-agent@unkin.net> Co-committed-by: unkin-agent <unkin-agent@unkin.net>	2026-10-24 17:06:09 +11:00
unkin-agent	90600e3840	bump artifactapi to v3.21.0 (#568 ) v3.21.0 adds virtual deb repositories. - pin api, ui and image-keeper to v3.21.0 Reviewed-on: #568 Co-authored-by: unkin-agent <unkin-agent@unkin.net> Co-committed-by: unkin-agent <unkin-agent@unkin.net>	2026-10-24 16:41:34 +11:00
unkin-agent	2dad204428	Deploy encapi v0.2.0 with Vault OIDC (#567 ) encapi v0.2.0 authenticates writes with Vault identity OIDC tokens; it must validate the issuer, which is served with the internal Vault CA. - bump encapi image to v0.2.0 - set ENCAPI_OIDC_ISSUER to the Vault identity OIDC issuer - trust the Vault CA via a combined bundle and SSL_CERT_FILE, matching artifactapi Reviewed-on: #567 Co-authored-by: unkin-agent <unkin-agent@unkin.net> Co-committed-by: unkin-agent <unkin-agent@unkin.net>	2026-10-23 23:02:00 +11:00
unkin-agent	f4cd6160ab	Raise puppet-postgres memory (#566 ) The puppet-postgres primary is repeatedly OOMKilled at its 512Mi limit, causing repeated failovers; one left a replica diverged and serving stale PuppetDB reads. - raise memory request 256Mi -> 1Gi and limit 512Mi -> 2Gi - raise shared_buffers 128MB -> 256MB - raise effective_cache_size 256MB -> 1GB Reviewed-on: #566 Co-authored-by: unkin-agent <unkin-agent@unkin.net> Co-committed-by: unkin-agent <unkin-agent@unkin.net>	2026-10-23 21:25:31 +11:00
unkin-agent	45aa23942f	bump artifactapi to v3.20.0 (#565 ) v3.20.0 adds virtual puppet repositories and filtered remote Forge release listings. - pin api, ui and image-keeper to v3.20.0 Reviewed-on: #565 Co-authored-by: unkin-agent <unkin-agent@unkin.net> Co-committed-by: unkin-agent <unkin-agent@unkin.net>	2026-10-20 22:25:18 +11:00