feat: add artifact-keeper

- converted the artifact-keeper helm-chart into kustomization manifests
- converted postgres to cnpg
- moved secrets to vault

.woodpecker/kubeconform.yaml

@@ -6,13 +6,3 @@ steps:
     image: git.unkin.net/unkin/almalinux9-kubetest:20260319
     commands:
       - make kubeconform
-    backend_options:
-      kubernetes:
-        serviceAccountName: default
-        resources:
-          requests:
-            memory: 512Mi
-            cpu: 1
-          limits:
-            memory: 2Gi
-            cpu: 2

.woodpecker/pre-commit.yaml

@@ -6,13 +6,3 @@ steps:
     image: git.unkin.net/unkin/almalinux9-base:20260308
     commands:
       - uvx pre-commit run --all-files
-    backend_options:
-      kubernetes:
-        serviceAccountName: default
-        resources:
-          requests:
-            memory: 256Mi
-            cpu: 250m
-          limits:
-            memory: 1Gi
-            cpu: 1

apps/base/artifact-keeper/cnpg_cluster.yaml

@@ -2,20 +2,23 @@
 apiVersion: postgresql.cnpg.io/v1
 kind: Cluster
 metadata:
-  name: paperclip-postgres
+  name: artifact-keeper-postgres
-  namespace: paperclip
+  namespace: artifact-keeper
 spec:
   affinity:
     podAntiAffinityType: preferred
   bootstrap:
     initdb:
-      database: paperclip
+      database: artifact_registry
       encoding: UTF8
       localeCType: C
       localeCollate: C
-      owner: paperclip
+      owner: registry
       secret:
         name: postgres-credentials
+      postInitSQL:
+        - CREATE DATABASE dependency_track OWNER registry;
+        - GRANT ALL PRIVILEGES ON DATABASE dependency_track TO registry;
   enablePDB: true
   enableSuperuserAccess: false
   failoverDelay: 0
@@ -76,8 +79,8 @@ spec:
     updateInterval: 30
   resources:
     limits:
-      cpu: 500m
+      cpu: "1"
-      memory: 512Mi
+      memory: 1Gi
     requests:
       cpu: 250m
       memory: 256Mi
@@ -86,6 +89,6 @@ spec:
   stopDelay: 1800
   storage:
     resizeInUseVolumes: true
-    size: 10Gi
+    size: 20Gi
     storageClass: cephrbd-fast-delete
   switchoverDelay: 3600

apps/base/artifact-keeper/cnpg_pooler.yaml

@@ -2,11 +2,11 @@
 apiVersion: postgresql.cnpg.io/v1
 kind: Pooler
 metadata:
-  name: paperclip-pooler-rw
+  name: artifact-keeper-postgres-pooler
-  namespace: paperclip
+  namespace: artifact-keeper
 spec:
   cluster:
-    name: paperclip-postgres
+    name: artifact-keeper-postgres
   instances: 2
   pgbouncer:
     parameters:
@@ -17,7 +17,7 @@ spec:
   template:
     metadata:
       labels:
-        app: pooler
+        app: artifact-keeper-pooler
     spec:
       affinity:
         podAntiAffinity:
@@ -27,7 +27,7 @@ spec:
                   - key: app
                     operator: In
                     values:
-                      - pooler
+                      - artifact-keeper-pooler
               topologyKey: kubernetes.io/hostname
       containers: []
   type: rw

apps/base/artifact-keeper/configmap_app-config.yaml

@@ -0,0 +1,20 @@
+---
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: config
+  namespace: artifact-keeper
+  labels:
+    app.kubernetes.io/name: artifact-keeper
+    app.kubernetes.io/instance: ak
+    app.kubernetes.io/part-of: artifact-keeper
+data:
+  BIND_ADDRESS: "0.0.0.0:8080"
+  LOG_LEVEL: "info,artifact_keeper=debug"
+  STORAGE_BACKEND: "s3"
+  MEILISEARCH_URL: "http://meilisearch:7700"
+  TRIVY_URL: "http://trivy:8090"
+  DEPENDENCY_TRACK_URL: "http://dtrack:8080"
+  DEPENDENCY_TRACK_ENABLED: "true"
+  SCAN_WORKSPACE_PATH: "/scan-workspace"
+  PLUGINS_DIR: "/data/plugins"

apps/base/artifact-keeper/configmap_s3-env.yaml

@@ -0,0 +1,15 @@
+---
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: s3-env
+  namespace: artifact-keeper
+  labels:
+    app.kubernetes.io/name: artifact-keeper
+    app.kubernetes.io/instance: ak
+    app.kubernetes.io/part-of: artifact-keeper
+data:
+  S3_ENDPOINT: "https://radosgw.service.consul"
+  S3_BUCKET: "artifact-keeper"
+  S3_REGION: "ap-southeast-2"
+  S3_PATH_STYLE: "true"

apps/base/artifact-keeper/deployment_backend.yaml

@@ -0,0 +1,171 @@
+---
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: backend
+  namespace: artifact-keeper
+  labels:
+    app.kubernetes.io/name: artifact-keeper
+    app.kubernetes.io/instance: ak
+    app.kubernetes.io/part-of: artifact-keeper
+    app.kubernetes.io/component: backend
+  annotations:
+    reloader.stakater.com/auto: "true"
+spec:
+  replicas: 2
+  selector:
+    matchLabels:
+      app.kubernetes.io/name: artifact-keeper
+      app.kubernetes.io/instance: ak
+      app.kubernetes.io/component: backend
+  template:
+    metadata:
+      labels:
+        app.kubernetes.io/name: artifact-keeper
+        app.kubernetes.io/instance: ak
+        app.kubernetes.io/component: backend
+    spec:
+      serviceAccountName: backend
+      automountServiceAccountToken: false
+      securityContext:
+        runAsNonRoot: true
+        runAsUser: 1000
+        fsGroup: 1000
+      affinity:
+        podAntiAffinity:
+          preferredDuringSchedulingIgnoredDuringExecution:
+            - weight: 100
+              podAffinityTerm:
+                labelSelector:
+                  matchExpressions:
+                    - key: app.kubernetes.io/component
+                      operator: In
+                      values:
+                        - backend
+                topologyKey: kubernetes.io/hostname
+      initContainers:
+        - name: wait-for-postgres
+          image: postgres:16-alpine
+          securityContext:
+            readOnlyRootFilesystem: true
+            allowPrivilegeEscalation: false
+            capabilities:
+              drop:
+                - ALL
+          resources:
+            requests:
+              cpu: 10m
+              memory: 16Mi
+            limits:
+              cpu: 100m
+              memory: 64Mi
+          command: ["/bin/sh", "-c"]
+          args:
+            - |
+              echo "Waiting for PostgreSQL..."
+              until pg_isready -h artifact-keeper-postgres-pooler -p 5432 -U registry; do
+                sleep 3
+              done
+              echo "PostgreSQL is ready"
+        - name: wait-for-meilisearch
+          image: alpine:3.20
+          securityContext:
+            readOnlyRootFilesystem: true
+            allowPrivilegeEscalation: false
+            capabilities:
+              drop:
+                - ALL
+          resources:
+            requests:
+              cpu: 10m
+              memory: 16Mi
+              ephemeral-storage: 32Mi
+            limits:
+              cpu: 100m
+              memory: 64Mi
+              ephemeral-storage: 64Mi
+          command: ["/bin/sh", "-c"]
+          args:
+            - |
+              echo "Waiting for Meilisearch..."
+              until wget -qO- http://meilisearch:7700/health >/dev/null 2>&1; do
+                sleep 3
+              done
+              echo "Meilisearch is ready"
+      containers:
+        - name: backend
+          image: "ghcr.io/artifact-keeper/artifact-keeper-backend:dev"
+          imagePullPolicy: Always
+          securityContext:
+            readOnlyRootFilesystem: true
+            allowPrivilegeEscalation: false
+            capabilities:
+              drop:
+                - ALL
+          command: ["/bin/sh", "-c"]
+          args:
+            - |
+              if [ -f /shared/dtrack-api-key ] && [ -s /shared/dtrack-api-key ]; then
+                export DEPENDENCY_TRACK_API_KEY="$(cat /shared/dtrack-api-key)"
+              fi
+              exec /usr/local/bin/artifact-keeper
+          ports:
+            - name: http
+              containerPort: 8080
+              protocol: TCP
+            - name: grpc
+              containerPort: 9090
+              protocol: TCP
+          envFrom:
+            - configMapRef:
+                name: config
+            - configMapRef:
+                name: s3-env
+            - secretRef:
+                name: s3-credentials
+            - secretRef:
+                name: app-secrets
+          resources:
+            limits:
+              cpu: "2"
+              memory: 2Gi
+            requests:
+              cpu: 250m
+              memory: 256Mi
+          livenessProbe:
+            httpGet:
+              path: /livez
+              port: http
+            periodSeconds: 15
+            timeoutSeconds: 5
+            failureThreshold: 5
+          volumeMounts:
+            - name: tmp
+              mountPath: /tmp
+            - name: storage
+              mountPath: /data/storage
+              subPath: storage
+            - name: storage
+              mountPath: /data/backups
+              subPath: backups
+            - name: storage
+              mountPath: /data/plugins
+              subPath: plugins
+            - name: scan-workspace
+              mountPath: /scan-workspace
+            - name: shared-config
+              mountPath: /shared
+              readOnly: true
+      volumes:
+        - name: tmp
+          emptyDir:
+            sizeLimit: 256Mi
+        - name: storage
+          persistentVolumeClaim:
+            claimName: storage
+        - name: scan-workspace
+          persistentVolumeClaim:
+            claimName: scan-workspace
+        - name: shared-config
+          persistentVolumeClaim:
+            claimName: shared-config

apps/base/artifact-keeper/deployment_dtrack.yaml

@@ -0,0 +1,111 @@
+---
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: dtrack
+  namespace: artifact-keeper
+  labels:
+    app.kubernetes.io/name: artifact-keeper
+    app.kubernetes.io/instance: ak
+    app.kubernetes.io/part-of: artifact-keeper
+    app.kubernetes.io/component: dependency-track
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app.kubernetes.io/name: artifact-keeper
+      app.kubernetes.io/instance: ak
+      app.kubernetes.io/component: dependency-track
+  template:
+    metadata:
+      labels:
+        app.kubernetes.io/name: artifact-keeper
+        app.kubernetes.io/instance: ak
+        app.kubernetes.io/component: dependency-track
+    spec:
+      automountServiceAccountToken: false
+      securityContext:
+        runAsNonRoot: true
+        runAsUser: 1000
+        fsGroup: 1000
+      initContainers:
+        - name: wait-for-postgres
+          image: postgres:16-alpine
+          securityContext:
+            readOnlyRootFilesystem: true
+            allowPrivilegeEscalation: false
+            capabilities:
+              drop:
+                - ALL
+          resources:
+            requests:
+              cpu: 10m
+              memory: 16Mi
+            limits:
+              cpu: 100m
+              memory: 64Mi
+          command: ["/bin/sh", "-c"]
+          args:
+            - |
+              echo "Waiting for PostgreSQL..."
+              until pg_isready -h artifact-keeper-postgres-pooler -p 5432 -U registry; do
+                sleep 3
+              done
+              echo "PostgreSQL is ready"
+      containers:
+        - name: dtrack-api
+          image: "dependencytrack/apiserver:4.11.4"
+          imagePullPolicy: IfNotPresent
+          securityContext:
+            readOnlyRootFilesystem: true
+            allowPrivilegeEscalation: false
+            capabilities:
+              drop:
+                - ALL
+          ports:
+            - name: http
+              containerPort: 8080
+              protocol: TCP
+          env:
+            - name: ALPINE_DATABASE_MODE
+              value: "external"
+            - name: ALPINE_DATABASE_URL
+              value: "jdbc:postgresql://artifact-keeper-postgres-pooler:5432/dependency_track"
+            - name: ALPINE_DATABASE_DRIVER
+              value: "org.postgresql.Driver"
+            - name: ALPINE_DATABASE_USERNAME
+              value: "registry"
+            - name: ALPINE_DATABASE_PASSWORD
+              valueFrom:
+                secretKeyRef:
+                  name: postgres-credentials
+                  key: password
+            - name: ALPINE_DATA_DIRECTORY
+              value: "/data"
+            - name: ALPINE_ENFORCE_AUTHENTICATION
+              value: "true"
+            - name: ALPINE_CORS_ENABLED
+              value: "true"
+            - name: ALPINE_CORS_ALLOW_ORIGIN
+              value: "*"
+            - name: JAVA_OPTIONS
+              value: "-Xmx4g"
+          resources:
+            limits:
+              cpu: "2"
+              memory: 6Gi
+            requests:
+              cpu: 250m
+              memory: 4Gi
+          volumeMounts:
+            - name: dtrack-data
+              mountPath: /data
+            - name: tmp
+              mountPath: /tmp
+      volumes:
+        - name: tmp
+          emptyDir:
+            sizeLimit: 256Mi
+        - name: dtrack-data
+          persistentVolumeClaim:
+            claimName: dtrack

apps/base/artifact-keeper/deployment_meilisearch.yaml

@@ -0,0 +1,154 @@
+---
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: meilisearch
+  namespace: artifact-keeper
+  labels:
+    app.kubernetes.io/name: artifact-keeper
+    app.kubernetes.io/instance: ak
+    app.kubernetes.io/part-of: artifact-keeper
+    app.kubernetes.io/component: meilisearch
+spec:
+  replicas: 1
+  strategy:
+    type: Recreate
+  selector:
+    matchLabels:
+      app.kubernetes.io/name: artifact-keeper
+      app.kubernetes.io/instance: ak
+      app.kubernetes.io/component: meilisearch
+  template:
+    metadata:
+      labels:
+        app.kubernetes.io/name: artifact-keeper
+        app.kubernetes.io/instance: ak
+        app.kubernetes.io/component: meilisearch
+    spec:
+      automountServiceAccountToken: false
+      securityContext:
+        runAsNonRoot: true
+        runAsUser: 1000
+        fsGroup: 1000
+      initContainers:
+        - name: fix-ownership
+          image: busybox:1.37
+          securityContext:
+            runAsNonRoot: false
+            runAsUser: 0
+            readOnlyRootFilesystem: true
+            allowPrivilegeEscalation: false
+            capabilities:
+              drop:
+                - ALL
+              add:
+                - CHOWN
+                - FOWNER
+          resources:
+            requests:
+              cpu: 10m
+              memory: 16Mi
+              ephemeral-storage: 32Mi
+            limits:
+              cpu: 100m
+              memory: 64Mi
+              ephemeral-storage: 64Mi
+          command: ["sh", "-c", "chown -R 1000:1000 /meili_data"]
+          volumeMounts:
+            - name: meilisearch-data
+              mountPath: /meili_data
+        - name: version-guard
+          image: busybox:1.37
+          securityContext:
+            readOnlyRootFilesystem: true
+            allowPrivilegeEscalation: false
+            capabilities:
+              drop:
+                - ALL
+          resources:
+            requests:
+              cpu: 10m
+              memory: 16Mi
+            limits:
+              cpu: 100m
+              memory: 64Mi
+          command: ["sh", "-c"]
+          args:
+            - |
+              EXPECTED="v1.12"
+              VERSION_FILE="/meili_data/data.ms/VERSION"
+              if [ ! -f "$VERSION_FILE" ]; then
+                echo "No existing database, fresh start"
+                exit 0
+              fi
+              CURRENT=$(cat "$VERSION_FILE" 2>/dev/null || echo "unknown")
+              echo "Current DB version: $CURRENT, expected image: $EXPECTED"
+              if echo "$CURRENT" | grep -qv "$(echo $EXPECTED | sed 's/^v//')"; then
+                echo "Version mismatch — wiping data.ms for clean re-index"
+                rm -rf /meili_data/data.ms
+                echo "Done. Backend will re-index automatically."
+              else
+                echo "Versions match, keeping existing data"
+              fi
+          volumeMounts:
+            - name: meilisearch-data
+              mountPath: /meili_data
+      containers:
+        - name: meilisearch
+          image: "getmeili/meilisearch:v1.12"
+          imagePullPolicy: IfNotPresent
+          securityContext:
+            readOnlyRootFilesystem: false
+            allowPrivilegeEscalation: false
+            capabilities:
+              drop:
+                - ALL
+          ports:
+            - name: http
+              containerPort: 7700
+              protocol: TCP
+          env:
+            - name: MEILI_MASTER_KEY
+              valueFrom:
+                secretKeyRef:
+                  name: app-secrets
+                  key: MEILISEARCH_API_KEY
+            - name: MEILI_ENV
+              value: "production"
+            - name: MEILI_MAX_INDEXING_THREADS
+              value: "4"
+          resources:
+            limits:
+              cpu: "1"
+              memory: 8Gi
+            requests:
+              cpu: 250m
+              memory: 512Mi
+          readinessProbe:
+            httpGet:
+              path: /health
+              port: 7700
+            initialDelaySeconds: 5
+            periodSeconds: 10
+            timeoutSeconds: 5
+            failureThreshold: 5
+          livenessProbe:
+            httpGet:
+              path: /health
+              port: 7700
+            initialDelaySeconds: 10
+            periodSeconds: 10
+            timeoutSeconds: 5
+            failureThreshold: 5
+          volumeMounts:
+            - name: meilisearch-data
+              mountPath: /meili_data
+            - name: tmp
+              mountPath: /tmp
+      volumes:
+        - name: tmp
+          emptyDir:
+            sizeLimit: 256Mi
+        - name: meilisearch-data
+          persistentVolumeClaim:
+            claimName: meilisearch

apps/base/artifact-keeper/deployment_trivy.yaml

@@ -0,0 +1,87 @@
+---
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: trivy
+  namespace: artifact-keeper
+  labels:
+    app.kubernetes.io/name: artifact-keeper
+    app.kubernetes.io/instance: ak
+    app.kubernetes.io/part-of: artifact-keeper
+    app.kubernetes.io/component: trivy
+spec:
+  replicas: 1
+  strategy:
+    type: Recreate
+  selector:
+    matchLabels:
+      app.kubernetes.io/name: artifact-keeper
+      app.kubernetes.io/instance: ak
+      app.kubernetes.io/component: trivy
+  template:
+    metadata:
+      labels:
+        app.kubernetes.io/name: artifact-keeper
+        app.kubernetes.io/instance: ak
+        app.kubernetes.io/component: trivy
+    spec:
+      automountServiceAccountToken: false
+      securityContext:
+        runAsNonRoot: true
+        runAsUser: 10000
+        fsGroup: 10000
+      containers:
+        - name: trivy
+          image: "aquasec/trivy:0.62.1"
+          imagePullPolicy: IfNotPresent
+          securityContext:
+            readOnlyRootFilesystem: true
+            allowPrivilegeEscalation: false
+            capabilities:
+              drop:
+                - ALL
+          command: ["trivy"]
+          args: ["server", "--listen", "0.0.0.0:8090", "--cache-dir", "/home/trivy/.cache"]
+          ports:
+            - name: http
+              containerPort: 8090
+              protocol: TCP
+          resources:
+            limits:
+              cpu: "1"
+              memory: 2Gi
+            requests:
+              cpu: 250m
+              memory: 256Mi
+          readinessProbe:
+            tcpSocket:
+              port: 8090
+            initialDelaySeconds: 15
+            periodSeconds: 10
+            timeoutSeconds: 5
+            failureThreshold: 5
+          livenessProbe:
+            tcpSocket:
+              port: 8090
+            initialDelaySeconds: 30
+            periodSeconds: 30
+            timeoutSeconds: 5
+            failureThreshold: 3
+          volumeMounts:
+            - name: trivy-cache
+              mountPath: /home/trivy/.cache
+            - name: tmp
+              mountPath: /tmp
+            - name: scan-workspace
+              mountPath: /scan-workspace
+              readOnly: true
+      volumes:
+        - name: tmp
+          emptyDir:
+            sizeLimit: 256Mi
+        - name: trivy-cache
+          persistentVolumeClaim:
+            claimName: trivy-cache
+        - name: scan-workspace
+          persistentVolumeClaim:
+            claimName: scan-workspace

apps/base/artifact-keeper/deployment_web.yaml

@@ -0,0 +1,98 @@
+---
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: web
+  namespace: artifact-keeper
+  labels:
+    app.kubernetes.io/name: artifact-keeper
+    app.kubernetes.io/instance: ak
+    app.kubernetes.io/part-of: artifact-keeper
+    app.kubernetes.io/component: web
+spec:
+  replicas: 2
+  selector:
+    matchLabels:
+      app.kubernetes.io/name: artifact-keeper
+      app.kubernetes.io/instance: ak
+      app.kubernetes.io/component: web
+  template:
+    metadata:
+      labels:
+        app.kubernetes.io/name: artifact-keeper
+        app.kubernetes.io/instance: ak
+        app.kubernetes.io/component: web
+    spec:
+      automountServiceAccountToken: false
+      securityContext:
+        runAsNonRoot: true
+        runAsUser: 1000
+        fsGroup: 1000
+      affinity:
+        podAntiAffinity:
+          preferredDuringSchedulingIgnoredDuringExecution:
+            - weight: 100
+              podAffinityTerm:
+                labelSelector:
+                  matchExpressions:
+                    - key: app.kubernetes.io/component
+                      operator: In
+                      values:
+                        - web
+                topologyKey: kubernetes.io/hostname
+      containers:
+        - name: web
+          image: "ghcr.io/artifact-keeper/artifact-keeper-web:dev"
+          imagePullPolicy: Always
+          securityContext:
+            readOnlyRootFilesystem: true
+            allowPrivilegeEscalation: false
+            capabilities:
+              drop:
+                - ALL
+          ports:
+            - name: http
+              containerPort: 3000
+              protocol: TCP
+          env:
+            - name: NEXT_PUBLIC_API_URL
+              value: ""
+            - name: BACKEND_URL
+              value: "http://backend:8080"
+            - name: NODE_ENV
+              value: "production"
+          resources:
+            limits:
+              cpu: "1"
+              memory: 1Gi
+            requests:
+              cpu: 250m
+              memory: 256Mi
+          readinessProbe:
+            httpGet:
+              path: /
+              port: http
+            initialDelaySeconds: 10
+            periodSeconds: 10
+            timeoutSeconds: 5
+            failureThreshold: 5
+          livenessProbe:
+            httpGet:
+              path: /
+              port: http
+            initialDelaySeconds: 20
+            periodSeconds: 15
+            timeoutSeconds: 5
+            failureThreshold: 5
+          volumeMounts:
+            - name: tmp
+              mountPath: /tmp
+            - name: nextjs-cache
+              mountPath: /app/.next/cache
+      volumes:
+        - name: tmp
+          emptyDir:
+            sizeLimit: 256Mi
+        - name: nextjs-cache
+          emptyDir:
+            sizeLimit: 1Gi

apps/base/artifact-keeper/ingress.yaml

@@ -0,0 +1,286 @@
+---
+apiVersion: networking.k8s.io/v1
+kind: Ingress
+metadata:
+  name: artifact-keeper
+  namespace: artifact-keeper
+  annotations:
+    nginx.ingress.kubernetes.io/enable-cors: "true"
+    nginx.ingress.kubernetes.io/proxy-body-size: 10g
+    nginx.ingress.kubernetes.io/proxy-read-timeout: "600"
+    nginx.ingress.kubernetes.io/proxy-send-timeout: "600"
+    cert-manager.io/cluster-issuer: vault-issuer
+    cert-manager.io/common-name: artifacts.k8s.syd1.au.unkin.net
+    cert-manager.io/private-key-size: "4096"
+    external-dns.alpha.kubernetes.io/hostname: artifacts.k8s.syd1.au.unkin.net
+    external-dns.alpha.kubernetes.io/target: 198.18.200.0
+    nginx.ingress.kubernetes.io/ssl-redirect: "false"
+spec:
+  ingressClassName: nginx
+  rules:
+    - host: artifacts.k8s.syd1.au.unkin.net
+      http:
+        paths:
+          - path: /api
+            pathType: Prefix
+            backend:
+              service:
+                name: backend
+                port:
+                  number: 8080
+          - path: /health
+            pathType: Exact
+            backend:
+              service:
+                name: backend
+                port:
+                  number: 8080
+          - path: /ready
+            pathType: Exact
+            backend:
+              service:
+                name: backend
+                port:
+                  number: 8080
+          - path: /v2
+            pathType: Prefix
+            backend:
+              service:
+                name: backend
+                port:
+                  number: 8080
+          - path: /maven
+            pathType: Prefix
+            backend:
+              service:
+                name: backend
+                port:
+                  number: 8080
+          - path: /npm
+            pathType: Prefix
+            backend:
+              service:
+                name: backend
+                port:
+                  number: 8080
+          - path: /pypi
+            pathType: Prefix
+            backend:
+              service:
+                name: backend
+                port:
+                  number: 8080
+          - path: /nuget
+            pathType: Prefix
+            backend:
+              service:
+                name: backend
+                port:
+                  number: 8080
+          - path: /cargo
+            pathType: Prefix
+            backend:
+              service:
+                name: backend
+                port:
+                  number: 8080
+          - path: /gems
+            pathType: Prefix
+            backend:
+              service:
+                name: backend
+                port:
+                  number: 8080
+          - path: /go
+            pathType: Prefix
+            backend:
+              service:
+                name: backend
+                port:
+                  number: 8080
+          - path: /helm
+            pathType: Prefix
+            backend:
+              service:
+                name: backend
+                port:
+                  number: 8080
+          - path: /debian
+            pathType: Prefix
+            backend:
+              service:
+                name: backend
+                port:
+                  number: 8080
+          - path: /rpm
+            pathType: Prefix
+            backend:
+              service:
+                name: backend
+                port:
+                  number: 8080
+          - path: /alpine
+            pathType: Prefix
+            backend:
+              service:
+                name: backend
+                port:
+                  number: 8080
+          - path: /composer
+            pathType: Prefix
+            backend:
+              service:
+                name: backend
+                port:
+                  number: 8080
+          - path: /conan
+            pathType: Prefix
+            backend:
+              service:
+                name: backend
+                port:
+                  number: 8080
+          - path: /conda
+            pathType: Prefix
+            backend:
+              service:
+                name: backend
+                port:
+                  number: 8080
+          - path: /swift
+            pathType: Prefix
+            backend:
+              service:
+                name: backend
+                port:
+                  number: 8080
+          - path: /terraform
+            pathType: Prefix
+            backend:
+              service:
+                name: backend
+                port:
+                  number: 8080
+          - path: /cocoapods
+            pathType: Prefix
+            backend:
+              service:
+                name: backend
+                port:
+                  number: 8080
+          - path: /hex
+            pathType: Prefix
+            backend:
+              service:
+                name: backend
+                port:
+                  number: 8080
+          - path: /pub
+            pathType: Prefix
+            backend:
+              service:
+                name: backend
+                port:
+                  number: 8080
+          - path: /lfs
+            pathType: Prefix
+            backend:
+              service:
+                name: backend
+                port:
+                  number: 8080
+          - path: /ivy
+            pathType: Prefix
+            backend:
+              service:
+                name: backend
+                port:
+                  number: 8080
+          - path: /chef
+            pathType: Prefix
+            backend:
+              service:
+                name: backend
+                port:
+                  number: 8080
+          - path: /puppet
+            pathType: Prefix
+            backend:
+              service:
+                name: backend
+                port:
+                  number: 8080
+          - path: /ansible
+            pathType: Prefix
+            backend:
+              service:
+                name: backend
+                port:
+                  number: 8080
+          - path: /cran
+            pathType: Prefix
+            backend:
+              service:
+                name: backend
+                port:
+                  number: 8080
+          - path: /huggingface
+            pathType: Prefix
+            backend:
+              service:
+                name: backend
+                port:
+                  number: 8080
+          - path: /jetbrains
+            pathType: Prefix
+            backend:
+              service:
+                name: backend
+                port:
+                  number: 8080
+          - path: /vscode
+            pathType: Prefix
+            backend:
+              service:
+                name: backend
+                port:
+                  number: 8080
+          - path: /proto
+            pathType: Prefix
+            backend:
+              service:
+                name: backend
+                port:
+                  number: 8080
+          - path: /incus
+            pathType: Prefix
+            backend:
+              service:
+                name: backend
+                port:
+                  number: 8080
+          - path: /ext
+            pathType: Prefix
+            backend:
+              service:
+                name: backend
+                port:
+                  number: 8080
+          - path: /dtrack
+            pathType: Prefix
+            backend:
+              service:
+                name: dtrack
+                port:
+                  number: 8080
+          - path: /
+            pathType: Prefix
+            backend:
+              service:
+                name: web
+                port:
+                  number: 3000
+  tls:
+    - hosts:
+        - artifacts.k8s.syd1.au.unkin.net
+      secretName: artifacts-tls

apps/base/artifact-keeper/job_dtrack-init.yaml

@@ -0,0 +1,70 @@
+---
+apiVersion: batch/v1
+kind: Job
+metadata:
+  name: dtrack-init
+  namespace: artifact-keeper
+  labels:
+    app.kubernetes.io/name: artifact-keeper
+    app.kubernetes.io/instance: ak
+    app.kubernetes.io/part-of: artifact-keeper
+    app.kubernetes.io/component: dependency-track
+spec:
+  backoffLimit: 3
+  template:
+    metadata:
+      labels:
+        app.kubernetes.io/name: artifact-keeper
+        app.kubernetes.io/instance: ak
+        app.kubernetes.io/component: dependency-track
+    spec:
+      restartPolicy: OnFailure
+      automountServiceAccountToken: false
+      securityContext:
+        runAsNonRoot: true
+        runAsUser: 1000
+        fsGroup: 1000
+      containers:
+        - name: dtrack-init
+          image: alpine:3.20
+          securityContext:
+            allowPrivilegeEscalation: false
+            capabilities:
+              drop:
+                - ALL
+          resources:
+            requests:
+              cpu: 10m
+              memory: 32Mi
+              ephemeral-storage: 64Mi
+            limits:
+              cpu: 200m
+              memory: 128Mi
+              ephemeral-storage: 128Mi
+          command: ["/bin/sh", "-c"]
+          args:
+            - |
+              apk add --no-cache curl jq >/dev/null 2>&1
+              /bin/sh /scripts/init-dtrack.sh
+          env:
+            - name: DEPENDENCY_TRACK_URL
+              value: "http://dtrack:8080"
+            - name: DEPENDENCY_TRACK_ADMIN_PASSWORD
+              valueFrom:
+                secretKeyRef:
+                  name: app-secrets
+                  key: DEPENDENCY_TRACK_ADMIN_PASSWORD
+          volumeMounts:
+            - name: init-script
+              mountPath: /scripts
+              readOnly: true
+            - name: shared-config
+              mountPath: /shared
+      volumes:
+        - name: init-script
+          configMap:
+            name: dtrack-init
+            defaultMode: 0755
+        - name: shared-config
+          persistentVolumeClaim:
+            claimName: shared-config

apps/base/artifact-keeper/kustomization.yaml

@@ -0,0 +1,33 @@
+---
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+
+resources:
+  - namespace.yaml
+  - serviceaccount_backend.yaml
+  - cnpg_cluster.yaml
+  - cnpg_pooler.yaml
+  - vaultauth.yaml
+  - vaultstaticsecret.yaml
+  - configmap_app-config.yaml
+  - configmap_s3-env.yaml
+  - persistentvolumeclaims.yaml
+  - service_backend.yaml
+  - service_dtrack.yaml
+  - service_meilisearch.yaml
+  - service_trivy.yaml
+  - service_web.yaml
+  - deployment_backend.yaml
+  - deployment_dtrack.yaml
+  - deployment_meilisearch.yaml
+  - deployment_trivy.yaml
+  - deployment_web.yaml
+  - job_dtrack-init.yaml
+  - ingress.yaml
+
+configMapGenerator:
+  - name: dtrack-init
+    files:
+      - resources/init-dtrack.sh
+    options:
+      disableNameSuffixHash: true

apps/base/artifact-keeper/namespace.yaml

@@ -0,0 +1,7 @@
+---
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: artifact-keeper
+  labels:
+    app.kubernetes.io/name: artifact-keeper

apps/base/artifact-keeper/persistentvolumeclaims.yaml

@@ -0,0 +1,78 @@
+---
+apiVersion: v1
+kind: PersistentVolumeClaim
+metadata:
+  name: storage
+  namespace: artifact-keeper
+spec:
+  accessModes:
+    - ReadWriteMany
+  storageClassName: cephfs-raid5-delete
+  resources:
+    requests:
+      storage: 10Gi
+---
+apiVersion: v1
+kind: PersistentVolumeClaim
+metadata:
+  name: scan-workspace
+  namespace: artifact-keeper
+spec:
+  accessModes:
+    - ReadWriteMany
+  storageClassName: cephfs-raid5-delete
+  resources:
+    requests:
+      storage: 2Gi
+---
+apiVersion: v1
+kind: PersistentVolumeClaim
+metadata:
+  name: shared-config
+  namespace: artifact-keeper
+spec:
+  accessModes:
+    - ReadWriteMany
+  storageClassName: cephfs-raid5-delete
+  resources:
+    requests:
+      storage: 1Gi
+---
+apiVersion: v1
+kind: PersistentVolumeClaim
+metadata:
+  name: dtrack
+  namespace: artifact-keeper
+spec:
+  accessModes:
+    - ReadWriteOnce
+  storageClassName: cephrbd-fast-delete
+  resources:
+    requests:
+      storage: 5Gi
+---
+apiVersion: v1
+kind: PersistentVolumeClaim
+metadata:
+  name: meilisearch
+  namespace: artifact-keeper
+spec:
+  accessModes:
+    - ReadWriteOnce
+  storageClassName: cephrbd-fast-delete
+  resources:
+    requests:
+      storage: 5Gi
+---
+apiVersion: v1
+kind: PersistentVolumeClaim
+metadata:
+  name: trivy-cache
+  namespace: artifact-keeper
+spec:
+  accessModes:
+    - ReadWriteOnce
+  storageClassName: cephrbd-fast-delete
+  resources:
+    requests:
+      storage: 5Gi

apps/base/artifact-keeper/resources/init-dtrack.sh

@@ -0,0 +1,43 @@
+#!/bin/sh
+set -e
+DT_URL="${DEPENDENCY_TRACK_URL:-http://ak-artifact-keeper-dtrack:8080}"
+DT_ADMIN_USER="admin"
+DT_DEFAULT_PASS="admin"
+DT_NEW_PASS="${DEPENDENCY_TRACK_ADMIN_PASSWORD}"
+API_KEY_FILE="/shared/dtrack-api-key"
+
+echo "[dtrack-init] Waiting for Dependency-Track at $DT_URL ..."
+for i in $(seq 1 60); do
+  if curl -sf "$DT_URL/api/version" > /dev/null 2>&1; then break; fi
+  if [ "$i" -eq 60 ]; then echo "[dtrack-init] ERROR: timeout"; exit 1; fi
+  sleep 5
+done
+
+if [ -f "$API_KEY_FILE" ] && [ -s "$API_KEY_FILE" ]; then
+  echo "[dtrack-init] API key already provisioned -- skipping"
+  exit 0
+fi
+
+TOKEN=$(curl -sf -X POST "$DT_URL/api/v1/user/login" \
+  -H "Content-Type: application/x-www-form-urlencoded" \
+  -d "username=${DT_ADMIN_USER}&password=${DT_NEW_PASS}" 2>/dev/null || true)
+
+if [ -z "$TOKEN" ] || echo "$TOKEN" | grep -qi "FORCE_PASSWORD_CHANGE"; then
+  curl -sf -o /dev/null -X POST "$DT_URL/api/v1/user/forceChangePassword" \
+    -H "Content-Type: application/x-www-form-urlencoded" \
+    -d "username=${DT_ADMIN_USER}&password=${DT_DEFAULT_PASS}&newPassword=${DT_NEW_PASS}&confirmPassword=${DT_NEW_PASS}"
+  TOKEN=$(curl -sf -X POST "$DT_URL/api/v1/user/login" \
+    -H "Content-Type: application/x-www-form-urlencoded" \
+    -d "username=${DT_ADMIN_USER}&password=${DT_NEW_PASS}" 2>/dev/null || true)
+fi
+
+if [ -z "$TOKEN" ]; then echo "[dtrack-init] ERROR: auth failed"; exit 1; fi
+
+API_KEY=$(curl -sf "$DT_URL/api/v1/team" \
+  -H "Authorization: Bearer $TOKEN" | \
+  jq -r '.[] | select(.name == "Automation") | .apiKeys[0].key // empty')
+
+if [ -z "$API_KEY" ]; then echo "[dtrack-init] ERROR: no API key"; exit 1; fi
+
+echo "$API_KEY" > "$API_KEY_FILE"
+echo "[dtrack-init] Done"

apps/base/artifact-keeper/service_backend.yaml

@@ -0,0 +1,26 @@
+---
+apiVersion: v1
+kind: Service
+metadata:
+  name: backend
+  namespace: artifact-keeper
+  labels:
+    app.kubernetes.io/name: artifact-keeper
+    app.kubernetes.io/instance: ak
+    app.kubernetes.io/part-of: artifact-keeper
+    app.kubernetes.io/component: backend
+spec:
+  type: ClusterIP
+  ports:
+    - name: http
+      port: 8080
+      targetPort: http
+      protocol: TCP
+    - name: grpc
+      port: 9090
+      targetPort: grpc
+      protocol: TCP
+  selector:
+    app.kubernetes.io/name: artifact-keeper
+    app.kubernetes.io/instance: ak
+    app.kubernetes.io/component: backend

apps/base/artifact-keeper/service_dtrack.yaml

@@ -0,0 +1,22 @@
+---
+apiVersion: v1
+kind: Service
+metadata:
+  name: dtrack
+  namespace: artifact-keeper
+  labels:
+    app.kubernetes.io/name: artifact-keeper
+    app.kubernetes.io/instance: ak
+    app.kubernetes.io/part-of: artifact-keeper
+    app.kubernetes.io/component: dependency-track
+spec:
+  type: ClusterIP
+  ports:
+    - name: http
+      port: 8080
+      targetPort: http
+      protocol: TCP
+  selector:
+    app.kubernetes.io/name: artifact-keeper
+    app.kubernetes.io/instance: ak
+    app.kubernetes.io/component: dependency-track

apps/base/artifact-keeper/service_meilisearch.yaml

@@ -0,0 +1,22 @@
+---
+apiVersion: v1
+kind: Service
+metadata:
+  name: meilisearch
+  namespace: artifact-keeper
+  labels:
+    app.kubernetes.io/name: artifact-keeper
+    app.kubernetes.io/instance: ak
+    app.kubernetes.io/part-of: artifact-keeper
+    app.kubernetes.io/component: meilisearch
+spec:
+  type: ClusterIP
+  ports:
+    - name: http
+      port: 7700
+      targetPort: http
+      protocol: TCP
+  selector:
+    app.kubernetes.io/name: artifact-keeper
+    app.kubernetes.io/instance: ak
+    app.kubernetes.io/component: meilisearch

apps/base/artifact-keeper/service_trivy.yaml

@@ -0,0 +1,22 @@
+---
+apiVersion: v1
+kind: Service
+metadata:
+  name: trivy
+  namespace: artifact-keeper
+  labels:
+    app.kubernetes.io/name: artifact-keeper
+    app.kubernetes.io/instance: ak
+    app.kubernetes.io/part-of: artifact-keeper
+    app.kubernetes.io/component: trivy
+spec:
+  type: ClusterIP
+  ports:
+    - name: http
+      port: 8090
+      targetPort: http
+      protocol: TCP
+  selector:
+    app.kubernetes.io/name: artifact-keeper
+    app.kubernetes.io/instance: ak
+    app.kubernetes.io/component: trivy

apps/base/artifact-keeper/service_web.yaml

@@ -0,0 +1,22 @@
+---
+apiVersion: v1
+kind: Service
+metadata:
+  name: web
+  namespace: artifact-keeper
+  labels:
+    app.kubernetes.io/name: artifact-keeper
+    app.kubernetes.io/instance: ak
+    app.kubernetes.io/part-of: artifact-keeper
+    app.kubernetes.io/component: web
+spec:
+  type: ClusterIP
+  ports:
+    - name: http
+      port: 3000
+      targetPort: http
+      protocol: TCP
+  selector:
+    app.kubernetes.io/name: artifact-keeper
+    app.kubernetes.io/instance: ak
+    app.kubernetes.io/component: web

apps/base/artifact-keeper/serviceaccount_backend.yaml

@@ -0,0 +1,11 @@
+---
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: backend
+  namespace: artifact-keeper
+  labels:
+    app.kubernetes.io/name: artifact-keeper
+    app.kubernetes.io/instance: ak
+    app.kubernetes.io/part-of: artifact-keeper
+    app.kubernetes.io/component: backend

apps/base/artifact-keeper/vaultauth.yaml

@@ -3,10 +3,10 @@ apiVersion: secrets.hashicorp.com/v1beta1
 kind: VaultAuth
 metadata:
   name: default
-  namespace: paperclip
+  namespace: artifact-keeper
 spec:
   allowedNamespaces:
-    - paperclip
+    - artifact-keeper
   kubernetes:
     audiences:
       - vault

apps/base/artifact-keeper/vaultstaticsecret.yaml

@@ -0,0 +1,51 @@
+---
+apiVersion: secrets.hashicorp.com/v1beta1
+kind: VaultStaticSecret
+metadata:
+  name: postgres-credentials
+  namespace: artifact-keeper
+spec:
+  destination:
+    create: true
+    name: postgres-credentials
+    overwrite: true
+  hmacSecretData: true
+  mount: kv
+  path: kubernetes/namespace/artifact-keeper/default/postgres-credentials
+  refreshAfter: 5m
+  type: kv-v2
+  vaultAuthRef: default
+---
+apiVersion: secrets.hashicorp.com/v1beta1
+kind: VaultStaticSecret
+metadata:
+  name: app-secrets
+  namespace: artifact-keeper
+spec:
+  destination:
+    create: true
+    name: app-secrets
+    overwrite: true
+  hmacSecretData: true
+  mount: kv
+  path: kubernetes/namespace/artifact-keeper/default/app-secrets
+  refreshAfter: 5m
+  type: kv-v2
+  vaultAuthRef: default
+---
+apiVersion: secrets.hashicorp.com/v1beta1
+kind: VaultStaticSecret
+metadata:
+  name: s3-credentials
+  namespace: artifact-keeper
+spec:
+  destination:
+    create: true
+    name: s3-credentials
+    overwrite: true
+  hmacSecretData: true
+  mount: kv
+  path: kubernetes/namespace/artifact-keeper/default/s3-credentials
+  refreshAfter: 5m
+  type: kv-v2
+  vaultAuthRef: default

apps/base/artifactapi/artifactapi-deployment.yaml

@@ -19,8 +19,8 @@ spec:
       automountServiceAccountToken: true
       containers:
         - name: artifactapi
-          image: git.unkin.net/unkin/artifactapi:v2.7.2
+          image: git.unkin.net/unkin/almalinux9-artifactapi:latest
-          imagePullPolicy: IfNotPresent
+          imagePullPolicy: Always
           ports:
             - containerPort: 8000
               name: http
@@ -60,30 +60,10 @@ spec:
               cpu: 100m
               memory: 256Mi
           volumeMounts:
-            - mountPath: /etc/artifactapi/conf.d/config.yaml
+            - mountPath: /app/remotes.yaml
+              mountPropagation: None
               name: remotes-config
-              subPath: config.yaml
+              subPath: remotes.yaml
-            - mountPath: /etc/artifactapi/conf.d/local-generic.yaml
-              name: remotes-config
-              subPath: local-generic.yaml
-            - mountPath: /etc/artifactapi/conf.d/remote-alpine.yaml
-              name: remotes-config
-              subPath: remote-alpine.yaml
-            - mountPath: /etc/artifactapi/conf.d/remote-docker.yaml
-              name: remotes-config
-              subPath: remote-docker.yaml
-            - mountPath: /etc/artifactapi/conf.d/remote-generic.yaml
-              name: remotes-config
-              subPath: remote-generic.yaml
-            - mountPath: /etc/artifactapi/conf.d/remote-helm.yaml
-              name: remotes-config
-              subPath: remote-helm.yaml
-            - mountPath: /etc/artifactapi/conf.d/remote-rpm.yaml
-              name: remotes-config
-              subPath: remote-rpm.yaml
-            - mountPath: /etc/artifactapi/conf.d/virtual-helm.yaml
-              name: remotes-config
-              subPath: virtual-helm.yaml
       restartPolicy: Always
       volumes:
         - configMap:

apps/base/artifactapi/configmap.yaml

@@ -5,7 +5,7 @@ metadata:
   name: artifactapi-env
   namespace: artifactapi
 data:
-  CONFIG_PATH: /etc/artifactapi/conf.d/
+  CONFIG_PATH: /app/remotes.yaml
   DBHOST: postgres-service
   DBNAME: artifacts
   DBPORT: "5432"

apps/base/artifactapi/kustomization.yaml

@@ -18,13 +18,6 @@ resources:
 configMapGenerator:
   - name: remotes-config
     files:
-      - resources/conf.d/config.yaml
+      - resources/remotes.yaml
-      - resources/conf.d/local-generic.yaml
-      - resources/conf.d/remote-generic.yaml
-      - resources/conf.d/remote-alpine.yaml
-      - resources/conf.d/remote-rpm.yaml
-      - resources/conf.d/remote-docker.yaml
-      - resources/conf.d/remote-helm.yaml
-      - resources/conf.d/virtual-helm.yaml
     options:
       disableNameSuffixHash: true

apps/base/artifactapi/resources/conf.d/config.yaml

@@ -1,3 +0,0 @@
-# Global artifactapi configuration.
-# S3, Redis, and database connection settings are injected via environment variables.
-# Add any top-level overrides here if needed.

apps/base/artifactapi/resources/conf.d/local-generic.yaml

@@ -1,7 +0,0 @@
-locals:
-  local-generic:
-    package: "generic"
-    description: "Local generic file repository"
-    cache:
-      immutable_ttl: 0
-      mutable_ttl: 0

apps/base/artifactapi/resources/conf.d/remote-alpine.yaml

@@ -1,10 +0,0 @@
-remotes:
-  alpine:
-    base_url: "https://dl-cdn.alpinelinux.org"
-    package: "alpine"
-    description: "Alpine Linux APK package repository"
-    immutable_patterns:
-      - ".*/x86_64/.*\\.apk$"
-    cache:
-      immutable_ttl: 0
-      mutable_ttl: 7200

apps/base/artifactapi/resources/conf.d/remote-docker.yaml

@@ -1,96 +0,0 @@
-remotes:
-  ghcr:
-    base_url: "https://ghcr.io"
-    package: "docker"
-    description: "GitHub Container Registry"
-    immutable_patterns:
-      - "^cloudnative-pg/cloudnative-pg"
-      - "^emberstack/helm-charts"
-      - "^openvoxproject/"
-      - "^stakater/reloader"
-      - "^voxpupuli/puppetboard"
-      - "^woodpecker-ci/helm"
-    cache:
-      immutable_ttl: 0
-      mutable_ttl: 300
-
-  dockerhub:
-    base_url: "https://registry-1.docker.io"
-    package: "docker"
-    description: "Docker Hub registry"
-    immutable_patterns:
-      - "^library/almalinux"
-      - "^library/busybox"
-      - "^library/debian"
-      - "^library/fedora"
-      - "^library/nginx"
-      - "^library/postgres"
-      - "^library/redis"
-      - "^beats/filebeat"
-      - "^bitnami/"
-      - "^curlimages/curl"
-      - "^emberstack/kubernetes-reflector"
-      - "^hashicorp/vault-secrets-operator"
-      - "^jfrog/"
-      - "^rancher/"
-      - "^traefik/"
-      - "^ubi9/ubi-minimal"
-      - "^victoriametrics/"
-      - "^woodpeckerci/"
-    cache:
-      immutable_ttl: 0
-      mutable_ttl: 300
-
-  quay:
-    base_url: "https://quay.io"
-    package: "docker"
-    description: "Quay.io container registry"
-    immutable_patterns:
-      - "^brancz/kube-rbac-proxy"
-      - "^cephcsi/cephcsi"
-      - "^jetstack/cert-manager-"
-    cache:
-      immutable_ttl: 0
-      mutable_ttl: 300
-
-  k8s-registry:
-    base_url: "https://registry.k8s.io"
-    package: "docker"
-    description: "Kubernetes container registry"
-    immutable_patterns:
-      - "^external-dns/external-dns"
-      - "^sig-storage/"
-    cache:
-      immutable_ttl: 0
-      mutable_ttl: 300
-
-  gitlab:
-    base_url: "https://registry.gitlab.com"
-    package: "docker"
-    description: "GitLab container registry"
-    immutable_patterns:
-      - "^purelb/purelb"
-    cache:
-      immutable_ttl: 0
-      mutable_ttl: 300
-
-  elastic:
-    base_url: "https://docker.elastic.co"
-    package: "docker"
-    description: "Elastic container registry"
-    immutable_patterns:
-      - "^eck/eck-operator"
-    cache:
-      immutable_ttl: 0
-      mutable_ttl: 300
-
-  gcr:
-    base_url: "https://gcr.io"
-    package: "docker"
-    description: "Google Container Registry"
-    immutable_patterns:
-      - "^k8s-staging-nfd/charts"
-      - "^k8s-staging-nfd/node-feature-discovery"
-    cache:
-      immutable_ttl: 0
-      mutable_ttl: 300

apps/base/artifactapi/resources/conf.d/remote-generic.yaml

@@ -1,130 +0,0 @@
-remotes:
-  github:
-    base_url: "https://github.com"
-    package: "generic"
-    description: "GitHub releases and files"
-    mutable_patterns:
-      - ".*/archive/refs/heads/.*.tar.gz$"
-    immutable_patterns:
-      - ".*/archive/refs/tags/.*.tar.gz$"
-      - "ahmetb/kubectx/.*/kubectx_.*_linux_x86_64.tar.gz$"
-      - "ahmetb/kubectx/.*/kubens_.*_linux_x86_64.tar.gz$"
-      - "apple/foundationdb/.*/libfdb_c.x86_64.so$"
-      - "astral-sh/ruff/.*/ruff-x86_64-unknown-linux-gnu.tar.gz$"
-      - "astral-sh/uv/.*/uv-x86_64-unknown-linux-gnu.tar.gz$"
-      - "camptocamp/prometheus-puppetdb-exporter/.*/prometheus-puppetdb-exporter-.*.linux-amd64.tar.gz$"
-      - "coder/code-server/.*/code-server-.*-amd64.rpm$"
-      - "containernetworking/plugins/.*/cni-plugins-linux-amd64-.*.tgz"
-      - "dandavison/delta/.*/delta-.*-x86_64-unknown-linux-musl.tar.gz$"
-      - "ducaale/xh/.*/xh-.*-x86_64-unknown-linux-musl.tar.gz$"
-      - "etcd-io/etcd/.*/etcd-.*-linux-amd64.tar.gz$"
-      - "getsops/sops/.*/sops-v.*\\.linux\\.amd64$"
-      - "grafana/jsonnet-language-server/.*/jsonnet-language-server_.*_linux_amd64$"
-      - "gruntwork-io/boilerplate/.*/boilerplate_linux_amd64$"
-      - "gruntwork-io/terragrunt/.*terragrunt_linux_amd64.*"
-      - "hadolint/hadolint/.*/hadolint-linux-x86_64$"
-      - "helmfile/helmfile/.*/helmfile_.*_linux_amd64.tar.gz$"
-      - "helmfile/vals/.*/vals_.*_linux_amd64.tar.gz$"
-      - "jesseduffield/lazydocker/.*/lazydocker_.*_Linux_x86_64.tar.gz$"
-      - "kubecolor/kubecolor/.*/kubecolor_.*_linux_amd64.tar.gz$"
-      - "kubernetes-sigs/gateway-api/.*/standard-install.yaml$"
-      - "kubernetes-sigs/kustomize/.*/kustomize_.*_linux_amd64.tar.gz$"
-      - "lxc/incus/.*.tar.gz$"
-      - "mikefarah/yq/.*/yq_linux_amd64$"
-      - "neovim/neovim-releases/.*/nvim-linux-x86_64.tar.gz$"
-      - "neovim/neovim/.*/nvim-linux-x86_64.tar.gz$"
-      - "nzbgetcom/nzbget/.*/nzbget-.*.x86_64.rpm$"
-      - "onedr0p/exportarr/.*/exportarr_.*_linux_amd64.tar.gz$"
-      - "openbao/openbao-plugins/.*/openbao-plugin-secrets-consul_linux_amd64_.*.tar.gz$"
-      - "openbao/openbao-plugins/.*/openbao-plugin-secrets-nomad_linux_amd64_.*.tar.gz$"
-      - "prometheus-community/bind_exporter/.*/bind_exporter-.*.linux-amd64.tar.gz$"
-      - "prometheus-community/pgbouncer_exporter/.*/pgbouncer_exporter-.*.linux-amd64.tar.gz$"
-      - "prometheus-community/postgres_exporter/.*/postgres_exporter-.*.linux-amd64.tar.gz$"
-      - "prometheus/node_exporter/.*/node_exporter-.*.linux-amd64.tar.gz$"
-      - "rancher/rke2/.*/rke2-images.linux-amd64.tar.zst$"
-      - "stalwartlabs/stalwart/.*/stalwart-cli-x86_64-unknown-linux-gnu.tar.gz$"
-      - "stalwartlabs/stalwart/.*/stalwart-foundationdb-x86_64-unknown-linux-gnu.tar.gz$"
-      - "stalwartlabs/stalwart/.*/stalwart-x86_64-unknown-linux-gnu.tar.gz$"
-      - "starship/starship/.*/starship-x86_64-unknown-linux-musl.tar.gz$"
-      - "stern/stern/.*/stern_.*_linux_amd64.tar.gz$"
-      - "terraform-linters/tflint/.*/tflint_linux_amd64.zip$"
-      - "tynany/frr_exporter/.*/frr_exporter-.*.linux-amd64.tar.gz$"
-      - "VictoriaMetrics/VictoriaLogs/.*/victoria-logs-linux-amd64-.*.tar.gz$"
-      - "VictoriaMetrics/VictoriaLogs/.*/vlutils-linux-amd64-.*.tar.gz$"
-      - "VictoriaMetrics/VictoriaMetrics/.*/victoria-logs-linux-amd64-.*.tar.gz$"
-      - "VictoriaMetrics/VictoriaMetrics/.*/victoria-metrics-linux-amd64-.*-cluster.tar.gz$"
-      - "VictoriaMetrics/VictoriaMetrics/.*/vlutils-linux-amd64-.*.tar.gz$"
-      - "VictoriaMetrics/VictoriaMetrics/.*/vmutils-linux-amd64-.*.tar.gz$"
-      - "xorpaul/g10k/.*/g10k-.*-linux-amd64.zip$"
-      - "yannh/kubeconform/.*/kubeconform-linux-amd64.tar.gz$"
-    cache:
-      immutable_ttl: 0
-      mutable_ttl: 7200
-
-  github_user:
-    base_url: "https://raw.githubusercontent.com"
-    package: "generic"
-    description: "GitHub User Content"
-    immutable_patterns:
-      - "argoproj/argo-cd/.*.yaml$"
-      - "yannh/kubernetes-json-schema/master/.*.json$"
-      - "datreeio/CRDs-catalog/main/.*.json$"
-    cache:
-      immutable_ttl: 0
-      mutable_ttl: 7200
-
-  gitea-dl:
-    base_url: "https://dl.gitea.com"
-    package: "generic"
-    description: "Gitea download site"
-    immutable_patterns:
-      - "act_runner/.*/act_runner-.*-linux-amd64$"
-      - "tea/.*/tea-.*-linux-amd64$"
-    cache:
-      immutable_ttl: 0
-      mutable_ttl: 7200
-
-  hashicorp-releases:
-    base_url: "https://releases.hashicorp.com"
-    package: "generic"
-    description: "HashiCorp product releases"
-    immutable_patterns:
-      - "terraform/.*terraform_.*_linux_amd64\\.zip$"
-      - "terraform/.*terraform_.*_windows_amd64\\.zip$"
-      - "terraform/.*terraform_.*_darwin_amd64\\.zip$"
-      - "vault/.*vault_.*_linux_amd64\\.zip$"
-      - "vault/.*vault_.*_windows_amd64\\.zip$"
-      - "vault/.*vault_.*_darwin_amd64\\.zip$"
-      - "consul-cni/.*/consul-cni_.*_linux_amd64\\.zip$"
-      - "consul/.*/consul_.*_linux_amd64\\.zip$"
-      - "nomad-autoscaler/.*/nomad-autoscaler_.*_linux_amd64\\.zip$"
-      - "nomad/.*/nomad_.*_linux_amd64\\.zip$"
-      - "packer/.*/packer_.*_linux_amd64\\.zip$"
-    cache:
-      immutable_ttl: 0
-      mutable_ttl: 7200
-
-  rarlab:
-    base_url: "https://www.rarlab.com"
-    package: "generic"
-    description: "RARLab"
-    immutable_patterns:
-      - "rar/rarlinux-x64-.*.tar.gz"
-    cache:
-      immutable_ttl: 0
-      mutable_ttl: 7200
-
-  claude-ai:
-    base_url: "https://downloads.claude.ai"
-    package: "generic"
-    description: "Anthropic Claude Code binary releases"
-    mutable_patterns:
-      - "claude-code-releases/.*/manifest.json$"
-    immutable_patterns:
-      - "claude-code-releases/.*/linux-x64/claude$"
-      - "claude-code-releases/.*/linux-arm64/claude$"
-      - "claude-code-releases/.*/linux-x64-musl/claude$"
-      - "claude-code-releases/.*/linux-arm64-musl/claude$"
-    cache:
-      immutable_ttl: 0
-      mutable_ttl: 7200

apps/base/artifactapi/resources/conf.d/remote-helm.yaml

@@ -1,143 +0,0 @@
-remotes:
-  ceph-csi:
-    base_url: "https://ceph.github.io/csi-charts"
-    package: "helm"
-    description: "Ceph CSI driver Helm charts"
-    check_mutable_updates: true
-    immutable_patterns:
-      - "\\.tgz$"
-    cache:
-      immutable_ttl: 0
-      mutable_ttl: 3600
-
-  cnpg:
-    base_url: "https://cloudnative-pg.github.io/charts"
-    package: "helm"
-    description: "CloudNativePG operator Helm charts"
-    check_mutable_updates: true
-    immutable_patterns:
-      - "\\.tgz$"
-    cache:
-      immutable_ttl: 0
-      mutable_ttl: 3600
-
-  elastic-helm:
-    base_url: "https://helm.elastic.co"
-    package: "helm"
-    description: "Elastic stack Helm charts"
-    check_mutable_updates: true
-    immutable_patterns:
-      - "\\.tgz$"
-    cache:
-      immutable_ttl: 0
-      mutable_ttl: 3600
-
-  external-dns:
-    base_url: "https://kubernetes-sigs.github.io/external-dns/"
-    package: "helm"
-    description: "ExternalDNS Helm charts"
-    check_mutable_updates: true
-    immutable_patterns:
-      - "\\.tgz$"
-    cache:
-      immutable_ttl: 0
-      mutable_ttl: 3600
-
-  hashicorp-helm:
-    base_url: "https://helm.releases.hashicorp.com"
-    package: "helm"
-    description: "HashiCorp Helm charts (Vault Secrets Operator, etc.)"
-    check_mutable_updates: true
-    immutable_patterns:
-      - "\\.tgz$"
-    cache:
-      immutable_ttl: 0
-      mutable_ttl: 3600
-
-  intel-helm:
-    base_url: "https://intel.github.io/helm-charts/"
-    package: "helm"
-    description: "Intel Helm charts (device plugins)"
-    check_mutable_updates: true
-    immutable_patterns:
-      - "\\.tgz$"
-    cache:
-      immutable_ttl: 0
-      mutable_ttl: 3600
-
-  jetstack:
-    base_url: "https://charts.jetstack.io"
-    package: "helm"
-    description: "Jetstack Helm charts (cert-manager)"
-    check_mutable_updates: true
-    immutable_patterns:
-      - "\\.tgz$"
-    cache:
-      immutable_ttl: 0
-      mutable_ttl: 3600
-
-  purelb:
-    base_url: "https://gitlab.com/api/v4/projects/20400619/packages/helm/stable"
-    package: "helm"
-    description: "PureLB load balancer Helm charts"
-    check_mutable_updates: true
-    immutable_patterns:
-      - "\\.tgz$"
-    cache:
-      immutable_ttl: 0
-      mutable_ttl: 3600
-
-  rancher-stable:
-    base_url: "https://releases.rancher.com/server-charts/stable"
-    package: "helm"
-    description: "Rancher stable Helm charts"
-    check_mutable_updates: true
-    immutable_patterns:
-      - "\\.tgz$"
-    cache:
-      immutable_ttl: 0
-      mutable_ttl: 3600
-
-  stakater:
-    base_url: "https://stakater.github.io/stakater-charts"
-    package: "helm"
-    description: "Stakater Helm charts (Reloader)"
-    check_mutable_updates: true
-    immutable_patterns:
-      - "\\.tgz$"
-    cache:
-      immutable_ttl: 0
-      mutable_ttl: 3600
-
-  traefik:
-    base_url: "https://traefik.github.io/charts"
-    package: "helm"
-    description: "Traefik Helm charts"
-    check_mutable_updates: true
-    immutable_patterns:
-      - "\\.tgz$"
-    cache:
-      immutable_ttl: 0
-      mutable_ttl: 3600
-
-  victoriametrics:
-    base_url: "https://victoriametrics.github.io/helm-charts/"
-    package: "helm"
-    description: "VictoriaMetrics observability Helm charts"
-    check_mutable_updates: true
-    immutable_patterns:
-      - "\\.tgz$"
-    cache:
-      immutable_ttl: 0
-      mutable_ttl: 3600
-
-  argo-helm:
-    base_url: "https://argoproj.github.io/argo-helm"
-    package: "helm"
-    description: "Argo Project Helm charts (ArgoCD, Image Updater, Rollouts, etc.)"
-    check_mutable_updates: true
-    immutable_patterns:
-      - "\\.tgz$"
-    cache:
-      immutable_ttl: 0
-      mutable_ttl: 3600

apps/base/artifactapi/resources/conf.d/remote-rpm.yaml

@@ -1,154 +0,0 @@
-remotes:
-  almalinux:
-    base_url: "https://gsl-syd.mm.fcix.net/almalinux"
-    package: "rpm"
-    description: "AlmaLinux RPM package repository"
-    immutable_patterns:
-      - ".*/x86_64/.*\\.rpm$"
-      - ".*/noarch/.*\\.rpm$"
-      - ".*/repodata/.*\\.sqlite.*$"
-      - ".*/repodata/.*\\.xml.*$"
-      - ".*/repodata/.*\\.yaml.*$"
-      - ".*/install.img"
-      - ".*/squashfs.img"
-      - ".*/updates.img"
-      - ".*/RPM-GPG-KEY-.*$"
-    cache:
-      immutable_ttl: 0
-      mutable_ttl: 7200
-
-  ceph-reef:
-    base_url: "https://download.ceph.com/rpm-reef/"
-    package: "rpm"
-    description: "Ceph Reef 18"
-    immutable_patterns:
-      - ".*/x86_64/.*\\.rpm$"
-      - ".*/noarch/.*\\.rpm$"
-      - ".*/repodata/.*\\.xml.*$"
-    cache:
-      immutable_ttl: 0
-      mutable_ttl: 7200
-
-  ceph-squid:
-    base_url: "https://download.ceph.com/rpm-squid/"
-    package: "rpm"
-    description: "Ceph Squid 19"
-    immutable_patterns:
-      - ".*/x86_64/.*\\.rpm$"
-      - ".*/noarch/.*\\.rpm$"
-      - ".*/repodata/.*\\.xml.*$"
-    cache:
-      immutable_ttl: 0
-      mutable_ttl: 7200
-
-  ceph-tentacle:
-    base_url: "https://download.ceph.com/rpm-tentacle/"
-    package: "rpm"
-    description: "Ceph Tentacle 20"
-    immutable_patterns:
-      - ".*/x86_64/.*\\.rpm$"
-      - ".*/noarch/.*\\.rpm$"
-      - ".*/repodata/.*\\.xml.*$"
-    cache:
-      immutable_ttl: 0
-      mutable_ttl: 7200
-
-  epel:
-    base_url: "https://gsl-syd.mm.fcix.net/epel"
-    package: "rpm"
-    description: "EPEL (Extra Packages for Enterprise Linux)"
-    immutable_patterns:
-      - ".*/Everything/x86_64/.*\\.rpm$"
-      - ".*/noarch/.*\\.rpm$"
-      - ".*/repodata/.*\\.sqlite.*$"
-      - ".*/repodata/.*\\.xml.*$"
-      - ".*/repodata/.*\\.yaml.*$"
-      - "RPM-GPG-KEY-.*$"
-    cache:
-      immutable_ttl: 0
-      mutable_ttl: 7200
-
-  fedora:
-    base_url: "https://gsl-syd.mm.fcix.net/fedora/linux"
-    package: "rpm"
-    description: "Fedora Linux RPM package repository"
-    immutable_patterns:
-      - "releases/.*/Everything/x86_64/.*\\.rpm$"
-      - "updates/.*/Everything/x86_64/.*\\.rpm$"
-      - "development/.*/Everything/x86_64/.*\\.rpm$"
-      - ".*/noarch/.*\\.rpm$"
-      - ".*/repodata/.*\\.xml.*$"
-    cache:
-      immutable_ttl: 0
-      mutable_ttl: 7200
-
-  frr:
-    base_url: "https://rpm.frrouting.org/repo"
-    package: "rpm"
-    description: "FRR RPM package repository"
-    immutable_patterns:
-      - ".*\\.rpm$"
-      - ".*/repodata/.*\\.xml.*$"
-    cache:
-      immutable_ttl: 0
-      mutable_ttl: 7200
-
-  mariadb:
-    base_url: "http://mariadb.mirror.digitalpacific.com.au/yum"
-    package: "rpm"
-    description: "MariaDB RPM package repository"
-    immutable_patterns:
-      - ".*\\.rpm$"
-      - ".*/repodata/.*\\.xml.*$"
-      - ".*/RPM-GPG-KEY-.*$"
-    cache:
-      immutable_ttl: 0
-      mutable_ttl: 7200
-
-  openvox:
-    base_url: "https://yum.voxpupuli.org"
-    package: "rpm"
-    description: "OpenVox RPM package repository"
-    immutable_patterns:
-      - ".*\\.rpm$"
-      - ".*/repodata/.*\\.xml.*$"
-      - "GPG-KEY-.*$"
-    cache:
-      immutable_ttl: 0
-      mutable_ttl: 7200
-
-  postgresql:
-    base_url: "https://download.postgresql.org/pub/repos/yum"
-    package: "rpm"
-    description: "PostgreSQL RPM package repository"
-    immutable_patterns:
-      - ".*\\.rpm$"
-      - ".*/repodata/.*\\.xml.*$"
-      - ".*/RPM-GPG-KEY-.*$"
-      - ".*/PGDG-RPM-GPG-KEY-.*$"
-    cache:
-      immutable_ttl: 0
-      mutable_ttl: 7200
-
-  rke2:
-    base_url: "https://rpm.rancher.io"
-    package: "rpm"
-    description: "RKE2 RPM package repository"
-    immutable_patterns:
-      - ".*\\.rpm$"
-      - ".*/repodata/.*\\.xml.*$"
-      - "public.key$"
-    cache:
-      immutable_ttl: 0
-      mutable_ttl: 7200
-
-  zfs:
-    base_url: "http://download.zfsonlinux.org"
-    package: "rpm"
-    description: "ZFS RPM package repository"
-    immutable_patterns:
-      - ".*\\.rpm$"
-      - ".*/repodata/.*\\.xml.*$"
-    cache:
-      immutable_ttl: 0
-      mutable_ttl: 7200

apps/base/artifactapi/resources/conf.d/virtual-helm.yaml

@@ -1,18 +0,0 @@
-virtuals:
-  helm:
-    package: "helm"
-    description: "Virtual repository merging all helm remotes — member order is priority order for duplicate chart+version"
-    members:
-      - ceph-csi
-      - cnpg
-      - elastic-helm
-      - external-dns
-      - hashicorp-helm
-      - intel-helm
-      - jetstack
-      - purelb
-      - rancher-stable
-      - stakater
-      - traefik
-      - victoriametrics
-      - argo-helm

apps/base/artifactapi/resources/remotes.yaml

@@ -0,0 +1,287 @@
+remotes:
+  github:
+    base_url: "https://github.com"
+    type: "remote"
+    package: "generic"
+    description: "GitHub releases and files"
+    include_patterns:
+      - "apple/foundationdb/.*/libfdb_c.x86_64.so$"
+      - "astral-sh/ruff/.*/ruff-x86_64-unknown-linux-gnu.tar.gz$"
+      - "astral-sh/uv/.*/uv-x86_64-unknown-linux-gnu.tar.gz$"
+      - "camptocamp/prometheus-puppetdb-exporter/.*/prometheus-puppetdb-exporter-.*.linux-amd64.tar.gz$"
+      - "containernetworking/plugins/.*/cni-plugins-linux-amd64-.*.tgz"
+      - "ducaale/xh/.*/xh-.*-x86_64-unknown-linux-musl.tar.gz$"
+      - "etcd-io/etcd/.*/etcd-.*-linux-amd64.tar.gz$"
+      - "grafana/jsonnet-language-server/.*/jsonnet-language-server_.*_linux_amd64$"
+      - "gruntwork-io/boilerplate/.*/boilerplate_linux_amd64$"
+      - "gruntwork-io/terragrunt/.*terragrunt_linux_amd64.*"
+      - "helmfile/helmfile/.*/helmfile_.*_linux_amd64.tar.gz$"
+      - "helmfile/vals/.*/vals_.*_linux_amd64.tar.gz$"
+      - "lxc/incus/.*.tar.gz$"
+      - "nzbgetcom/nzbget/.*/nzbget-.*.x86_64.rpm$"
+      - "onedr0p/exportarr/.*/exportarr_.*_linux_amd64.tar.gz$"
+      - "openbao/openbao-plugins/.*/openbao-plugin-secrets-consul_linux_amd64_.*.tar.gz$"
+      - "openbao/openbao-plugins/.*/openbao-plugin-secrets-nomad_linux_amd64_.*.tar.gz$"
+      - "prometheus/node_exporter/.*/node_exporter-.*.linux-amd64.tar.gz$"
+      - "prometheus-community/bind_exporter/.*/bind_exporter-.*.linux-amd64.tar.gz$"
+      - "prometheus-community/pgbouncer_exporter/.*/pgbouncer_exporter-.*.linux-amd64.tar.gz$"
+      - "prometheus-community/postgres_exporter/.*/postgres_exporter-.*.linux-amd64.tar.gz$"
+      - "rancher/rke2/.*/rke2-images.linux-amd64.tar.zst$"
+      - "stalwartlabs/stalwart/.*/stalwart-cli-x86_64-unknown-linux-gnu.tar.gz$"
+      - "stalwartlabs/stalwart/.*/stalwart-foundationdb-x86_64-unknown-linux-gnu.tar.gz$"
+      - "stalwartlabs/stalwart/.*/stalwart-x86_64-unknown-linux-gnu.tar.gz$"
+      - "terraform-linters/tflint/.*/tflint_linux_amd64.zip$"
+      - "tynany/frr_exporter/.*/frr_exporter-.*.linux-amd64.tar.gz$"
+      - "VictoriaMetrics/VictoriaLogs/.*/victoria-logs-linux-amd64-.*.tar.gz$"
+      - "VictoriaMetrics/VictoriaLogs/.*/vlutils-linux-amd64-.*.tar.gz$"
+      - "VictoriaMetrics/VictoriaMetrics/.*/victoria-logs-linux-amd64-.*.tar.gz$"
+      - "VictoriaMetrics/VictoriaMetrics/.*/victoria-metrics-linux-amd64-.*-cluster.tar.gz$"
+      - "VictoriaMetrics/VictoriaMetrics/.*/vlutils-linux-amd64-.*.tar.gz$"
+      - "VictoriaMetrics/VictoriaMetrics/.*/vmutils-linux-amd64-.*.tar.gz$"
+      - "xorpaul/g10k/.*/g10k-.*-linux-amd64.zip$"
+    cache:
+      file_ttl: 0
+      index_ttl: 0
+
+  github_user:
+    base_url: "https://raw.githubusercontent.com"
+    type: "remote"
+    package: "generic"
+    description: "GitHub User Content"
+    include_patterns:
+      - "argoproj/argo-cd/.*.yaml$"
+      - "yannh/kubernetes-json-schema/master/.*.json$"
+      - "datreeio/CRDs-catalog/main/.*.json$"
+    cache:
+      file_ttl: 0
+      index_ttl: 0
+
+  gitea-dl:
+    base_url: "https://dl.gitea.com"
+    type: "remote"
+    package: "generic"
+    description: "Gitea download site"
+    include_patterns:
+      - "act_runner/.*/act_runner-.*-linux-amd64$"
+      - "tea/.*/tea-.*-linux-amd64$"
+    cache:
+      file_ttl: 0
+      index_ttl: 0
+
+  hashicorp-releases:
+    base_url: "https://releases.hashicorp.com"
+    type: "remote"
+    package: "generic"
+    description: "HashiCorp product releases"
+    include_patterns:
+      - "terraform/.*terraform_.*_linux_amd64\\.zip$"
+      - "terraform/.*terraform_.*_windows_amd64\\.zip$"
+      - "terraform/.*terraform_.*_darwin_amd64\\.zip$"
+      - "vault/.*vault_.*_linux_amd64\\.zip$"
+      - "vault/.*vault_.*_windows_amd64\\.zip$"
+      - "vault/.*vault_.*_darwin_amd64\\.zip$"
+      - "consul-cni/.*/consul-cni_.*_linux_amd64\\.zip$"
+      - "consul/.*/consul_.*_linux_amd64\\.zip$"
+      - "nomad-autoscaler/.*/nomad-autoscaler_.*_linux_amd64\\.zip$"
+      - "nomad/.*/nomad_.*_linux_amd64\\.zip$"
+      - "packer/.*/packer_.*_linux_amd64\\.zip$"
+    cache:
+      file_ttl: 0
+      index_ttl: 0
+
+  rarlab:
+    base_url: "https://www.rarlab.com"
+    type: "remote"
+    package: "generic"
+    description: "RARLab"
+    include_patterns:
+      - "rar/rarlinux-x64-.*.tar.gz"
+    cache:
+      file_ttl: 0
+      index_ttl: 0
+
+  alpine:
+    base_url: "https://dl-cdn.alpinelinux.org"
+    type: "remote"
+    package: "alpine"
+    description: "Alpine Linux APK package repository"
+    include_patterns:
+      - ".*/x86_64/.*\\.apk$"
+    cache:
+      file_ttl: 0
+      index_ttl: 7200
+
+  almalinux:
+    base_url: "https://gsl-syd.mm.fcix.net/almalinux"
+    type: "remote"
+    package: "rpm"
+    description: "AlmaLinux RPM package repository"
+    include_patterns:
+      - ".*/x86_64/.*\\.rpm$"
+      - ".*/noarch/.*\\.rpm$"
+      - ".*/repodata/.*\\.sqlite.*$"
+      - ".*/repodata/.*\\.xml.*$"
+      - ".*/repodata/.*\\.yaml.*$"
+      - ".*/install.img"
+      - ".*/squashfs.img"
+      - ".*/updates.img"
+      - ".*/RPM-GPG-KEY-.*$"
+    cache:
+      file_ttl: 0
+      index_ttl: 7200
+
+  ceph-reef:
+    base_url: "https://download.ceph.com/rpm-reef/"
+    type: "remote"
+    package: "rpm"
+    description: "Ceph Reef 18"
+    include_patterns:
+      - ".*/x86_64/.*\\.rpm$"
+      - ".*/noarch/.*\\.rpm$"
+      - ".*/repodata/.*\\.xml.*$"
+    cache:
+      file_ttl: 0
+      index_ttl: 7200
+
+  ceph-squid:
+    base_url: "https://download.ceph.com/rpm-squid/"
+    type: "remote"
+    package: "rpm"
+    description: "Ceph Squid 19"
+    include_patterns:
+      - ".*/x86_64/.*\\.rpm$"
+      - ".*/noarch/.*\\.rpm$"
+      - ".*/repodata/.*\\.xml.*$"
+    cache:
+      file_ttl: 0
+      index_ttl: 7200
+
+  ceph-tentacle:
+    base_url: "https://download.ceph.com/rpm-tentacle/"
+    type: "remote"
+    package: "rpm"
+    description: "Ceph Tentacle 20"
+    include_patterns:
+      - ".*/x86_64/.*\\.rpm$"
+      - ".*/noarch/.*\\.rpm$"
+      - ".*/repodata/.*\\.xml.*$"
+    cache:
+      file_ttl: 0
+      index_ttl: 7200
+
+  epel:
+    base_url: "https://gsl-syd.mm.fcix.net/epel"
+    type: "remote"
+    package: "rpm"
+    description: "EPEL (Extra Packages for Enterprise Linux)"
+    include_patterns:
+      - ".*/Everything/x86_64/.*\\.rpm$"
+      - ".*/noarch/.*\\.rpm$"
+      - ".*/repodata/.*\\.sqlite.*$"
+      - ".*/repodata/.*\\.xml.*$"
+      - ".*/repodata/.*\\.yaml.*$"
+      - "RPM-GPG-KEY-.*$"
+    cache:
+      file_ttl: 0
+      index_ttl: 7200
+
+  fedora:
+    base_url: "https://gsl-syd.mm.fcix.net/fedora/linux"
+    type: "remote"
+    package: "rpm"
+    description: "Fedora Linux RPM package repository"
+    include_patterns:
+      - "releases/.*/Everything/x86_64/.*\\.rpm$"
+      - "updates/.*/Everything/x86_64/.*\\.rpm$"
+      - "development/.*/Everything/x86_64/.*\\.rpm$"
+      - ".*/noarch/.*\\.rpm$"
+      - ".*/repodata/.*\\.xml.*$"
+    cache:
+      file_ttl: 0
+      index_ttl: 7200
+
+  frr:
+    base_url: "https://rpm.frrouting.org/repo"
+    type: "remote"
+    package: "rpm"
+    description: "FRR RPM package repository"
+    include_patterns:
+      - ".*\\.rpm$"
+      - ".*/repodata/.*\\.xml.*$"
+    cache:
+      file_ttl: 0
+      index_ttl: 7200
+
+  mariadb:
+    base_url: "http://mariadb.mirror.digitalpacific.com.au/yum"
+    type: "remote"
+    package: "rpm"
+    description: "MariaDB RPM package repository"
+    include_patterns:
+      - ".*\\.rpm$"
+      - ".*/repodata/.*\\.xml.*$"
+      - ".*/RPM-GPG-KEY-.*$"
+    cache:
+      file_ttl: 0
+      index_ttl: 7200
+
+  openvox:
+    base_url: "https://yum.voxpupuli.org"
+    type: "remote"
+    package: "rpm"
+    description: "OpenVox RPM package repository"
+    include_patterns:
+      - ".*\\.rpm$"
+      - ".*/repodata/.*\\.xml.*$"
+      - "GPG-KEY-.*$"
+    cache:
+      file_ttl: 0
+      index_ttl: 7200
+
+  postgresql:
+    base_url: "https://download.postgresql.org/pub/repos/yum"
+    type: "remote"
+    package: "rpm"
+    description: "PostgreSQL RPM package repository"
+    include_patterns:
+      - ".*\\.rpm$"
+      - ".*/repodata/.*\\.xml.*$"
+      - ".*/RPM-GPG-KEY-.*$"
+      - ".*/PGDG-RPM-GPG-KEY-.*$"
+    cache:
+      file_ttl: 0
+      index_ttl: 7200
+
+  rke2:
+    base_url: "https://rpm.rancher.io"
+    type: "remote"
+    package: "rpm"
+    description: "RKE2 RPM package repository"
+    include_patterns:
+      - ".*\\.rpm$"
+      - ".*/repodata/.*\\.xml.*$"
+      - "public.key$"
+    cache:
+      file_ttl: 0
+      index_ttl: 7200
+
+  zfs:
+    base_url: "http://download.zfsonlinux.org"
+    type: "remote"
+    package: "rpm"
+    description: "ZFS RPM package repository"
+    include_patterns:
+      - ".*\\.rpm$"
+      - ".*/repodata/.*\\.xml.*$"
+    cache:
+      file_ttl: 0
+      index_ttl: 7200
+
+
+  local-generic:
+    type: "local"
+    package: "generic"
+    description: "Local generic file repository"
+    cache:
+      file_ttl: 0
+      index_ttl: 0

apps/base/cattle-system/gateway.yaml

@@ -1,29 +0,0 @@
----
-apiVersion: gateway.networking.k8s.io/v1
-kind: Gateway
-metadata:
-  labels:
-    traefik.io/instance: internal
-  annotations:
-    cert-manager.io/cluster-issuer: vault-issuer
-    cert-manager.io/common-name: rancher.k8s.syd1.au.unkin.net
-    cert-manager.io/private-key-size: "4096"
-    external-dns.alpha.kubernetes.io/hostname: rancher.k8s.syd1.au.unkin.net
-    external-dns.alpha.kubernetes.io/target: "198.18.200.4"
-  name: rancher
-  namespace: cattle-system
-spec:
-  gatewayClassName: traefik-internal
-  listeners:
-    - allowedRoutes:
-        namespaces:
-          from: Same
-      hostname: rancher.k8s.syd1.au.unkin.net
-      name: https
-      port: 443
-      protocol: HTTPS
-      tls:
-        certificateRefs:
-          - kind: Secret
-            name: rancher-tls
-        mode: Terminate

apps/base/cattle-system/httproute.yaml

@@ -1,20 +0,0 @@
----
-apiVersion: gateway.networking.k8s.io/v1
-kind: HTTPRoute
-metadata:
-  name: rancher
-  namespace: cattle-system
-spec:
-  hostnames:
-    - rancher.k8s.syd1.au.unkin.net
-  parentRefs:
-    - name: rancher
-      sectionName: https
-  rules:
-    - backendRefs:
-        - name: rancher
-          port: 80
-      matches:
-        - path:
-            type: PathPrefix
-            value: /

apps/base/cattle-system/ingress.yaml

@@ -0,0 +1,29 @@
+---
+apiVersion: networking.k8s.io/v1
+kind: Ingress
+metadata:
+  name: rancher
+  namespace: cattle-system
+  annotations:
+    cert-manager.io/cluster-issuer: vault-issuer
+    cert-manager.io/common-name: rancher.k8s.syd1.au.unkin.net
+    cert-manager.io/private-key-size: "4096"
+    external-dns.alpha.kubernetes.io/hostname: rancher.k8s.syd1.au.unkin.net
+    external-dns.alpha.kubernetes.io/target: "198.18.200.0"
+spec:
+  ingressClassName: nginx
+  tls:
+    - hosts:
+        - rancher.k8s.syd1.au.unkin.net
+      secretName: rancher-tls
+  rules:
+    - host: rancher.k8s.syd1.au.unkin.net
+      http:
+        paths:
+          - path: /
+            pathType: Prefix
+            backend:
+              service:
+                name: rancher
+                port:
+                  number: 80

apps/base/cattle-system/kustomization.yaml

@@ -6,5 +6,4 @@ resources:
   - namespace.yaml
   - vaultauth.yaml
   - vaultstaticsecret.yaml
-  - gateway.yaml
+  - ingress.yaml
-  - httproute.yaml

apps/base/inteldeviceplugins-system/kustomization.yaml

@@ -7,12 +7,12 @@ resources:
 
 helmCharts:
   - name: intel-device-plugins-operator
-    repo: https://artifactapi.k8s.syd1.au.unkin.net/api/v1/virtual/helm
+    repo: https://intel.github.io/helm-charts/
     version: "0.35.0"
     releaseName: intel-device-plugins-operator
     namespace: inteldeviceplugins-system
   - name: intel-device-plugins-gpu
-    repo: https://artifactapi.k8s.syd1.au.unkin.net/api/v1/virtual/helm
+    repo: https://intel.github.io/helm-charts/
     version: "0.34.1"
     releaseName: intel-gpu-plugin
     namespace: inteldeviceplugins-system

apps/base/litellm/cnpg_cluster.yaml

@@ -1,91 +0,0 @@
----
-apiVersion: postgresql.cnpg.io/v1
-kind: Cluster
-metadata:
-  name: litellm-postgres
-  namespace: litellm
-spec:
-  affinity:
-    podAntiAffinityType: preferred
-  bootstrap:
-    initdb:
-      database: litellm
-      encoding: UTF8
-      localeCType: C
-      localeCollate: C
-      owner: litellm
-      secret:
-        name: postgres-credentials
-  enablePDB: true
-  enableSuperuserAccess: false
-  failoverDelay: 0
-  imageName: ghcr.io/cloudnative-pg/postgresql:17-minimal-trixie
-  instances: 3
-  logLevel: info
-  maxSyncReplicas: 0
-  minSyncReplicas: 0
-  monitoring:
-    customQueriesConfigMap:
-      - key: queries
-        name: cnpg-default-monitoring
-    disableDefaultQueries: false
-    enablePodMonitor: false
-  postgresql:
-    parameters:
-      archive_mode: "on"
-      archive_timeout: 5min
-      dynamic_shared_memory_type: posix
-      effective_cache_size: 256MB
-      full_page_writes: "on"
-      log_destination: csvlog
-      log_directory: /controller/log
-      log_filename: postgres
-      log_rotation_age: "0"
-      log_rotation_size: "0"
-      log_truncate_on_rotation: "false"
-      logging_collector: "on"
-      max_connections: "200"
-      max_parallel_workers: "16"
-      max_replication_slots: "16"
-      max_worker_processes: "16"
-      shared_buffers: 128MB
-      shared_memory_type: mmap
-      ssl_max_protocol_version: TLSv1.3
-      ssl_min_protocol_version: TLSv1.3
-      wal_keep_size: 256MB
-      wal_level: logical
-      wal_log_hints: "on"
-      wal_receiver_timeout: 5s
-      wal_sender_timeout: 5s
-    syncReplicaElectionConstraint:
-      enabled: false
-  primaryUpdateMethod: restart
-  primaryUpdateStrategy: unsupervised
-  probes:
-    liveness:
-      isolationCheck:
-        connectionTimeout: 1000
-        enabled: true
-        requestTimeout: 1000
-  replicationSlots:
-    highAvailability:
-      enabled: true
-      slotPrefix: _cnpg_
-    synchronizeReplicas:
-      enabled: true
-    updateInterval: 30
-  resources:
-    limits:
-      cpu: 500m
-      memory: 512Mi
-    requests:
-      cpu: 250m
-      memory: 256Mi
-  smartShutdownTimeout: 180
-  startDelay: 3600
-  stopDelay: 1800
-  storage:
-    resizeInUseVolumes: true
-    size: 10Gi
-    storageClass: cephrbd-fast-delete
-  switchoverDelay: 3600

apps/base/litellm/cnpg_pooler.yaml

@@ -1,33 +0,0 @@
----
-apiVersion: postgresql.cnpg.io/v1
-kind: Pooler
-metadata:
-  name: litellm-postgres-pooler
-  namespace: litellm
-spec:
-  cluster:
-    name: litellm-postgres
-  instances: 2
-  pgbouncer:
-    parameters:
-      default_pool_size: "100"
-      max_client_conn: "400"
-    paused: false
-    poolMode: session
-  template:
-    metadata:
-      labels:
-        app: pooler
-    spec:
-      affinity:
-        podAntiAffinity:
-          requiredDuringSchedulingIgnoredDuringExecution:
-            - labelSelector:
-                matchExpressions:
-                  - key: app
-                    operator: In
-                    values:
-                      - pooler
-              topologyKey: kubernetes.io/hostname
-      containers: []
-  type: rw

apps/base/litellm/deployment.yaml

@@ -1,71 +0,0 @@
----
-apiVersion: apps/v1
-kind: Deployment
-metadata:
-  name: litellm
-  namespace: litellm
-spec:
-  selector:
-    matchLabels:
-      app: litellm
-  template:
-    metadata:
-      annotations:
-        reloader.stakater.com/auto: "true"
-      labels:
-        app: litellm
-    spec:
-      containers:
-        - name: litellm
-          image: docker.litellm.ai/berriai/litellm-database:main-stable
-          imagePullPolicy: Always
-          args:
-            - --config
-            - /app/config.yaml
-            - --port
-            - "4000"
-            - --num_workers
-            - "8"
-          ports:
-            - containerPort: 4000
-              name: http
-              protocol: TCP
-          envFrom:
-            - secretRef:
-                name: litellm-credentials
-            - configMapRef:
-                name: litellm-env
-          livenessProbe:
-            httpGet:
-              path: /health/liveliness
-              port: 4000
-            failureThreshold: 3
-            initialDelaySeconds: 30
-            periodSeconds: 30
-            successThreshold: 1
-            timeoutSeconds: 5
-          readinessProbe:
-            httpGet:
-              path: /health/readiness
-              port: 4000
-            failureThreshold: 3
-            initialDelaySeconds: 10
-            periodSeconds: 10
-            successThreshold: 1
-            timeoutSeconds: 5
-          resources:
-            limits:
-              cpu: "2"
-              memory: 6Gi
-            requests:
-              cpu: 250m
-              memory: 2Gi
-          volumeMounts:
-            - mountPath: /app/config.yaml
-              name: config
-              subPath: config.yaml
-      restartPolicy: Always
-      volumes:
-        - name: config
-          configMap:
-            name: litellm-config

apps/base/litellm/hpa.yaml

@@ -1,41 +0,0 @@
----
-apiVersion: autoscaling/v2
-kind: HorizontalPodAutoscaler
-metadata:
-  name: litellm-hpa
-  namespace: litellm
-spec:
-  scaleTargetRef:
-    apiVersion: apps/v1
-    kind: Deployment
-    name: litellm
-  minReplicas: 2
-  maxReplicas: 10
-  metrics:
-    - type: Resource
-      resource:
-        name: cpu
-        target:
-          type: Utilization
-          averageUtilization: 60
-  behavior:
-    scaleUp:
-      stabilizationWindowSeconds: 0
-      selectPolicy: Max
-      policies:
-        - type: Percent
-          value: 100
-          periodSeconds: 30
-        - type: Pods
-          value: 4
-          periodSeconds: 30
-    scaleDown:
-      stabilizationWindowSeconds: 300
-      selectPolicy: Min
-      policies:
-        - type: Percent
-          value: 10
-          periodSeconds: 60
-        - type: Pods
-          value: 2
-          periodSeconds: 60

apps/base/litellm/ingress.yaml

@@ -1,29 +0,0 @@
----
-apiVersion: networking.k8s.io/v1
-kind: Ingress
-metadata:
-  annotations:
-    kubernetes.io/ingress.class: nginx
-    external-dns.alpha.kubernetes.io/hostname: litellm.k8s.syd1.au.unkin.net
-    external-dns.alpha.kubernetes.io/target: 198.18.200.0
-    cert-manager.io/cluster-issuer: vault-issuer
-    cert-manager.io/common-name: litellm.k8s.syd1.au.unkin.net
-    cert-manager.io/private-key-size: "4096"
-  name: litellm
-  namespace: litellm
-spec:
-  rules:
-    - host: litellm.k8s.syd1.au.unkin.net
-      http:
-        paths:
-          - backend:
-              service:
-                name: litellm
-                port:
-                  number: 4000
-            path: /
-            pathType: Prefix
-  tls:
-    - hosts:
-        - litellm.k8s.syd1.au.unkin.net
-      secretName: litellm-tls

apps/base/litellm/kustomization.yaml

@@ -1,28 +0,0 @@
----
-apiVersion: kustomize.config.k8s.io/v1beta1
-kind: Kustomization
-
-resources:
-  - cnpg_cluster.yaml
-  - cnpg_pooler.yaml
-  - deployment.yaml
-  - hpa.yaml
-  - ingress.yaml
-  - namespace.yaml
-  - redis-deployment.yaml
-  - redis-pvc.yaml
-  - services.yaml
-  - vaultauth.yaml
-  - vaultstaticsecret.yaml
-
-configMapGenerator:
-  - name: litellm-config
-    files:
-      - config.yaml=resources/config.yaml
-    options:
-      disableNameSuffixHash: true
-  - name: litellm-env
-    literals:
-      - STORE_MODEL_IN_DB=True
-    options:
-      disableNameSuffixHash: true

apps/base/litellm/namespace.yaml

@@ -1,5 +0,0 @@
----
-apiVersion: v1
-kind: Namespace
-metadata:
-  name: litellm

apps/base/litellm/redis-deployment.yaml

@@ -1,67 +0,0 @@
----
-apiVersion: apps/v1
-kind: Deployment
-metadata:
-  name: redis
-  namespace: litellm
-spec:
-  replicas: 1
-  selector:
-    matchLabels:
-      app: redis
-  strategy:
-    type: Recreate
-  template:
-    metadata:
-      labels:
-        app: redis
-    spec:
-      containers:
-        - name: redis
-          image: redis:7-alpine
-          imagePullPolicy: IfNotPresent
-          command:
-            - redis-server
-            - --save
-            - "20"
-            - "1"
-          ports:
-            - containerPort: 6379
-              name: redis
-              protocol: TCP
-          livenessProbe:
-            exec:
-              command:
-                - redis-cli
-                - ping
-            failureThreshold: 3
-            initialDelaySeconds: 30
-            periodSeconds: 30
-            successThreshold: 1
-            timeoutSeconds: 5
-          readinessProbe:
-            exec:
-              command:
-                - redis-cli
-                - ping
-            failureThreshold: 3
-            initialDelaySeconds: 5
-            periodSeconds: 10
-            successThreshold: 1
-            timeoutSeconds: 5
-          resources:
-            limits:
-              cpu: 500m
-              memory: 512Mi
-            requests:
-              cpu: 50m
-              memory: 128Mi
-          volumeMounts:
-            - mountPath: /data
-              mountPropagation: None
-              name: data
-      restartPolicy: Always
-      volumes:
-        - name: data
-          persistentVolumeClaim:
-            claimName: litellm-redis-data

apps/base/litellm/redis-pvc.yaml

@@ -1,14 +0,0 @@
----
-apiVersion: v1
-kind: PersistentVolumeClaim
-metadata:
-  name: litellm-redis-data
-  namespace: litellm
-spec:
-  accessModes:
-    - ReadWriteOnce
-  resources:
-    requests:
-      storage: 5Gi
-  storageClassName: cephrbd-fast-delete
-  volumeMode: Filesystem

apps/base/litellm/resources/config.yaml

@@ -1,15 +0,0 @@
-model_list: []
-
-router_settings:
-  redis_host: redis-service
-  redis_port: 6379
-
-general_settings:
-  use_redis_transaction_buffer: true
-
-litellm_settings:
-  cache: true
-  cache_params:
-    type: redis
-    host: redis-service
-    port: 6379

apps/base/litellm/services.yaml

@@ -1,34 +0,0 @@
----
-apiVersion: v1
-kind: Service
-metadata:
-  name: litellm
-  namespace: litellm
-spec:
-  internalTrafficPolicy: Cluster
-  ports:
-    - name: http
-      port: 4000
-      protocol: TCP
-      targetPort: http
-  selector:
-    app: litellm
-  sessionAffinity: None
-  type: ClusterIP
----
-apiVersion: v1
-kind: Service
-metadata:
-  name: redis-service
-  namespace: litellm
-spec:
-  internalTrafficPolicy: Cluster
-  ports:
-    - name: redis
-      port: 6379
-      protocol: TCP
-      targetPort: redis
-  selector:
-    app: redis
-  sessionAffinity: None
-  type: ClusterIP

apps/base/litellm/vaultauth.yaml

@@ -1,18 +0,0 @@
----
-apiVersion: secrets.hashicorp.com/v1beta1
-kind: VaultAuth
-metadata:
-  name: default
-  namespace: litellm
-spec:
-  allowedNamespaces:
-    - litellm
-  kubernetes:
-    audiences:
-      - vault
-    role: default
-    serviceAccount: default
-    tokenExpirationSeconds: 600
-  method: kubernetes
-  mount: k8s/au/syd1
-  vaultConnectionRef: vso-system/default

apps/base/litellm/vaultstaticsecret.yaml

@@ -1,34 +0,0 @@
----
-apiVersion: secrets.hashicorp.com/v1beta1
-kind: VaultStaticSecret
-metadata:
-  name: postgres-credentials
-  namespace: litellm
-spec:
-  destination:
-    create: true
-    name: postgres-credentials
-    overwrite: true
-  hmacSecretData: true
-  mount: kv
-  path: kubernetes/namespace/litellm/default/postgres-credentials
-  refreshAfter: 5m
-  type: kv-v2
-  vaultAuthRef: default
----
-apiVersion: secrets.hashicorp.com/v1beta1
-kind: VaultStaticSecret
-metadata:
-  name: litellm-credentials
-  namespace: litellm
-spec:
-  destination:
-    create: true
-    name: litellm-credentials
-    overwrite: true
-  hmacSecretData: true
-  mount: kv
-  path: kubernetes/namespace/litellm/default/litellm-credentials
-  refreshAfter: 5m
-  type: kv-v2
-  vaultAuthRef: default

apps/base/paperclip/deployment.yaml

@@ -1,108 +0,0 @@
----
-apiVersion: apps/v1
-kind: Deployment
-metadata:
-  name: paperclip
-  namespace: paperclip
-spec:
-  selector:
-    matchLabels:
-      app: paperclip
-  template:
-    metadata:
-      labels:
-        app: paperclip
-    spec:
-      containers:
-        - name: paperclip
-          image: ghcr.io/paperclipai/paperclip:latest
-          imagePullPolicy: Always
-          ports:
-            - containerPort: 3100
-              name: http
-              protocol: TCP
-          env:
-            - name: PORT
-              value: "3100"
-            - name: PAPERCLIP_BIND
-              value: custom
-            - name: PAPERCLIP_BIND_HOST
-              value: 0.0.0.0
-            - name: PAPERCLIP_API_URL
-              value: https://paperclip.k8s.syd1.au.unkin.net
-            - name: BETTER_AUTH_BASE_URL
-              value: https://paperclip.k8s.syd1.au.unkin.net
-            - name: PAPERCLIP_ALLOWED_HOSTNAMES
-              value: paperclip.k8s.syd1.au.unkin.net,localhost
-            - name: PAPERCLIP_HOME
-              value: /paperclip
-            - name: PAPERCLIP_INSTANCE_ID
-              value: default
-            - name: PAPERCLIP_DEPLOYMENT_MODE
-              value: authenticated
-            - name: PAPERCLIP_DEPLOYMENT_EXPOSURE
-              value: private
-            - name: SERVE_UI
-              value: "true"
-            - name: HEARTBEAT_SCHEDULER_ENABLED
-              value: "true"
-            - name: PAPERCLIP_MIGRATION_AUTO_APPLY
-              value: "true"
-            - name: PAPERCLIP_STORAGE_PROVIDER
-              value: s3
-            - name: PAPERCLIP_STORAGE_S3_BUCKET
-              value: paperclip
-            - name: PAPERCLIP_STORAGE_S3_REGION
-              value: us-east-1
-            - name: PAPERCLIP_STORAGE_S3_ENDPOINT
-              value: https://radosgw.service.consul
-            - name: PAPERCLIP_STORAGE_S3_FORCE_PATH_STYLE
-              value: "true"
-            - name: NODE_EXTRA_CA_CERTS
-              value: /etc/ssl/paperclip/ca.crt
-          envFrom:
-            - secretRef:
-                name: paperclip-credentials
-          volumeMounts:
-            - name: vault-ca-cert
-              mountPath: /etc/ssl/paperclip
-              readOnly: true
-          livenessProbe:
-            httpGet:
-              path: /api/health
-              port: 3100
-              httpHeaders:
-                - name: Host
-                  value: localhost
-            failureThreshold: 3
-            initialDelaySeconds: 30
-            periodSeconds: 30
-            successThreshold: 1
-            timeoutSeconds: 5
-          readinessProbe:
-            httpGet:
-              path: /api/health
-              port: 3100
-              httpHeaders:
-                - name: Host
-                  value: localhost
-            failureThreshold: 3
-            initialDelaySeconds: 10
-            periodSeconds: 10
-            successThreshold: 1
-            timeoutSeconds: 5
-          resources:
-            limits:
-              cpu: "1"
-              memory: 2Gi
-            requests:
-              cpu: 250m
-              memory: 512Mi
-      volumes:
-        - name: vault-ca-cert
-          secret:
-            secretName: vault-ca-cert
-            items:
-              - key: ca.crt
-                path: ca.crt
-      restartPolicy: Always

apps/base/paperclip/ingress.yaml

@@ -1,29 +0,0 @@
----
-apiVersion: networking.k8s.io/v1
-kind: Ingress
-metadata:
-  annotations:
-    kubernetes.io/ingress.class: nginx
-    external-dns.alpha.kubernetes.io/hostname: paperclip.k8s.syd1.au.unkin.net
-    external-dns.alpha.kubernetes.io/target: 198.18.200.0
-    cert-manager.io/cluster-issuer: vault-issuer
-    cert-manager.io/common-name: paperclip.k8s.syd1.au.unkin.net
-    cert-manager.io/private-key-size: "4096"
-  name: paperclip
-  namespace: paperclip
-spec:
-  rules:
-    - host: paperclip.k8s.syd1.au.unkin.net
-      http:
-        paths:
-          - backend:
-              service:
-                name: paperclip
-                port:
-                  number: 3100
-            path: /
-            pathType: Prefix
-  tls:
-    - hosts:
-        - paperclip.k8s.syd1.au.unkin.net
-      secretName: paperclip-tls

apps/base/paperclip/kustomization.yaml

@@ -1,13 +0,0 @@
----
-apiVersion: kustomize.config.k8s.io/v1beta1
-kind: Kustomization
-
-resources:
-  - cnpg_cluster.yaml
-  - cnpg_pooler.yaml
-  - deployment.yaml
-  - ingress.yaml
-  - namespace.yaml
-  - services.yaml
-  - vaultauth.yaml
-  - vaultstaticsecret.yaml

apps/base/paperclip/namespace.yaml

@@ -1,5 +0,0 @@
----
-apiVersion: v1
-kind: Namespace
-metadata:
-  name: paperclip

apps/base/paperclip/services.yaml

@@ -1,17 +0,0 @@
----
-apiVersion: v1
-kind: Service
-metadata:
-  name: paperclip
-  namespace: paperclip
-spec:
-  internalTrafficPolicy: Cluster
-  ports:
-    - name: http
-      port: 3100
-      protocol: TCP
-      targetPort: http
-  selector:
-    app: paperclip
-  sessionAffinity: None
-  type: ClusterIP

apps/base/paperclip/vaultstaticsecret.yaml

@@ -1,34 +0,0 @@
----
-apiVersion: secrets.hashicorp.com/v1beta1
-kind: VaultStaticSecret
-metadata:
-  name: postgres-credentials
-  namespace: paperclip
-spec:
-  destination:
-    create: true
-    name: postgres-credentials
-    overwrite: true
-  hmacSecretData: true
-  mount: kv
-  path: kubernetes/namespace/paperclip/default/postgres-credentials
-  refreshAfter: 5m
-  type: kv-v2
-  vaultAuthRef: default
----
-apiVersion: secrets.hashicorp.com/v1beta1
-kind: VaultStaticSecret
-metadata:
-  name: paperclip-credentials
-  namespace: paperclip
-spec:
-  destination:
-    create: true
-    name: paperclip-credentials
-    overwrite: true
-  hmacSecretData: true
-  mount: kv
-  path: kubernetes/namespace/paperclip/default/paperclip-credentials
-  refreshAfter: 5m
-  type: kv-v2
-  vaultAuthRef: default

apps/base/traefik-system/gatewayclass-external.yaml

@@ -1,9 +0,0 @@
----
-apiVersion: gateway.networking.k8s.io/v1
-kind: GatewayClass
-metadata:
-  labels:
-    traefik.io/instance: external
-  name: traefik-external
-spec:
-  controllerName: traefik.io/gateway-controller

apps/base/traefik-system/gatewayclass-internal.yaml

@@ -1,9 +0,0 @@
----
-apiVersion: gateway.networking.k8s.io/v1
-kind: GatewayClass
-metadata:
-  labels:
-    traefik.io/instance: internal
-  name: traefik-internal
-spec:
-  controllerName: traefik.io/gateway-controller

apps/base/traefik-system/kustomization.yaml

@@ -1,8 +0,0 @@
----
-apiVersion: kustomize.config.k8s.io/v1beta1
-kind: Kustomization
-
-resources:
-  - namespace.yaml
-  - gatewayclass-internal.yaml
-  - gatewayclass-external.yaml

apps/base/traefik-system/namespace.yaml

@@ -1,5 +0,0 @@
----
-apiVersion: v1
-kind: Namespace
-metadata:
-  name: traefik-system

apps/base/woodpecker/kustomization.yaml

@@ -6,6 +6,5 @@ resources:
   - namespace.yaml
   - cnpg_cluster.yaml
   - cnpg_pooler.yaml
-  - serviceaccount_terraform_vault.yaml
   - vaultauth.yaml
   - vaultstaticsecret.yaml

apps/base/woodpecker/serviceaccount_terraform_vault.yaml

@@ -1,6 +0,0 @@
----
-apiVersion: v1
-kind: ServiceAccount
-metadata:
-  name: terraform-vault
-  namespace: woodpecker

apps/overlays/au-syd1/artifact-keeper/kustomization.yaml

@@ -3,4 +3,4 @@ apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
 
 resources:
-  - ../../../base/litellm
+  - ../../../base/artifact-keeper

apps/overlays/au-syd1/cattle-system/kustomization.yaml

@@ -7,7 +7,7 @@ resources:
 
 helmCharts:
   - name: rancher
-    repo: https://artifactapi.k8s.syd1.au.unkin.net/api/v1/virtual/helm
+    repo: https://releases.rancher.com/server-charts/stable
     version: "2.13.1"
     releaseName: rancher
     namespace: cattle-system

apps/overlays/au-syd1/cert-manager/kustomization.yaml

@@ -7,7 +7,7 @@ resources:
 
 helmCharts:
   - name: cert-manager
-    repo: https://artifactapi.k8s.syd1.au.unkin.net/api/v1/virtual/helm
+    repo: https://charts.jetstack.io
     version: "v1.19.2"
     releaseName: cert-manager
     namespace: cert-manager

apps/overlays/au-syd1/cnpg-system/kustomization.yaml

@@ -7,7 +7,7 @@ resources:
 
 helmCharts:
   - name: cloudnative-pg
-    repo: https://artifactapi.k8s.syd1.au.unkin.net/api/v1/virtual/helm
+    repo: https://cloudnative-pg.github.io/charts
     version: "0.27.0"
     releaseName: cloudnative-pg-operator
     namespace: cnpg-system

apps/overlays/au-syd1/elastic-system/kustomization.yaml

@@ -9,7 +9,7 @@ resources:
 
 helmCharts:
   - name: eck-operator
-    repo: https://artifactapi.k8s.syd1.au.unkin.net/api/v1/virtual/helm
+    repo: https://helm.elastic.co
     version: "3.2.0"
     releaseName: elastic-operator
     namespace: elastic-system

apps/overlays/au-syd1/externaldns/kustomization.yaml

@@ -7,7 +7,7 @@ resources:
 
 helmCharts:
   - name: external-dns
-    repo: https://artifactapi.k8s.syd1.au.unkin.net/api/v1/virtual/helm
+    repo: https://kubernetes-sigs.github.io/external-dns/
     version: "1.19.0"
     releaseName: externaldns
     namespace: externaldns

apps/overlays/au-syd1/externaldns/values.yaml

@@ -24,11 +24,6 @@ policy: "sync"
 sources:
   - service
   - ingress
-  - gateway-httproute
-  - gateway-tlsroute
-  - gateway-grpcroute
-  - gateway-tcproute
-  - gateway-udproute
 
 # Environment variables for TSIG secret and algorithm from Vault
 env:
@@ -54,5 +49,3 @@ extraArgs:
   - --rfc2136-tsig-axfr
   - --rfc2136-tsig-secret=$(EXTERNAL_DNS_RFC2136_TSIG_SECRET)
   - --ingress-class=nginx
-
-logLevel: debug

apps/overlays/au-syd1/observability/kustomization.yaml

@@ -9,13 +9,13 @@ resources:
 
 helmCharts:
   - name: victoria-metrics-cluster
-    repo: https://artifactapi.k8s.syd1.au.unkin.net/api/v1/virtual/helm
+    repo: https://victoriametrics.github.io/helm-charts/
     version: "0.33.0"
     releaseName: victoria-metrics-cluster
     namespace: observability
     valuesFile: values-vmcluster.yaml
   - name: victoria-metrics-agent
-    repo: https://artifactapi.k8s.syd1.au.unkin.net/api/v1/virtual/helm
+    repo: https://victoriametrics.github.io/helm-charts/
     version: "0.30.0"
     releaseName: victoria-metrics-agent
     namespace: observability

apps/overlays/au-syd1/paperclip/kustomization.yaml

@@ -1,6 +0,0 @@
----
-apiVersion: kustomize.config.k8s.io/v1beta1
-kind: Kustomization
-
-resources:
-  - ../../../base/paperclip

apps/overlays/au-syd1/reloader-system/kustomization.yaml

@@ -7,7 +7,7 @@ resources:
 
 helmCharts:
   - name: reloader
-    repo: https://artifactapi.k8s.syd1.au.unkin.net/api/v1/virtual/helm
+    repo: https://stakater.github.io/stakater-charts
     version: "2.2.8"
     releaseName: reloader
     namespace: reloader-system

apps/overlays/au-syd1/traefik-system/kustomization.yaml

@@ -1,24 +0,0 @@
----
-apiVersion: kustomize.config.k8s.io/v1beta1
-kind: Kustomization
-
-resources:
-  - ../../../base/traefik-system
-
-helmCharts:
-  - name: traefik
-    repo: https://artifactapi.k8s.syd1.au.unkin.net/api/v1/virtual/helm
-    version: "40.0.0"
-    releaseName: traefik-internal
-    namespace: traefik-system
-    valuesFile: values-internal.yaml
-    apiVersions:
-      - policy/v1/PodDisruptionBudget
-  - name: traefik
-    repo: https://artifactapi.k8s.syd1.au.unkin.net/api/v1/virtual/helm
-    version: "40.0.0"
-    releaseName: traefik-external
-    namespace: traefik-system
-    valuesFile: values-external.yaml
-    apiVersions:
-      - policy/v1/PodDisruptionBudget

apps/overlays/au-syd1/traefik-system/values-external.yaml

@@ -1,98 +0,0 @@
-image:
-  tag: v3.7.0
-
-
-podDisruptionBudget:
-  enabled: true
-  maxUnavailable: 1
-
-gateway:
-  enabled: false
-
-gatewayClass:
-  enabled: false
-
-updateStrategy:
-  type: RollingUpdate
-  rollingUpdate:
-    maxUnavailable: 1
-
-providers:
-  kubernetesCRD:
-    enabled: false
-  kubernetesIngress:
-    enabled: false
-  kubernetesGateway:
-    enabled: true
-    experimentalChannel: false
-    namespaces: []
-    nativeLBByDefault: false
-    labelSelector: "traefik.io/instance=external"
-
-logs:
-  access:
-    enabled: true
-
-global:
-  checkNewVersion: true
-  sendAnonymousUsage: false
-  notAppendXForwardedFor: false
-
-service:
-  enabled: true
-  single: true
-  annotations:
-    purelb.io/service-group: "dmz"
-    purelb.io/addresses: 198.18.199.0
-  annotationsTCP: {}
-  annotationsUDP: {}
-  labels: {}
-  spec:
-    type: LoadBalancer
-    loadBalancerIP: "198.18.199.0"
-  additionalServices: {}
-
-autoscaling:
-  enabled: true
-  minReplicas: 2
-  maxReplicas: 5
-  metrics: []
-  behavior: {}
-  scaleTargetRef:
-    apiVersion: apps/v1
-    kind: Deployment
-    name: "{{ template \"traefik.fullname\" . }}"
-
-persistence:
-  enabled: false
-
-affinity:
-  podAntiAffinity:
-    requiredDuringSchedulingIgnoredDuringExecution:
-      - labelSelector:
-          matchLabels:
-            app.kubernetes.io/name: '{{ template "traefik.name" . }}'
-            app.kubernetes.io/instance: '{{ .Release.Name }}-{{ include "traefik.namespace" . }}'
-        topologyKey: kubernetes.io/hostname
-
-podSecurityContext:
-  runAsGroup: 65532
-  runAsNonRoot: true
-  runAsUser: 65532
-  seccompProfile:
-    type: RuntimeDefault
-
-securityContext:
-  allowPrivilegeEscalation: false
-  capabilities:
-    drop: [ALL]
-    add: [NET_BIND_SERVICE]
-  readOnlyRootFilesystem: true
-
-ports:
-  web:
-    port: 80
-  websecure:
-    port: 443
-
-enabled: true

apps/overlays/au-syd1/traefik-system/values-internal.yaml

@@ -1,98 +0,0 @@
-image:
-  tag: v3.7.0
-
-
-podDisruptionBudget:
-  enabled: true
-  maxUnavailable: 1
-
-gateway:
-  enabled: false
-
-gatewayClass:
-  enabled: false
-
-updateStrategy:
-  type: RollingUpdate
-  rollingUpdate:
-    maxUnavailable: 1
-
-providers:
-  kubernetesCRD:
-    enabled: false
-  kubernetesIngress:
-    enabled: false
-  kubernetesGateway:
-    enabled: true
-    experimentalChannel: false
-    namespaces: []
-    nativeLBByDefault: false
-    labelSelector: "traefik.io/instance=internal"
-
-logs:
-  access:
-    enabled: true
-
-global:
-  checkNewVersion: true
-  sendAnonymousUsage: false
-  notAppendXForwardedFor: false
-
-service:
-  enabled: true
-  single: true
-  annotations:
-    purelb.io/service-group: "common"
-    purelb.io/addresses: 198.18.200.4
-  annotationsTCP: {}
-  annotationsUDP: {}
-  labels: {}
-  spec:
-    type: LoadBalancer
-    loadBalancerIP: "198.18.200.4"
-  additionalServices: {}
-
-autoscaling:
-  enabled: true
-  minReplicas: 2
-  maxReplicas: 5
-  metrics: []
-  behavior: {}
-  scaleTargetRef:
-    apiVersion: apps/v1
-    kind: Deployment
-    name: "{{ template \"traefik.fullname\" . }}"
-
-persistence:
-  enabled: false
-
-affinity:
-  podAntiAffinity:
-    requiredDuringSchedulingIgnoredDuringExecution:
-      - labelSelector:
-          matchLabels:
-            app.kubernetes.io/name: '{{ template "traefik.name" . }}'
-            app.kubernetes.io/instance: '{{ .Release.Name }}-{{ include "traefik.namespace" . }}'
-        topologyKey: kubernetes.io/hostname
-
-podSecurityContext:
-  runAsGroup: 65532
-  runAsNonRoot: true
-  runAsUser: 65532
-  seccompProfile:
-    type: RuntimeDefault
-
-securityContext:
-  allowPrivilegeEscalation: false
-  capabilities:
-    drop: [ALL]
-    add: [NET_BIND_SERVICE]
-  readOnlyRootFilesystem: true
-
-ports:
-  web:
-    port: 80
-  websecure:
-    port: 443
-
-enabled: true

apps/overlays/au-syd1/vso-system/kustomization.yaml

@@ -9,8 +9,8 @@ resources:
 
 helmCharts:
   - name: vault-secrets-operator
-    repo: https://artifactapi.k8s.syd1.au.unkin.net/api/v1/virtual/helm
+    repo: https://helm.releases.hashicorp.com
-    version: "1.3.0"
+    version: "1.2.0"
     releaseName: vault-secrets-operator
     namespace: vso-system
     valuesFile: values.yaml

apps/overlays/au-syd1/woodpecker/values.yaml

@@ -26,7 +26,7 @@ server:
     WOODPECKER_OPEN: "true"
     WOODPECKER_ADMIN: "unkinben"
     WOODPECKER_DISABLE_USER_AGENT_REGISTRATION: "true"
-    WOODPECKER_PLUGINS_PRIVILEGED: "woodpeckerci/plugin-docker-buildx,woodpeckerci/plugin-docker-buildx:latest-insecure"
+    WOODPECKER_PLUGINS_PRIVILEGED: "woodpeckerci/plugin-docker-buildx:latest-insecure"
   extraSecretNamesForEnvFrom:
     - woodpecker-gitea
     - woodpecker-postgres-credentials

argocd/applicationsets/aitooling.yaml

@@ -1,32 +0,0 @@
----
-apiVersion: argoproj.io/v1alpha1
-kind: ApplicationSet
-metadata:
-  name: aitooling-apps
-  namespace: argocd
-spec:
-  generators:
-  - git:
-      repoURL: https://git.unkin.net/unkin/argocd-apps
-      revision: HEAD
-      directories:
-      - path: apps/overlays/*/litellm
-      - path: apps/overlays/*/paperclip
-  template:
-    metadata:
-      name: 'aitooling-{{path[3]}}'
-    spec:
-      project: aitooling
-      source:
-        repoURL: https://git.unkin.net/unkin/argocd-apps
-        targetRevision: HEAD
-        path: '{{path}}'
-      destination:
-        server: https://kubernetes.default.svc
-        namespace: '{{path[3]}}'
-      syncPolicy:
-        automated:
-          prune: true
-          selfHeal: true
-        syncOptions:
-        - ServerSideApply=true

argocd/applicationsets/kustomization.yaml

@@ -3,7 +3,6 @@ apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
 
 resources:
-  - aitooling.yaml
   - observability.yaml
   - platform.yaml
   - storage.yaml

argocd/applicationsets/platform.yaml

@@ -25,7 +25,6 @@ spec:
       - path: apps/overlays/*/reflector-system
       - path: apps/overlays/*/reloader-system
       - path: apps/overlays/*/reposync
-      - path: apps/overlays/*/traefik-system
       - path: apps/overlays/*/vm-system
       - path: apps/overlays/*/vso-system
       - path: apps/overlays/*/woodpecker

argocd/projects/aitooling.yaml

@@ -1,21 +0,0 @@
----
-apiVersion: argoproj.io/v1alpha1
-kind: AppProject
-metadata:
-  name: aitooling
-  namespace: argocd
-spec:
-  description: AI tooling services
-  sourceRepos:
-    - https://git.unkin.net/unkin/argocd-apps
-  destinations:
-    - namespace: 'litellm'
-      server: https://kubernetes.default.svc
-    - namespace: 'paperclip'
-      server: https://kubernetes.default.svc
-  clusterResourceWhitelist:
-    - group: ''
-      kind: Namespace
-  namespaceResourceWhitelist:
-    - group: '*'
-      kind: '*'

argocd/projects/kustomization.yaml

@@ -3,7 +3,6 @@ apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
 
 resources:
-  - aitooling.yaml
   - observability.yaml
   - platform.yaml
   - storage.yaml

argocd/projects/observability.yaml

@@ -8,6 +8,7 @@ spec:
   description: Observability stack (metrics, monitoring)
   sourceRepos:
     - https://git.unkin.net/unkin/argocd-apps
+    - https://victoriametrics.github.io/helm-charts/
   destinations:
     - namespace: 'observability'
       server: https://kubernetes.default.svc

argocd/projects/platform.yaml

@@ -8,9 +8,17 @@ spec:
   description: Platform infrastructure and core services
   sourceRepos:
     - https://git.unkin.net/unkin/argocd-apps
-    - https://artifactapi.k8s.syd1.au.unkin.net/api/v1/virtual/helm
+    - https://charts.jetstack.io
+    - https://cloudnative-pg.github.io/charts
+    - https://helm.elastic.co
+    - https://helm.releases.hashicorp.com
     - https://purelb.github.io/purelb/charts
+    - https://intel.github.io/helm-charts/
+    - https://kubernetes-sigs.github.io/external-dns/
+    - https://releases.rancher.com/server-charts/stable
+    - https://victoriametrics.github.io/helm-charts/
     - oci://gcr.io/k8s-staging-nfd/charts
+    - oci://ghcr.io/emberstack/helm-charts
     - oci://ghcr.io/woodpecker-ci/helm/woodpecker
   destinations:
     - namespace: '*-system'
@@ -60,10 +68,6 @@ spec:
       kind: Certificate
     - group: 'cert-manager.io'
       kind: Issuer
-    - group: 'gateway.networking.k8s.io'
-      kind: GatewayClass
-    - group: 'networking.k8s.io'
-      kind: IngressClass
   namespaceResourceWhitelist:
     - group: '*'
       kind: '*'

clusters/au-syd1/bootstrap/argocd-repo-server-vault-ca-patch.yaml

@@ -1,25 +0,0 @@
----
-apiVersion: apps/v1
-kind: Deployment
-metadata:
-  name: argocd-repo-server
-  namespace: argocd
-spec:
-  template:
-    spec:
-      volumes:
-        - name: vault-ca-cert
-          secret:
-            secretName: vault-ca-cert
-            items:
-              - key: ca.crt
-                path: ca.crt
-      containers:
-        - name: argocd-repo-server
-          env:
-            - name: SSL_CERT_DIR
-              value: /etc/ssl/certs:/custom-certs
-          volumeMounts:
-            - name: vault-ca-cert
-              mountPath: /custom-certs
-              readOnly: true

clusters/au-syd1/bootstrap/argocd-self-app.yaml

@@ -1,21 +0,0 @@
----
-apiVersion: argoproj.io/v1alpha1
-kind: Application
-metadata:
-  name: argocd
-  namespace: argocd
-spec:
-  project: default
-  source:
-    repoURL: https://git.unkin.net/unkin/argocd-apps
-    targetRevision: HEAD
-    path: clusters/au-syd1/bootstrap
-  destination:
-    server: https://kubernetes.default.svc
-    namespace: argocd
-  syncPolicy:
-    automated:
-      prune: false
-      selfHeal: true
-    syncOptions:
-      - ServerSideApply=true

clusters/au-syd1/bootstrap/argocd-tls-certs-patch.yaml

@@ -1,50 +0,0 @@
----
-apiVersion: v1
-kind: ConfigMap
-metadata:
-  name: argocd-tls-certs-cm
-  namespace: argocd
-data:
-  artifactapi.k8s.syd1.au.unkin.net: |
-    -----BEGIN CERTIFICATE-----
-    MIIDujCCAqKgAwIBAgIULZAR/QcvAnxdi04S6bXhNeazozYwDQYJKoZIhvcNAQEL
-    BQAwFDESMBAGA1UEAxMJdW5raW4ubmV0MB4XDTI0MDQyNzExMzcyMloXDTI5MDQy
-    NjExMzc1MlowKzEpMCcGA1UEAxMgdW5raW4ubmV0IEludGVybWVkaWF0ZSBBdXRo
-    b3JpdHkwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQDDq0ZU2DnuYW5s
-    E3lPjVe2Ns6cPu64yx1GLVqB5VbOUs71ThRjPjvEwE98YtGMza8ok0CQSqS2qX8z
-    vnMbnVCaWKjCnem/dtQtB+8WCu5uQuNHhwqxgw1tD/klAkVLWGgTPDEgasvjDMkc
-    sW8in/BhtrV9YA/lQGpge+j9/MFXhlnvaLCPybFifPRX9Yc5CcnhSzLSzFPO4PJx
-    VH4Qu9eByyKHMTvgcCy6p9qjjzz+8dtAlxeIsgfTEdvtfCPowsF+v2XooutTsJt0
-    xUDvUDu4xV6tVCEOYRA2cZHkLRBhV289M0hocHrsGqMmA1+j0skwwt/6UkVHqlCT
-    mitItX+RAgMBAAGjgewwgekwDgYDVR0PAQH/BAQDAgEGMA8GA1UdEwEB/wQFMAMB
-    Af8wHQYDVR0OBBYEFEp/+grAdVqRSeb9xJjSeZYNW32MMB8GA1UdIwQYMBaAFBqc
-    v6Y+hfHt4EjgKa/uoQGEHTknMEcGCCsGAQUFBwEBBDswOTA3BggrBgEFBQcwAoYr
-    aHR0cHM6Ly92YXVsdC5zZXJ2aWNlLmNvbnN1bC92MS9wa2lfcm9vdC9jYTA9BgNV
-    HR8ENjA0MDKgMKAuhixodHRwczovL3ZhdWx0LnNlcnZpY2UuY29uc3VsL3YxL3Br
-    aV9yb290L2NybDANBgkqhkiG9w0BAQsFAAOCAQEAM0FS8tscZe7yly/gM7jO6lx5
-    muMFusifjUIrcQGnZBkoECeuUVPNTs3e/Th+XaxjCnmSpqSNT3z9Irr6Hhxf7n03
-    4+hpF3G0bf1yh4DRex/0ua3szvgo91RwyKVQM1BHIA1PwdF8csO+LT4FTMILzo4U
-    DdSVvDEIaxYYQCDNfAD81n+8lmFbabupfsKbkSTR+sNTS+TMnLpN8YwSXdB0e+RU
-    eEZRNVu0jKmbE8U/66Sc33YLe6cxbCclHA+G4giGwEP+lYZk+rFjmr6ci9bj5yyN
-    Sznr7xdW0ofOdACAQFFy5KTZqCDjIrvk12vUn4bSsXmWVIQEd+jPx6wuxD/rSw==
-    -----END CERTIFICATE-----
-    -----BEGIN CERTIFICATE-----
-    MIIDLzCCAhegAwIBAgIUIDADwsHIrQ8dfncpechBdIUCQdIwDQYJKoZIhvcNAQEL
-    BQAwFDESMBAGA1UEAxMJdW5raW4ubmV0MB4XDTI0MDQyNzExMjcwMloXDTM0MDQy
-    NTExMjczMlowFDESMBAGA1UEAxMJdW5raW4ubmV0MIIBIjANBgkqhkiG9w0BAQEF
-    AAOCAQ8AMIIBCgKCAQEA3ENPv7R7gCUJAg8Q4hB2LEZSdvbK155YbcrguLDDnu6m
-    2fkJn8jYMMW3Z6/+Y04ouGwi6sKup8ggTb217sY+dC4IUZjotDPAhruxfXVQAh0v
-    Yr3RYoxVDrm4nRSFLo1RA4Qt+1KK299mHGQf9iAiwbsFp5mDrJT9uz15FE2uWmbK
-    8/onMyJC4fnkMihVN6NIgTtjpHYNm5aAJwxoWldTopgF0ucb7X3XVPNbKAmd3Avd
-    lsOo6m751zSZ0HvJOxgRSy7lvPzMuUfCQsOcmI4O4+Z2FL4Y7p+T9DvWkciC7L3i
-    tBiK30fPfGKNpWaof1ONCcPQNjMwWcEFXqSiWUOXkwIDAQABo3kwdzAOBgNVHQ8B
-    Af8EBAMCAQYwDwYDVR0TAQH/BAUwAwEB/zAdBgNVHQ4EFgQUGpy/pj6F8e3gSOAp
-    r+6hAYQdOScwHwYDVR0jBBgwFoAUGpy/pj6F8e3gSOApr+6hAYQdOScwFAYDVR0R
-    BA0wC4IJdW5raW4ubmV0MA0GCSqGSIb3DQEBCwUAA4IBAQA5xocILzuvD+R2Iub1
-    UnTdcVpgNcxJmESz0eX4UrkcBmddtuFINXvDTv5//XTFs78LsVVSf00xZ+2C62Xe
-    xRdCdluHN8VDCAKulP4XJY1BiZ7im0v+iMgPDKhq4OXb86WFYI/8J6uRm7oIAwj1
-    zhhKxMimkzli+yHB8ipL15W7l68CMUgmOjFA+EG6sbfadFpQTX/h6TVj3FQPkU/p
-    UJEm2XjlGNAKGJrNRU47PM4vRDv5Joyowp9zv/pHFXvUJladaJupMKRJQVWQz1US
-    EXE67rawG79s3vm8dDolnbli/IhPHtjDRIprxAwrMs5tt9cY0xsRkFBZVcAOjrpb
-    4gqd
-    -----END CERTIFICATE-----

clusters/au-syd1/bootstrap/kustomization.yaml

@@ -3,21 +3,11 @@ apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
 
 resources:
-  - https://artifactapi.k8s.syd1.au.unkin.net/api/v1/remote/github_user/argoproj/argo-cd/refs/tags/v3.3.2/manifests/ha/install.yaml
+  - https://raw.githubusercontent.com/argoproj/argo-cd/refs/tags/v3.3.2/manifests/ha/install.yaml
-  - https://artifactapi.k8s.syd1.au.unkin.net/api/v1/remote/github/kubernetes-sigs/gateway-api/releases/download/v1.5.1/standard-install.yaml
   - au-syd1-apps.yaml
-  - argocd-self-app.yaml
 
 patches:
   - path: argocd-cm-patch.yaml
     target:
       kind: ConfigMap
       name: argocd-cm
-  - path: argocd-tls-certs-patch.yaml
-    target:
-      kind: ConfigMap
-      name: argocd-tls-certs-cm
-  - path: argocd-repo-server-vault-ca-patch.yaml
-    target:
-      kind: Deployment
-      name: argocd-repo-server