feat: add local RPM repository with on-demand repodata

Upload RPMs to local repos. Metadata is parsed async after upload
using cavaliergopher/rpm and stored in rpm_metadata table. Repodata
(repomd.xml, primary.xml.gz, filelists.xml.gz, other.xml.gz) is
generated on-demand from the DB — nothing stored in S3.

- RPM provider implements LocalUploader (validates .rpm extension,
  stores under Packages/)
- RPM provider implements PostUploadHook (async goroutine parses RPM
  headers, extracts name/version/arch/deps/etc into rpm_metadata)
- RPM provider implements LocalIndexer (serves repodata/* paths by
  querying rpm_metadata and generating XML on the fly)
- New provider interfaces: PostUploadHook, BlobReader, MetadataStore,
  RPMMetadataReader
- New rpm_metadata table with JSONB columns for requires/provides/
  files/changelogs

Tested e2e: upload cowsay RPM → repodata generated → dnf install
from local repo

.pre-commit-config.yaml

@@ -1,24 +0,0 @@
-repos:
-  - repo: https://github.com/pre-commit/pre-commit-hooks
-    rev: v5.0.0
-    hooks:
-      - id: trailing-whitespace
-      - id: end-of-file-fixer
-      - id: check-yaml
-      - id: check-added-large-files
-      - id: check-merge-conflict
-
-  - repo: https://github.com/dnephin/pre-commit-golang
-    rev: v0.5.1
-    hooks:
-      - id: go-fmt
-      - id: go-mod-tidy
-
-  - repo: local
-    hooks:
-      - id: go-vet
-        name: go vet
-        entry: go vet ./...
-        language: system
-        types: [go]
-        pass_filenames: false

.woodpecker/docker.yaml

@@ -22,8 +22,6 @@ steps:
       repo: git.unkin.net/unkin/artifactapi-ui
       dockerfile: ui/Dockerfile.ui
       context: ui
-      build_args:
-        BASE_PATH: /ui
       username: droneci
       password:
         from_secret: DRONECI_PASSWORD

.woodpecker/pre-commit.yaml

@@ -3,15 +3,7 @@ when:
 
 steps:
   - name: pre-commit
-    image: git.unkin.net/unkin/almalinux9-gobuilder:20260606
+    image: golang:1.25
     commands:
-      - uvx pre-commit run --all-files
-    backend_options:
-      kubernetes:
-        resources:
-          requests:
-            memory: 512Mi
-            cpu: 1
-          limits:
-            memory: 2Gi
-            cpu: 2
+      - test -z "$(gofmt -l .)"
+      - go vet ./...

internal/api/v1/proxy.go

@@ -37,20 +37,6 @@ func (h *ProxyHandler) Routes() chi.Router {
 	return r
 }
 
-func (h *ProxyHandler) DockerV2Routes() chi.Router {
-	r := chi.NewRouter()
-	r.Get("/", h.handleDockerPing)
-	r.Head("/", h.handleDockerPing)
-	r.Get("/{remoteName}/*", h.handleProxy)
-	r.Head("/{remoteName}/*", h.handleProxy)
-	return r
-}
-
-func (h *ProxyHandler) handleDockerPing(w http.ResponseWriter, r *http.Request) {
-	w.Header().Set("Docker-Distribution-Api-Version", "registry/2.0")
-	w.WriteHeader(http.StatusOK)
-}
-
 func (h *ProxyHandler) handleProxy(w http.ResponseWriter, r *http.Request) {
 	remoteName := chi.URLParam(r, "remoteName")
 	path := chi.URLParam(r, "*")

internal/proxy/engine.go

@@ -4,12 +4,10 @@ import (
 	"context"
 	"crypto/sha256"
 	"encoding/hex"
-	"encoding/json"
 	"fmt"
 	"io"
 	"log/slog"
 	"net/http"
-	"strings"
 	"time"
 
 	"git.unkin.net/unkin/artifactapi/internal/cache"
@@ -149,21 +147,6 @@ func (e *Engine) fetchFromUpstream(ctx context.Context, remote models.Remote, pa
 		return nil, &UpstreamError{Err: err}
 	}
 
-	if resp.StatusCode == http.StatusUnauthorized {
-		resp.Body.Close()
-		token, err := fetchBearerToken(ctx, resp.Header.Get("Www-Authenticate"), remote)
-		if err == nil && token != "" {
-			req2, _ := http.NewRequestWithContext(ctx, http.MethodGet, url, nil)
-			req2.Header.Set("Authorization", "Bearer "+token)
-			resp, err = http.DefaultClient.Do(req2)
-			if err != nil {
-				return nil, &UpstreamError{Err: err}
-			}
-		} else {
-			return nil, &ProxyError{Status: http.StatusUnauthorized, Message: "upstream returned 401"}
-		}
-	}
-
 	if resp.StatusCode != http.StatusOK {
 		resp.Body.Close()
 		return nil, &ProxyError{Status: resp.StatusCode, Message: fmt.Sprintf("upstream returned %d", resp.StatusCode)}
@@ -336,71 +319,6 @@ func (r readerAt) ReadAt(p []byte, off int64) (n int, err error) {
 	return
 }
 
-func fetchBearerToken(ctx context.Context, wwwAuth string, remote models.Remote) (string, error) {
-	if !strings.HasPrefix(wwwAuth, "Bearer ") {
-		return "", fmt.Errorf("not a Bearer challenge")
-	}
-
-	params := map[string]string{}
-	for _, part := range strings.Split(wwwAuth[7:], ",") {
-		part = strings.TrimSpace(part)
-		eq := strings.Index(part, "=")
-		if eq < 0 {
-			continue
-		}
-		key := part[:eq]
-		val := strings.Trim(part[eq+1:], `"`)
-		params[key] = val
-	}
-
-	realm := params["realm"]
-	if realm == "" {
-		return "", fmt.Errorf("no realm in Bearer challenge")
-	}
-
-	tokenURL := realm
-	sep := "?"
-	if s, ok := params["service"]; ok {
-		tokenURL += sep + "service=" + s
-		sep = "&"
-	}
-	if s, ok := params["scope"]; ok {
-		tokenURL += sep + "scope=" + s
-	}
-
-	req, err := http.NewRequestWithContext(ctx, http.MethodGet, tokenURL, nil)
-	if err != nil {
-		return "", err
-	}
-
-	if remote.Username != "" && remote.Password != "" {
-		req.SetBasicAuth(remote.Username, remote.Password)
-	}
-
-	resp, err := http.DefaultClient.Do(req)
-	if err != nil {
-		return "", err
-	}
-	defer resp.Body.Close()
-
-	if resp.StatusCode != http.StatusOK {
-		return "", fmt.Errorf("token endpoint returned %d", resp.StatusCode)
-	}
-
-	var tokenResp struct {
-		Token       string `json:"token"`
-		AccessToken string `json:"access_token"`
-	}
-	if err := json.NewDecoder(resp.Body).Decode(&tokenResp); err != nil {
-		return "", err
-	}
-
-	if tokenResp.Token != "" {
-		return tokenResp.Token, nil
-	}
-	return tokenResp.AccessToken, nil
-}
-
 type ProxyError struct {
 	Status  int
 	Message string

internal/server/server.go

@@ -96,7 +96,6 @@ func (s *Server) routes() chi.Router {
 
 	proxyHandler := v1.NewProxyHandler(s.engine, s.virtEngine, s.db, s.store, s.localHandler)
 	r.Mount("/api/v1", proxyHandler.Routes())
-	r.Mount("/v2", proxyHandler.DockerV2Routes())
 
 	remotesHandler := v2.NewRemotesHandler(s.db)
 	virtualsHandler := v2.NewVirtualsHandler(s.db)

internal/virtual/engine.go

@@ -79,7 +79,7 @@ func (e *Engine) fetchMemberIndexes(ctx context.Context, virt models.Virtual, pa
 					results[idx] = result{err: fmt.Errorf("local index %q: %w", name, err)}
 					return
 				}
-				results[idx] = result{index: MemberIndex{RemoteName: name, RepoType: remote.RepoType, BaseURL: remote.BaseURL, Body: body}}
+				results[idx] = result{index: MemberIndex{RemoteName: name, RepoType: remote.RepoType, Body: body}}
 				return
 			}
 
@@ -102,7 +102,7 @@ func (e *Engine) fetchMemberIndexes(ctx context.Context, virt models.Virtual, pa
 				return
 			}
 
-			results[idx] = result{index: MemberIndex{RemoteName: name, RepoType: remote.RepoType, BaseURL: remote.BaseURL, Body: body}}
+			results[idx] = result{index: MemberIndex{RemoteName: name, RepoType: remote.RepoType, Body: body}}
 		}(i, memberName)
 	}
 

internal/virtual/helm_merger.go

@@ -54,26 +54,15 @@ func (m *HelmMerger) MergeIndexes(members []MemberIndex, proxyBaseURL string) ([
 				seen[chart][ver.Version] = true
 
 				if proxyBaseURL != "" {
-					routePrefix := "remote"
-					if member.RepoType == "local" {
-						routePrefix = "local"
-					}
-					baseHost := extractHost(member.BaseURL)
-
 					for i, u := range ver.URLs {
 						if strings.HasPrefix(u, "http://") || strings.HasPrefix(u, "https://") {
-							if baseHost != "" && extractHost(u) != baseHost {
-								continue
-							}
-							ver.URLs[i] = fmt.Sprintf("%s/api/v1/%s/%s/%s",
+							ver.URLs[i] = fmt.Sprintf("%s/api/v1/remote/%s/%s",
 								strings.TrimRight(proxyBaseURL, "/"),
-								routePrefix,
 								member.RemoteName,
 								extractPath(u))
 						} else {
-							ver.URLs[i] = fmt.Sprintf("%s/api/v1/%s/%s/%s",
+							ver.URLs[i] = fmt.Sprintf("%s/api/v1/remote/%s/%s",
 								strings.TrimRight(proxyBaseURL, "/"),
-								routePrefix,
 								member.RemoteName,
 								u)
 						}
@@ -89,19 +78,6 @@ func (m *HelmMerger) MergeIndexes(members []MemberIndex, proxyBaseURL string) ([
 	return yaml.Marshal(merged)
 }
 
-func extractHost(rawURL string) string {
-	idx := strings.Index(rawURL, "://")
-	if idx == -1 {
-		return ""
-	}
-	rest := rawURL[idx+3:]
-	slashIdx := strings.Index(rest, "/")
-	if slashIdx == -1 {
-		return rest
-	}
-	return rest[:slashIdx]
-}
-
 func extractPath(rawURL string) string {
 	idx := strings.Index(rawURL, "://")
 	if idx == -1 {

internal/virtual/merger.go

@@ -9,7 +9,6 @@ import (
 type MemberIndex struct {
 	RemoteName string
 	RepoType   models.RepoType
-	BaseURL    string
 	Body       []byte
 }
 

ui/Dockerfile.ui

@@ -6,20 +6,13 @@ COPY package.json package-lock.json* ./
 RUN npm ci
 
 COPY . .
-
-ARG BASE_PATH=/
-ENV BASE_PATH=${BASE_PATH}
 RUN npm run build
 
 FROM nginx:alpine
 
-ARG BASE_PATH=/
-
 COPY --from=builder /app/dist /usr/share/nginx/html
 COPY nginx.conf /etc/nginx/conf.d/default.conf
 
-RUN sed -i "s|\${BASE_PATH}|${BASE_PATH}|g" /etc/nginx/conf.d/default.conf
-
 EXPOSE 80
 
 CMD ["nginx", "-g", "daemon off;"]

ui/nginx.conf

@@ -5,7 +5,33 @@ server {
     root /usr/share/nginx/html;
     index index.html;
 
-    location ${BASE_PATH} {
+    location /api/ {
+        proxy_pass http://artifactapi:8000;
+        proxy_set_header Host $host;
+        proxy_set_header X-Real-IP $remote_addr;
+        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+        proxy_set_header X-Forwarded-Proto $scheme;
+        proxy_buffering off;
+    }
+
+    location /v2/ {
+        proxy_pass http://artifactapi:8000;
+        proxy_set_header Host $host;
+        proxy_set_header X-Real-IP $remote_addr;
+        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+        proxy_set_header X-Forwarded-Proto $scheme;
+        proxy_buffering off;
+    }
+
+    location /health {
+        proxy_pass http://artifactapi:8000;
+    }
+
+    location /metrics {
+        proxy_pass http://artifactapi:8000;
+    }
+
+    location / {
         try_files $uri $uri/ /index.html;
     }
 }

ui/src/App.tsx

@@ -2,8 +2,6 @@ import { Routes, Route, NavLink } from 'react-router-dom';
 import { Dashboard } from './pages/Dashboard';
 import { Remotes } from './pages/Remotes';
 import { RemoteDetail } from './pages/RemoteDetail';
-import { Locals } from './pages/Locals';
-import { LocalDetail } from './pages/LocalDetail';
 import { Virtuals } from './pages/Virtuals';
 import { Objects } from './pages/Objects';
 import { Probe } from './pages/Probe';
@@ -20,7 +18,6 @@ export function App() {
         <div className="sidebar-nav">
           <NavLink to="/" end>Dashboard</NavLink>
           <NavLink to="/remotes">Remotes</NavLink>
-          <NavLink to="/locals">Locals</NavLink>
           <NavLink to="/virtuals">Virtuals</NavLink>
           <NavLink to="/probe">Test Remote</NavLink>
         </div>
@@ -34,9 +31,6 @@ export function App() {
           <Route path="/remotes" element={<Remotes />} />
           <Route path="/remotes/:name" element={<RemoteDetail />} />
           <Route path="/remotes/:name/objects" element={<Objects />} />
-          <Route path="/locals" element={<Locals />} />
-          <Route path="/locals/:name" element={<LocalDetail />} />
-          <Route path="/locals/:name/objects" element={<Objects />} />
           <Route path="/virtuals" element={<Virtuals />} />
           <Route path="/probe" element={<Probe />} />
         </Routes>

ui/src/main.tsx

@@ -4,13 +4,9 @@ import { BrowserRouter } from 'react-router-dom';
 import { App } from './App';
 import './index.css';
 
-declare const __BASE_PATH__: string;
-
-const basename = __BASE_PATH__.replace(/\/+$/, '') || '/';
-
 createRoot(document.getElementById('root')!).render(
   <StrictMode>
-    <BrowserRouter basename={basename}>
+    <BrowserRouter>
       <App />
     </BrowserRouter>
   </StrictMode>,

ui/src/pages/LocalDetail.tsx

@@ -1,46 +0,0 @@
-import { useEffect, useState } from 'react';
-import { useParams, Link } from 'react-router-dom';
-import { api } from '../api/client';
-import type { Remote } from '../api/types';
-import { Badge } from '../components/Badge';
-import './RemoteDetail.css';
-
-export function LocalDetail() {
-  const { name } = useParams<{ name: string }>();
-  const [remote, setRemote] = useState<Remote | null>(null);
-  const [error, setError] = useState<string | null>(null);
-
-  useEffect(() => {
-    if (!name) return;
-    api.getRemote(name)
-      .then(setRemote)
-      .catch(e => setError(e.message));
-  }, [name]);
-
-  if (error) return <div className="error-banner">{error}</div>;
-  if (!remote) return <div className="loading">Loading...</div>;
-
-  return (
-    <div>
-      <div className="detail-header">
-        <Link to="/locals" className="back-link">&larr; Locals</Link>
-        <h1 className="page-title">{remote.name}</h1>
-        <div className="detail-badges">
-          <Badge variant="blue">{remote.package_type}</Badge>
-          <Badge variant="default">local</Badge>
-          {remote.managed_by && <Badge variant="green">managed by {remote.managed_by}</Badge>}
-        </div>
-      </div>
-
-      {remote.description && (
-        <p className="detail-description">{remote.description}</p>
-      )}
-
-      <div className="detail-actions">
-        <Link to={`/locals/${remote.name}/objects`} className="btn btn-primary">
-          Browse Files
-        </Link>
-      </div>
-    </div>
-  );
-}

ui/src/pages/Locals.tsx

@@ -1,93 +0,0 @@
-import { useEffect, useState } from 'react';
-import { useNavigate } from 'react-router-dom';
-import { api } from '../api/client';
-import type { Remote } from '../api/types';
-import { Badge } from '../components/Badge';
-import { DataTable } from '../components/DataTable';
-import './Remotes.css';
-
-const typeColors: Record<string, 'blue' | 'green' | 'yellow' | 'red' | 'default'> = {
-  docker: 'blue',
-  helm: 'green',
-  rpm: 'yellow',
-  pypi: 'blue',
-  npm: 'red',
-  generic: 'default',
-  alpine: 'green',
-  puppet: 'yellow',
-  terraform: 'blue',
-  goproxy: 'green',
-};
-
-export function Locals() {
-  const navigate = useNavigate();
-  const [remotes, setRemotes] = useState<Remote[]>([]);
-  const [filter, setFilter] = useState('');
-  const [loading, setLoading] = useState(true);
-
-  useEffect(() => {
-    api.listRemotes()
-      .then(r => setRemotes((r || []).filter(x => x.repo_type === 'local')))
-      .finally(() => setLoading(false));
-  }, []);
-
-  const filtered = remotes.filter(r => {
-    if (filter && !r.name.toLowerCase().includes(filter.toLowerCase())) return false;
-    return true;
-  });
-
-  return (
-    <div>
-      <h1 className="page-title">Local Repositories</h1>
-
-      <div className="remotes-toolbar">
-        <input
-          className="search-input"
-          placeholder="Filter by name..."
-          value={filter}
-          onChange={e => setFilter(e.target.value)}
-        />
-        <span className="result-count">{filtered.length} locals</span>
-      </div>
-
-      {loading ? (
-        <div className="loading">Loading...</div>
-      ) : (
-        <DataTable
-          columns={[
-            {
-              key: 'name',
-              header: 'Name',
-              render: (r: Remote) => <span className="mono">{r.name}</span>,
-            },
-            {
-              key: 'type',
-              header: 'Type',
-              render: (r: Remote) => (
-                <Badge variant={typeColors[r.package_type] || 'default'}>
-                  {r.package_type}
-                </Badge>
-              ),
-              width: '110px',
-            },
-            {
-              key: 'description',
-              header: 'Description',
-              render: (r: Remote) => r.description || <span className="text-muted">—</span>,
-            },
-            {
-              key: 'managed',
-              header: 'Managed',
-              render: (r: Remote) =>
-                r.managed_by ? <Badge variant="blue">{r.managed_by}</Badge> : <span className="text-muted">—</span>,
-              width: '100px',
-            },
-          ]}
-          data={filtered}
-          emptyMessage="No local repositories configured"
-          onRowClick={(r) => navigate(`/locals/${r.name}`)}
-        />
-      )}
-    </div>
-  );
-}

ui/src/pages/Objects.tsx

@@ -1,5 +1,5 @@
 import { useEffect, useState, useCallback, useMemo } from 'react';
-import { useParams, useLocation, Link } from 'react-router-dom';
+import { useParams, Link } from 'react-router-dom';
 import { api } from '../api/client';
 import type { Artifact } from '../api/types';
 import { formatBytes, timeAgo, truncateHash } from '../components/format';
@@ -171,9 +171,6 @@ function TreeRow({ node, depth, expanded, onToggle, onEvict }: TreeRowProps) {
 
 export function Objects() {
   const { name } = useParams<{ name: string }>();
-  const location = useLocation();
-  const isLocal = location.pathname.startsWith('/locals/');
-  const backLink = isLocal ? `/locals/${name}` : `/remotes/${name}`;
   const [artifacts, setArtifacts] = useState<Artifact[]>([]);
   const [loading, setLoading] = useState(true);
   const [filter, setFilter] = useState('');
@@ -236,7 +233,7 @@ export function Objects() {
   return (
     <div>
       <div className="detail-header">
-        <Link to={backLink} className="back-link">&larr; {name}</Link>
+        <Link to={`/remotes/${name}`} className="back-link">&larr; {name}</Link>
         <h1 className="page-title">Cached Objects</h1>
       </div>
 

ui/src/pages/Remotes.tsx

@@ -32,10 +32,9 @@ export function Remotes() {
       .finally(() => setLoading(false));
   }, []);
 
-  const remoteOnly = remotes.filter(r => r.repo_type !== 'local');
-  const types = [...new Set(remoteOnly.map(r => r.package_type))].sort();
+  const types = [...new Set(remotes.map(r => r.package_type))].sort();
 
-  const filtered = remoteOnly.filter(r => {
+  const filtered = remotes.filter(r => {
     if (typeFilter && r.package_type !== typeFilter) return false;
     if (filter && !r.name.toLowerCase().includes(filter.toLowerCase())) return false;
     return true;

ui/src/pages/Virtuals.tsx

@@ -1,38 +1,21 @@
 import { useEffect, useState } from 'react';
-import { Link } from 'react-router-dom';
 import { api } from '../api/client';
-import type { Remote, Virtual } from '../api/types';
+import type { Virtual } from '../api/types';
 import { Badge } from '../components/Badge';
 import { DataTable } from '../components/DataTable';
 import './Virtuals.css';
 
 export function Virtuals() {
   const [virtuals, setVirtuals] = useState<Virtual[]>([]);
-  const [remoteMap, setRemoteMap] = useState<Record<string, Remote>>({});
   const [loading, setLoading] = useState(true);
   const [expanded, setExpanded] = useState<string | null>(null);
 
   useEffect(() => {
-    Promise.all([api.listVirtuals(), api.listRemotes()])
-      .then(([v, r]) => {
-        setVirtuals(v || []);
-        const map: Record<string, Remote> = {};
-        for (const remote of r || []) {
-          map[remote.name] = remote;
-        }
-        setRemoteMap(map);
-      })
+    api.listVirtuals()
+      .then(v => setVirtuals(v || []))
       .finally(() => setLoading(false));
   }, []);
 
-  function memberLink(name: string) {
-    const remote = remoteMap[name];
-    if (remote?.repo_type === 'local') {
-      return `/locals/${name}`;
-    }
-    return `/remotes/${name}`;
-  }
-
   return (
     <div>
       <h1 className="page-title">Virtual Repositories</h1>
@@ -57,7 +40,7 @@ export function Virtuals() {
               key: 'members',
               header: 'Members',
               render: (v: Virtual) => (
-                <span className="member-count">{v.members?.length || 0} repos</span>
+                <span className="member-count">{v.members?.length || 0} remotes</span>
               ),
               width: '110px',
             },
@@ -86,17 +69,12 @@ export function Virtuals() {
           <ul className="member-list">
             {virtuals
               .find(v => v.name === expanded)
-              ?.members?.map((m, i) => {
-                const remote = remoteMap[m];
-                const typeLabel = remote?.repo_type === 'local' ? 'local' : 'remote';
-                return (
-                  <li key={m}>
-                    <span className="member-priority">{i + 1}</span>
-                    <Link to={memberLink(m)} className="mono">{m}</Link>
-                    <Badge variant={typeLabel === 'local' ? 'yellow' : 'default'}>{typeLabel}</Badge>
-                  </li>
-                );
-              })}
+              ?.members?.map((m, i) => (
+                <li key={m}>
+                  <span className="member-priority">{i + 1}</span>
+                  <a href={`/remotes/${m}`} className="mono">{m}</a>
+                </li>
+              ))}
           </ul>
         </div>
       )}

ui/vite.config.ts

@@ -1,10 +1,7 @@
 import { defineConfig } from 'vite'
 import react from '@vitejs/plugin-react'
 
-const basePath = process.env.BASE_PATH || '/'
-
 export default defineConfig({
-  base: basePath,
   plugins: [react()],
   server: {
     proxy: {
@@ -14,7 +11,4 @@ export default defineConfig({
       '/metrics': 'http://localhost:8000',
     },
   },
-  define: {
-    '__BASE_PATH__': JSON.stringify(basePath),
-  },
 })