unkin-agent
f0ee593164
Local repo writes (file uploads/deletes, object evictions, native publishes, docker push) are open to anyone who can reach the service; only remote/virtual config is token-gated. - add `ARTIFACTAPI_AUTH_UPLOADS` (default false) gating every local write path behind the OIDC verifier - accept the token as Bearer, Token, Basic password (any user) or bare header value on every gated path, including remote/virtual config writes - serve a `/v2/token` Bearer challenge flow so `docker login` with the token enables push; missing, expired or invalid credentials get an anonymous token so pulls stay open - document minting a Vault identity token and passing it per client Reviewed-on: #169 Co-authored-by: unkin-agent <unkin-agent@unkin.net> Co-committed-by: unkin-agent <unkin-agent@unkin.net>
1.2 KiB
Local ansible repository
A local ansible repo is a Galaxy v3 server: ansible-galaxy collection publish
and ansible-galaxy collection install work against /api/v1/local/<repo>.
publish needs an API key; any value works unless uploads are gated.
ansible-galaxy collection build
ansible-galaxy collection publish unkin-hello-1.0.0.tar.gz \
--server https://artifactapi.example.com/api/v1/local/<repo>/ --api-key unused
ansible-galaxy collection install unkin.hello \
--server https://artifactapi.example.com/api/v1/local/<repo>/
Publishing reads collection_info from the tarball's MANIFEST.json and
finishes the import synchronously, so the import task is already completed.
Uploads over 256 MiB, tarballs with members or symlinks escaping the collection root, or
with an invalid name, version or dependency map are rejected with 400.
The repo serves api/v3/collections/<ns>/<name>/, the paginated
versions/ list (limit up to 100, offset), versions/<version>/ with
download_url, artifact.sha256 and metadata.dependencies, and
artifacts/<ns>-<name>-<version>.tar.gz.
Versions are immutable: publishing an existing namespace.name:version is
rejected with 409.