From ced33ad02f69f9db392926170c1ebc3d0680164c Mon Sep 17 00:00:00 2001
From: Ben Vincent <ben@unkin.net>
Date: Sun, 26 Jul 2026 23:09:00 +1000
Subject: [PATCH] yum: source AlmaLinux RPM repos from artifactapi, drop legacy
 unkin repo

AlmaLinux hosts still pulled in-house RPMs from the legacy unkin repo on
Gitea (git.query.consul). Point them at the artifactapi local rpm repos
instead, adding both the distribution-agnostic and per-EL-major variants of
rpm-internal and rpm-vendor so hosts get everything published for their
release. The unkinben personal repo is left untouched because the jellyfin
media role still enables it and its content is not on artifactapi yet.

- retarget rpm-vendor to the distribution-agnostic local/rpm-vendor repo
- add rpm-internal-release/rpm-vendor-release, resolved from the host's
  os.release.major (el8 hosts -> -el8, el9 -> -el9, etc.)
- remove the legacy unkin yumrepo definition

Claude-Session: https://claude.ai/code/session_015ur3i7D2azsMAWTSVABApv
---
 hieradata/os/AlmaLinux/all_releases.yaml | 29 +++++++++++++++++-------
 1 file changed, 21 insertions(+), 8 deletions(-)

diff --git a/hieradata/os/AlmaLinux/all_releases.yaml b/hieradata/os/AlmaLinux/all_releases.yaml
index 2bf464e..9b68e1b 100644
--- a/hieradata/os/AlmaLinux/all_releases.yaml
+++ b/hieradata/os/AlmaLinux/all_releases.yaml
@@ -70,6 +70,11 @@ profiles::yum::global::repos:
     baseurl: https://artifactapi.k8s.syd1.au.unkin.net/api/v1/remote/epel/%{facts.os.release.major}/Everything/%{facts.os.architecture}
     gpgkey: https://artifactapi.k8s.syd1.au.unkin.net/api/v1/remote/epel/RPM-GPG-KEY-EPEL-%{facts.os.release.major}
     mirrorlist: absent
+  # unkinben is a personal RPM repo still hosted on Gitea (git.query.consul).
+  # It is NOT part of the artifactapi migration (its packages are not mirrored
+  # into rpm-internal/rpm-vendor) and the jellyfin media role still enables it,
+  # so it is retained here unchanged. Migrate/remove separately once its content
+  # is available from artifactapi.
   unkinben:
     name: unkinben
     descr: unkinben repository
@@ -89,6 +94,22 @@ profiles::yum::global::repos:
     name: rpm-vendor
     descr: rpm-vendor repository
     target: /etc/yum.repos.d/rpm-vendor.repo
+    baseurl: https://artifactapi.k8s.syd1.au.unkin.net/api/v1/local/rpm-vendor/
+    gpgcheck: false
+    mirrorlist: absent
+  # Per-release variants, resolved from the host's EL major version so el8
+  # hosts pull rpm-internal-el8/rpm-vendor-el8, el9 hosts el9, etc.
+  rpm-internal-release:
+    name: rpm-internal-el%{facts.os.release.major}
+    descr: rpm-internal-el%{facts.os.release.major} repository
+    target: /etc/yum.repos.d/rpm-internal-release.repo
+    baseurl: https://artifactapi.k8s.syd1.au.unkin.net/api/v1/local/rpm-internal-el%{facts.os.release.major}/
+    gpgcheck: false
+    mirrorlist: absent
+  rpm-vendor-release:
+    name: rpm-vendor-el%{facts.os.release.major}
+    descr: rpm-vendor-el%{facts.os.release.major} repository
+    target: /etc/yum.repos.d/rpm-vendor-release.repo
     baseurl: https://artifactapi.k8s.syd1.au.unkin.net/api/v1/local/rpm-vendor-el%{facts.os.release.major}/
     gpgcheck: false
     mirrorlist: absent
@@ -274,11 +295,3 @@ profiles::yum::global::repos:
     gpgkey: https://artifactapi.k8s.syd1.au.unkin.net/api/v1/remote/rpmfusion-nonfree/el/RPM-GPG-KEY-rpmfusion-nonfree-el-%{facts.os.release.major}
     gpgcheck: 1
     mirrorlist: absent
-  unkin:
-    name: unkin
-    descr: unkin repository
-    target: /etc/yum.repos.d/unkin.repo
-    baseurl: https://git.query.consul/api/packages/unkin/rpm/almalinux/el%{facts.os.release.major}
-    gpgkey: https://git.query.consul/api/packages/unkin/rpm/repository.key
-    gpgcheck: false
-    mirrorlist: absent