ci: use container-rpmbuilder image

kubecolor is pinned at 0.6.0 (upstream is 0.8.0) and only builds for el8/el9, so Fedora hosts have no package.

- bump kubecolor el8/el9 builds to 0.8.0
- add fedora 42/43/44 builds, mirroring kubectl-view-secret

Reviewed-on: #184
Co-authored-by: unkin-agent <unkin-agent@unkin.net>
Co-committed-by: unkin-agent <unkin-agent@unkin.net>

.pre-commit-config.yaml

@@ -31,6 +31,24 @@ repos:
             "-s",
           ]
 
+  - repo: local
+    hooks:
+      - id: pytest
+        name: Run unit tests
+        entry: make test
+        language: system
+        types: [python]
+        pass_filenames: false
+
+  - repo: https://github.com/python-jsonschema/check-jsonschema
+    rev: 0.37.2
+    hooks:
+      - id: check-jsonschema
+        name: Validate RPM package metadata
+        files: ^rpms/[^/]+/metadata\.yaml$
+        args: [--schemafile, schema/metadata.json]
+        language_version: python3.11
+
   - repo: https://github.com/astral-sh/ruff-pre-commit
     rev: v0.14.7
     hooks:

.woodpecker/build-almalinux8.yaml

@@ -3,16 +3,22 @@ when:
 
 steps:
   - name: build rpms
-    image: git.unkin.net/unkin/almalinux9-rpmbuilder:latest
+    image: artifactapi.k8s.syd1.au.unkin.net/docker-internal/rpmbuilder:0.1.0-alma9
     commands:
       - mkdir -p /woodpecker/rpms
       - ln -s /woodpecker/rpms /workspace
-      - dnf install buildah -y
       - ./tools/build build-all --distro almalinux/el8 --buildah
     privileged: true
     backend_options:
       kubernetes:
         serviceAccountName: default
+        resources:
+          requests:
+            memory: 512Mi
+            cpu: 2
+          limits:
+            memory: 2Gi
+            cpu: 2
 
   - name: show rpms
     image: git.unkin.net/unkin/almalinux8-base:latest

.woodpecker/build-almalinux9.yaml

@@ -3,16 +3,22 @@ when:
 
 steps:
   - name: build rpms
-    image: git.unkin.net/unkin/almalinux9-rpmbuilder:latest
+    image: artifactapi.k8s.syd1.au.unkin.net/docker-internal/rpmbuilder:0.1.0-alma9
     commands:
       - mkdir -p /woodpecker/rpms
       - ln -s /woodpecker/rpms /workspace
-      - dnf install buildah -y
       - ./tools/build build-all --distro almalinux/el9 --buildah
     privileged: true
     backend_options:
       kubernetes:
         serviceAccountName: default
+        resources:
+          requests:
+            memory: 512Mi
+            cpu: 2
+          limits:
+            memory: 2Gi
+            cpu: 2
 
   - name: show rpms
     image: git.unkin.net/unkin/almalinux9-base:latest

.woodpecker/build-fedora42.yaml

@@ -0,0 +1,26 @@
+when:
+  - event: pull_request
+
+steps:
+  - name: build rpms
+    image: artifactapi.k8s.syd1.au.unkin.net/docker-internal/rpmbuilder:0.1.0-alma9
+    commands:
+      - mkdir -p /woodpecker/rpms
+      - ln -s /woodpecker/rpms /workspace
+      - ./tools/build build-all --distro fedora/42 --buildah
+    privileged: true
+    backend_options:
+      kubernetes:
+        serviceAccountName: default
+        resources:
+          requests:
+            memory: 512Mi
+            cpu: 2
+          limits:
+            memory: 2Gi
+            cpu: 2
+
+  - name: show rpms
+    image: git.unkin.net/unkin/fedora42-base:latest
+    commands:
+      - find /woodpecker/src/git.unkin.net/unkin/rpmbuilder/ -type f -name "*.rpm"

.woodpecker/build-fedora43.yaml

@@ -0,0 +1,26 @@
+when:
+  - event: pull_request
+
+steps:
+  - name: build rpms
+    image: artifactapi.k8s.syd1.au.unkin.net/docker-internal/rpmbuilder:0.1.0-alma9
+    commands:
+      - mkdir -p /woodpecker/rpms
+      - ln -s /woodpecker/rpms /workspace
+      - ./tools/build build-all --distro fedora/43 --buildah
+    privileged: true
+    backend_options:
+      kubernetes:
+        serviceAccountName: default
+        resources:
+          requests:
+            memory: 512Mi
+            cpu: 2
+          limits:
+            memory: 2Gi
+            cpu: 2
+
+  - name: show rpms
+    image: git.unkin.net/unkin/fedora43-base:latest
+    commands:
+      - find /woodpecker/src/git.unkin.net/unkin/rpmbuilder/ -type f -name "*.rpm"

.woodpecker/build-fedora44.yaml

@@ -0,0 +1,26 @@
+when:
+  - event: pull_request
+
+steps:
+  - name: build rpms
+    image: artifactapi.k8s.syd1.au.unkin.net/docker-internal/rpmbuilder:0.1.0-alma9
+    commands:
+      - mkdir -p /woodpecker/rpms
+      - ln -s /woodpecker/rpms /workspace
+      - ./tools/build build-all --distro fedora/44 --buildah
+    privileged: true
+    backend_options:
+      kubernetes:
+        serviceAccountName: default
+        resources:
+          requests:
+            memory: 512Mi
+            cpu: 2
+          limits:
+            memory: 2Gi
+            cpu: 2
+
+  - name: show rpms
+    image: git.unkin.net/unkin/fedora44-base:latest
+    commands:
+      - find /woodpecker/src/git.unkin.net/unkin/rpmbuilder/ -type f -name "*.rpm"

.woodpecker/deploy-almalinux8.yaml

@@ -4,16 +4,22 @@ when:
 
 steps:
   - name: build-rpms
-    image: git.unkin.net/unkin/almalinux9-rpmbuilder:latest
+    image: artifactapi.k8s.syd1.au.unkin.net/docker-internal/rpmbuilder:0.1.0-alma9
     commands:
       - mkdir -p /woodpecker/rpms
       - ln -s /woodpecker/rpms /workspace
-      - dnf install buildah -y
       - ./tools/build build-all --distro almalinux/el8 --buildah
     privileged: true
     backend_options:
       kubernetes:
         serviceAccountName: default
+        resources:
+          requests:
+            memory: 512Mi
+            cpu: 2
+          limits:
+            memory: 2Gi
+            cpu: 2
 
   - name: show-rpms
     image: git.unkin.net/unkin/almalinux9-base:latest
@@ -22,16 +28,29 @@ steps:
     depends_on: [build-rpms]
 
   - name: deploy-rpms
-    image: git.unkin.net/unkin/almalinux9-rpmbuilder:latest
+    image: artifactapi.k8s.syd1.au.unkin.net/docker-internal/rpmbuilder:0.1.0-alma9
     commands:
       - |
+        HOST="https://artifactapi.k8s.syd1.au.unkin.net"
+        REPO="rpm-vendor-el8"
         for rpm in $(find /woodpecker/src/git.unkin.net/unkin/rpmbuilder/ -type f -name "*.rpm"); do
-          curl --user droneci:$${DRONECI_PASSWORD} --upload-file $rpm https://git.unkin.net/api/packages/unkin/rpm/almalinux/el8/upload
+          FILE=$$(basename "$$rpm")
+          # artifactapi has no HEAD route (405); probe the served Packages path.
+          code=$$(curl -s -o /dev/null -w '%{http_code}' "$$HOST/api/v2/remotes/$$REPO/files/Packages/$$FILE" || true)
+          if [ "$$code" = "200" ]; then
+            echo "$$FILE already exists in $$REPO; skipping"
+            continue
+          fi
+          curl -f -X PUT "$$HOST/api/v2/remotes/$$REPO/files/$$FILE" -H "Content-Type: application/x-rpm" --data-binary @"$$rpm"
         done
-    environment:
-      DRONECI_PASSWORD:
-        from_secret: DRONECI_PASSWORD
     backend_options:
       kubernetes:
         serviceAccountName: default
+        resources:
+          requests:
+            memory: 128Mi
+            cpu: 100m
+          limits:
+            memory: 512Mi
+            cpu: 500m
     depends_on: [build-rpms, show-rpms]

.woodpecker/deploy-almalinux9.yaml

@@ -4,16 +4,22 @@ when:
 
 steps:
   - name: build-rpms
-    image: git.unkin.net/unkin/almalinux9-rpmbuilder:latest
+    image: artifactapi.k8s.syd1.au.unkin.net/docker-internal/rpmbuilder:0.1.0-alma9
     commands:
       - mkdir -p /woodpecker/rpms
       - ln -s /woodpecker/rpms /workspace
-      - dnf install buildah -y
       - ./tools/build build-all --distro almalinux/el9 --buildah
     privileged: true
     backend_options:
       kubernetes:
         serviceAccountName: default
+        resources:
+          requests:
+            memory: 512Mi
+            cpu: 2
+          limits:
+            memory: 2Gi
+            cpu: 2
 
   - name: show-rpms
     image: git.unkin.net/unkin/almalinux9-base:latest
@@ -22,16 +28,29 @@ steps:
     depends_on: [build-rpms]
 
   - name: deploy-rpms
-    image: git.unkin.net/unkin/almalinux9-rpmbuilder:latest
+    image: artifactapi.k8s.syd1.au.unkin.net/docker-internal/rpmbuilder:0.1.0-alma9
     commands:
       - |
+        HOST="https://artifactapi.k8s.syd1.au.unkin.net"
+        REPO="rpm-vendor-el9"
         for rpm in $(find /woodpecker/src/git.unkin.net/unkin/rpmbuilder/ -type f -name "*.rpm"); do
-          curl --user droneci:$${DRONECI_PASSWORD} --upload-file $rpm https://git.unkin.net/api/packages/unkin/rpm/almalinux/el9/upload
+          FILE=$$(basename "$$rpm")
+          # artifactapi has no HEAD route (405); probe the served Packages path.
+          code=$$(curl -s -o /dev/null -w '%{http_code}' "$$HOST/api/v2/remotes/$$REPO/files/Packages/$$FILE" || true)
+          if [ "$$code" = "200" ]; then
+            echo "$$FILE already exists in $$REPO; skipping"
+            continue
+          fi
+          curl -f -X PUT "$$HOST/api/v2/remotes/$$REPO/files/$$FILE" -H "Content-Type: application/x-rpm" --data-binary @"$$rpm"
         done
-    environment:
-      DRONECI_PASSWORD:
-        from_secret: DRONECI_PASSWORD
     backend_options:
       kubernetes:
         serviceAccountName: default
+        resources:
+          requests:
+            memory: 128Mi
+            cpu: 100m
+          limits:
+            memory: 512Mi
+            cpu: 500m
     depends_on: [build-rpms, show-rpms]

.woodpecker/deploy-fedora42.yaml

@@ -0,0 +1,56 @@
+when:
+  - event: push
+    branch: master
+
+steps:
+  - name: build-rpms
+    image: artifactapi.k8s.syd1.au.unkin.net/docker-internal/rpmbuilder:0.1.0-alma9
+    commands:
+      - mkdir -p /woodpecker/rpms
+      - ln -s /woodpecker/rpms /workspace
+      - ./tools/build build-all --distro fedora/42 --buildah
+    privileged: true
+    backend_options:
+      kubernetes:
+        serviceAccountName: default
+        resources:
+          requests:
+            memory: 512Mi
+            cpu: 2
+          limits:
+            memory: 2Gi
+            cpu: 2
+
+  - name: show-rpms
+    image: artifactapi.k8s.syd1.au.unkin.net/docker-internal/rpmbuilder:0.1.0-fedora42
+    commands:
+      - find /woodpecker/src/git.unkin.net/unkin/rpmbuilder/ -type f -name "*.rpm"
+    depends_on: [build-rpms]
+
+  - name: deploy-rpms
+    image: artifactapi.k8s.syd1.au.unkin.net/docker-internal/rpmbuilder:0.1.0-fedora42
+    commands:
+      - |
+        HOST="https://artifactapi.k8s.syd1.au.unkin.net"
+        REPO="rpm-vendor-f42"
+        for rpm in $(find /woodpecker/src/git.unkin.net/unkin/rpmbuilder/ -type f -name "*.rpm"); do
+          FILE=$$(basename "$$rpm")
+          # artifactapi has no HEAD route (405); probe the served Packages path.
+          code=$$(curl -s -o /dev/null -w '%{http_code}' "$$HOST/api/v2/remotes/$$REPO/files/Packages/$$FILE" || true)
+          if [ "$$code" = "200" ]; then
+            echo "$$FILE already exists in $$REPO; skipping"
+            continue
+          fi
+          curl -f -X PUT "$$HOST/api/v2/remotes/$$REPO/files/$$FILE" -H "Content-Type: application/x-rpm" --data-binary @"$$rpm"
+        done
+    backend_options:
+      kubernetes:
+        serviceAccountName: default
+        resources:
+          requests:
+            memory: 128Mi
+            cpu: 100m
+          limits:
+            memory: 512Mi
+            cpu: 500m
+    depends_on: [build-rpms, show-rpms]

.woodpecker/deploy-fedora43.yaml

@@ -0,0 +1,56 @@
+when:
+  - event: push
+    branch: master
+
+steps:
+  - name: build-rpms
+    image: artifactapi.k8s.syd1.au.unkin.net/docker-internal/rpmbuilder:0.1.0-alma9
+    commands:
+      - mkdir -p /woodpecker/rpms
+      - ln -s /woodpecker/rpms /workspace
+      - ./tools/build build-all --distro fedora/43 --buildah
+    privileged: true
+    backend_options:
+      kubernetes:
+        serviceAccountName: default
+        resources:
+          requests:
+            memory: 512Mi
+            cpu: 2
+          limits:
+            memory: 2Gi
+            cpu: 2
+
+  - name: show-rpms
+    image: artifactapi.k8s.syd1.au.unkin.net/docker-internal/rpmbuilder:0.1.0-fedora43
+    commands:
+      - find /woodpecker/src/git.unkin.net/unkin/rpmbuilder/ -type f -name "*.rpm"
+    depends_on: [build-rpms]
+
+  - name: deploy-rpms
+    image: artifactapi.k8s.syd1.au.unkin.net/docker-internal/rpmbuilder:0.1.0-fedora43
+    commands:
+      - |
+        HOST="https://artifactapi.k8s.syd1.au.unkin.net"
+        REPO="rpm-vendor-f43"
+        for rpm in $(find /woodpecker/src/git.unkin.net/unkin/rpmbuilder/ -type f -name "*.rpm"); do
+          FILE=$$(basename "$$rpm")
+          # artifactapi has no HEAD route (405); probe the served Packages path.
+          code=$$(curl -s -o /dev/null -w '%{http_code}' "$$HOST/api/v2/remotes/$$REPO/files/Packages/$$FILE" || true)
+          if [ "$$code" = "200" ]; then
+            echo "$$FILE already exists in $$REPO; skipping"
+            continue
+          fi
+          curl -f -X PUT "$$HOST/api/v2/remotes/$$REPO/files/$$FILE" -H "Content-Type: application/x-rpm" --data-binary @"$$rpm"
+        done
+    backend_options:
+      kubernetes:
+        serviceAccountName: default
+        resources:
+          requests:
+            memory: 128Mi
+            cpu: 100m
+          limits:
+            memory: 512Mi
+            cpu: 500m
+    depends_on: [build-rpms, show-rpms]

.woodpecker/deploy-fedora44.yaml

@@ -0,0 +1,56 @@
+when:
+  - event: push
+    branch: master
+
+steps:
+  - name: build-rpms
+    image: artifactapi.k8s.syd1.au.unkin.net/docker-internal/rpmbuilder:0.1.0-alma9
+    commands:
+      - mkdir -p /woodpecker/rpms
+      - ln -s /woodpecker/rpms /workspace
+      - ./tools/build build-all --distro fedora/44 --buildah
+    privileged: true
+    backend_options:
+      kubernetes:
+        serviceAccountName: default
+        resources:
+          requests:
+            memory: 512Mi
+            cpu: 2
+          limits:
+            memory: 2Gi
+            cpu: 2
+
+  - name: show-rpms
+    image: artifactapi.k8s.syd1.au.unkin.net/docker-internal/rpmbuilder:0.1.0-fedora44
+    commands:
+      - find /woodpecker/src/git.unkin.net/unkin/rpmbuilder/ -type f -name "*.rpm"
+    depends_on: [build-rpms]
+
+  - name: deploy-rpms
+    image: artifactapi.k8s.syd1.au.unkin.net/docker-internal/rpmbuilder:0.1.0-fedora44
+    commands:
+      - |
+        HOST="https://artifactapi.k8s.syd1.au.unkin.net"
+        REPO="rpm-vendor-f44"
+        for rpm in $(find /woodpecker/src/git.unkin.net/unkin/rpmbuilder/ -type f -name "*.rpm"); do
+          FILE=$$(basename "$$rpm")
+          # artifactapi has no HEAD route (405); probe the served Packages path.
+          code=$$(curl -s -o /dev/null -w '%{http_code}' "$$HOST/api/v2/remotes/$$REPO/files/Packages/$$FILE" || true)
+          if [ "$$code" = "200" ]; then
+            echo "$$FILE already exists in $$REPO; skipping"
+            continue
+          fi
+          curl -f -X PUT "$$HOST/api/v2/remotes/$$REPO/files/$$FILE" -H "Content-Type: application/x-rpm" --data-binary @"$$rpm"
+        done
+    backend_options:
+      kubernetes:
+        serviceAccountName: default
+        resources:
+          requests:
+            memory: 128Mi
+            cpu: 100m
+          limits:
+            memory: 512Mi
+            cpu: 500m
+    depends_on: [build-rpms, show-rpms]

Dockerfile

@@ -1,4 +1,4 @@
-ARG BASE_IMAGE=git.unkin.net/unkin/almalinux9-rpmbuilder:latest
+ARG BASE_IMAGE=artifactapi.k8s.syd1.au.unkin.net/docker-internal/rpmbuilder:0.1.0-alma9
 FROM ${BASE_IMAGE}
 
 # Create output directory for RPMs

Makefile

@@ -11,7 +11,7 @@ DISTRO ?= almalinux/el9
 PACKAGES := $(shell find $(ROOT_DIR)/rpms -mindepth 1 -maxdepth 1 -type d -exec test -f {}/metadata.yaml \; -print | xargs -n1 basename | sort)
 
 # Default target to build all packages
-.PHONY: all list build clean
+.PHONY: all list build clean test
 all: build-all
 
 # List all available packages
@@ -47,6 +47,10 @@ dry-run:
 	@echo "Dry run - showing what would be built for distro $(DISTRO):"
 	$(BUILD_TOOL) build-all --distro $(DISTRO) --dry-run
 
+# Run unit tests
+test:
+	@uv run --group dev pytest tests/ -q; rc=$$?; [ $$rc -eq 5 ] && exit 0 || exit $$rc
+
 # Clean target
 clean:
 	@echo "Cleaning build artifacts..."

pyproject.toml

@@ -0,0 +1,16 @@
+[project]
+name = "rpmbuilder"
+version = "0.1.0"
+requires-python = ">=3.11"
+
+[dependency-groups]
+dev = [
+    "pytest>=8",
+    "jsonschema>=4",
+    "pyyaml>=6",
+    # tools/build's own script dependencies, so tests can import it
+    "typer",
+    "requests",
+    "hvac",
+    "cerberus",
+]

rpms/act_runner/metadata.yaml

@@ -1,18 +1,20 @@
----
-arch: amd64
-builds:
-  - image: git.unkin.net/unkin/almalinux8-rpmbuilder:latest
-    release: '1'
-    repository: [almalinux/el8]
-    version: 0.2.12
-  - image: git.unkin.net/unkin/almalinux9-rpmbuilder:latest
-    release: '1'
-    repository: [almalinux/el9]
-    version: 0.2.12
-description: A runner for Gitea based on act.
+name: act_runner
 github: unknown/act_runner
+description: A runner for Gitea based on act.
+arch: amd64
+platform: linux
+maintainer: Gitea
 homepage: https://gitea.com/gitea/act_runner
 license: MIT
-maintainer: Gitea
-name: act_runner
-platform: linux
+dist_tag: true
+builds:
+- image: git.unkin.net/unkin/almalinux8-rpmbuilder:latest
+  release: '1'
+  repository:
+  - almalinux/el8
+  version: 0.2.12
+- image: artifactapi.k8s.syd1.au.unkin.net/docker-internal/rpmbuilder:0.1.0-alma9
+  release: '1'
+  repository:
+  - almalinux/el9
+  version: 0.2.12

rpms/argocd/metadata.yaml

@@ -0,0 +1,24 @@
+name: argocd
+github: argoproj/argo-cd
+github_release_pattern: ^v3\.5\.
+description: Declarative GitOps continuous delivery for Kubernetes - command line
+  client.
+arch: amd64
+platform: linux
+maintainer: Argo Project
+homepage: https://github.com/argoproj/argo-cd
+license: Apache-2.0
+dist_tag: true
+builds:
+- repository:
+  - almalinux/el9
+  image: artifactapi.k8s.syd1.au.unkin.net/docker-internal/rpmbuilder:0.1.0-alma9
+  release: 1
+  version: 3.5.3
+- repository:
+  - fedora/42
+  - fedora/43
+  - fedora/44
+  image: artifactapi.k8s.syd1.au.unkin.net/docker-internal/rpmbuilder:0.1.0-alma9
+  release: 1
+  version: 3.5.3

rpms/argocd/resources/build.sh

@@ -0,0 +1,22 @@
+#!/usr/bin/bash
+
+set -e
+
+BASE_URL="https://artifactapi.k8s.syd1.au.unkin.net/api/v1/remote/github/argoproj/argo-cd/releases/download/v${PACKAGE_VERSION}"
+
+wget -O /app/argocd "${BASE_URL}/argocd-linux-amd64"
+wget -O /app/cli_checksums.txt "${BASE_URL}/cli_checksums.txt"
+
+# Upstream lists the asset name; check it against the local filename.
+cd /app
+grep ' argocd-linux-amd64$' cli_checksums.txt | sed 's/argocd-linux-amd64$/argocd/' | sha256sum --check --strict -
+chmod +x /app/argocd
+
+mkdir -p /app/completions
+/app/argocd completion bash > /app/completions/argocd
+/app/argocd completion zsh > /app/completions/_argocd
+/app/argocd completion fish > /app/completions/argocd.fish
+
+envsubst < /app/resources/nfpm.yaml > /app/nfpm.yaml
+
+nfpm pkg --config /app/nfpm.yaml --target /app/dist --packager rpm

rpms/argocd/resources/nfpm.yaml

@@ -0,0 +1,48 @@
+# nfpm.yaml
+
+name: ${PACKAGE_NAME}
+version: ${PACKAGE_VERSION}
+release: ${PACKAGE_RELEASE}
+arch: ${PACKAGE_ARCH}
+platform: ${PACKAGE_PLATFORM}
+section: default
+priority: extra
+description: "${PACKAGE_DESCRIPTION}"
+
+maintainer: ${PACKAGE_MAINTAINER}
+homepage: ${PACKAGE_HOMEPAGE}
+license: ${PACKAGE_LICENSE}
+
+disable_globbing: false
+
+replaces:
+  - argocd
+
+provides:
+  - argocd
+
+contents:
+  - src: /app/argocd
+    dst: /usr/bin/argocd
+    file_info:
+      mode: 0755
+      owner: root
+      group: root
+  - src: /app/completions/argocd
+    dst: /usr/share/bash-completion/completions/argocd
+    file_info:
+      mode: 0644
+      owner: root
+      group: root
+  - src: /app/completions/_argocd
+    dst: /usr/share/zsh/site-functions/_argocd
+    file_info:
+      mode: 0644
+      owner: root
+      group: root
+  - src: /app/completions/argocd.fish
+    dst: /usr/share/fish/vendor_completions.d/argocd.fish
+    file_info:
+      mode: 0644
+      owner: root
+      group: root

rpms/bind_exporter/metadata.yaml

@@ -1,18 +1,20 @@
----
-arch: amd64
-builds:
-  - image: git.unkin.net/unkin/almalinux8-rpmbuilder:latest
-    release: '1'
-    repository: [almalinux/el8]
-    version: 0.8.0
-  - image: git.unkin.net/unkin/almalinux9-rpmbuilder:latest
-    release: '1'
-    repository: [almalinux/el9]
-    version: 0.8.0
-description: Prometheus exporter for BIND
+name: bind_exporter
 github: prometheus-community/bind_exporter
+description: Prometheus exporter for BIND
+arch: amd64
+platform: linux
+maintainer: Prometheus
 homepage: https://github.com/prometheus-community/bind_exporter
 license: Apache-2.0 license
-maintainer: Prometheus
-name: bind_exporter
-platform: linux
+dist_tag: true
+builds:
+- image: git.unkin.net/unkin/almalinux8-rpmbuilder:latest
+  release: '1'
+  repository:
+  - almalinux/el8
+  version: 0.8.0
+- image: artifactapi.k8s.syd1.au.unkin.net/docker-internal/rpmbuilder:0.1.0-alma9
+  release: '1'
+  repository:
+  - almalinux/el9
+  version: 0.8.0

rpms/boilerplate/metadata.yaml

@@ -7,6 +7,7 @@ platform: linux
 maintainer: Gruntwork
 homepage: https://github.com/gruntwork-io/boilerplate
 license: MIT
+dist_tag: true
 builds:
 - repository:
   - almalinux/el8
@@ -15,6 +16,6 @@ builds:
   version: 0.15.0
 - repository:
   - almalinux/el9
-  image: git.unkin.net/unkin/almalinux9-rpmbuilder:latest
+  image: artifactapi.k8s.syd1.au.unkin.net/docker-internal/rpmbuilder:0.1.0-alma9
   release: 1
   version: 0.15.0

rpms/claude-code/metadata.yaml

@@ -1,19 +1,19 @@
+name: claude-code
+description: Claude Code - Anthropic's agentic AI coding tool
 arch: amd64
+platform: linux
+maintainer: Anthropic
+homepage: https://claude.ai/code
+license: Proprietary
+dist_tag: true
 builds:
 - image: git.unkin.net/unkin/almalinux8-rpmbuilder:latest
   release: 1
   repository:
   - almalinux/el8
-  version: 2.1.126
-- image: git.unkin.net/unkin/almalinux9-rpmbuilder:latest
+  version: 2.1.156
+- image: artifactapi.k8s.syd1.au.unkin.net/docker-internal/rpmbuilder:0.1.0-alma9
   release: 1
   repository:
   - almalinux/el9
-  version: 2.1.126
-claude_ai: true
-description: Claude Code - Anthropic's agentic AI coding tool
-homepage: https://claude.ai/code
-license: Proprietary
-maintainer: Anthropic
-name: claude-code
-platform: linux
+  version: 2.1.156

rpms/cmctl/metadata.yaml

@@ -0,0 +1,22 @@
+name: cmctl
+github: cert-manager/cmctl
+description: Command line tool to manage and configure cert-manager resources.
+arch: amd64
+platform: linux
+maintainer: The cert-manager Authors
+homepage: https://github.com/cert-manager/cmctl
+license: Apache-2.0
+dist_tag: true
+builds:
+- repository:
+  - almalinux/el9
+  image: artifactapi.k8s.syd1.au.unkin.net/docker-internal/rpmbuilder:0.1.0-alma9
+  release: 1
+  version: 2.6.1
+- repository:
+  - fedora/42
+  - fedora/43
+  - fedora/44
+  image: artifactapi.k8s.syd1.au.unkin.net/docker-internal/rpmbuilder:0.1.0-alma9
+  release: 1
+  version: 2.6.1

rpms/cmctl/resources/build.sh

@@ -0,0 +1,22 @@
+#!/usr/bin/bash
+
+set -e
+
+BASE_URL="https://artifactapi.k8s.syd1.au.unkin.net/api/v1/remote/github/cert-manager/cmctl/releases/download/v${PACKAGE_VERSION}"
+
+wget -O /app/cmctl "${BASE_URL}/cmctl_linux_amd64"
+wget -O /app/checksums.txt "${BASE_URL}/checksums.txt"
+
+# Upstream lists the asset name; check it against the local filename.
+cd /app
+grep ' cmctl_linux_amd64$' checksums.txt | sed 's/cmctl_linux_amd64$/cmctl/' | sha256sum --check --strict -
+chmod +x /app/cmctl
+
+mkdir -p /app/completions
+/app/cmctl completion bash > /app/completions/cmctl
+/app/cmctl completion zsh > /app/completions/_cmctl
+/app/cmctl completion fish > /app/completions/cmctl.fish
+
+envsubst < /app/resources/nfpm.yaml > /app/nfpm.yaml
+
+nfpm pkg --config /app/nfpm.yaml --target /app/dist --packager rpm

rpms/cmctl/resources/kubectl_complete-cert_manager

@@ -0,0 +1,2 @@
+#!/usr/bin/env sh
+exec kubectl cert-manager __complete "$@"

rpms/cmctl/resources/nfpm.yaml

@@ -0,0 +1,57 @@
+# nfpm.yaml
+
+name: ${PACKAGE_NAME}
+version: ${PACKAGE_VERSION}
+release: ${PACKAGE_RELEASE}
+arch: ${PACKAGE_ARCH}
+platform: ${PACKAGE_PLATFORM}
+section: default
+priority: extra
+description: "${PACKAGE_DESCRIPTION}"
+
+maintainer: ${PACKAGE_MAINTAINER}
+homepage: ${PACKAGE_HOMEPAGE}
+license: ${PACKAGE_LICENSE}
+
+disable_globbing: false
+
+replaces:
+  - cmctl
+
+provides:
+  - cmctl
+
+contents:
+  - src: /app/cmctl
+    dst: /usr/bin/cmctl
+    file_info:
+      mode: 0755
+      owner: root
+      group: root
+  - src: cmctl
+    dst: /usr/bin/kubectl-cert_manager
+    type: symlink
+  - src: /app/resources/kubectl_complete-cert_manager
+    dst: /usr/bin/kubectl_complete-cert_manager
+    file_info:
+      mode: 0755
+      owner: root
+      group: root
+  - src: /app/completions/cmctl
+    dst: /usr/share/bash-completion/completions/cmctl
+    file_info:
+      mode: 0644
+      owner: root
+      group: root
+  - src: /app/completions/_cmctl
+    dst: /usr/share/zsh/site-functions/_cmctl
+    file_info:
+      mode: 0644
+      owner: root
+      group: root
+  - src: /app/completions/cmctl.fish
+    dst: /usr/share/fish/vendor_completions.d/cmctl.fish
+    file_info:
+      mode: 0644
+      owner: root
+      group: root

rpms/cni-plugins/metadata.yaml

@@ -7,14 +7,15 @@ platform: linux
 maintainer: ContainerNetworking
 homepage: https://github.com/containernetworking/plugins
 license: Apache-2.0
+dist_tag: true
 builds:
 - repository:
   - almalinux/el8
   image: git.unkin.net/unkin/almalinux8-rpmbuilder:latest
   release: 1
-  version: 1.9.0
+  version: 1.9.1
 - repository:
   - almalinux/el9
-  image: git.unkin.net/unkin/almalinux9-rpmbuilder:latest
+  image: artifactapi.k8s.syd1.au.unkin.net/docker-internal/rpmbuilder:0.1.0-alma9
   release: 1
-  version: 1.9.0
+  version: 1.9.1

rpms/code-server/metadata.yaml

@@ -1,4 +1,3 @@
----
 name: code-server
 github: coder/code-server
 description: VS Code in the browser.
@@ -7,6 +6,7 @@ platform: linux
 maintainer: Coder
 homepage: https://github.com/coder/code-server
 license: MIT
+dist_tag: true
 builds:
 - repository:
   - almalinux/el8
@@ -15,6 +15,6 @@ builds:
   version: 4.117.0
 - repository:
   - almalinux/el9
-  image: git.unkin.net/unkin/almalinux9-rpmbuilder:latest
+  image: artifactapi.k8s.syd1.au.unkin.net/docker-internal/rpmbuilder:0.1.0-alma9
   release: 1
   version: 4.117.0

rpms/consul-cni/metadata.yaml

@@ -1,18 +1,21 @@
----
-arch: amd64
-builds:
-  - image: git.unkin.net/unkin/almalinux8-rpmbuilder:latest
-    release: '1'
-    repository: [almalinux/el8]
-    version: 1.7.1
-  - image: git.unkin.net/unkin/almalinux9-rpmbuilder:latest
-    release: '1'
-    repository: [almalinux/el9]
-    version: 1.7.1
-description: Plugin for Consul on Kubernetes to allow configuring traffic redirection rules without escalated container privileges.
+name: consul-cni
 github: unknown/consul-cni
+description: Plugin for Consul on Kubernetes to allow configuring traffic redirection
+  rules without escalated container privileges.
+arch: amd64
+platform: linux
+maintainer: Hashicorp
 homepage: https://hashicorp.com
 license: Mozilla Public License, version 2.0
-maintainer: Hashicorp
-name: consul-cni
-platform: linux
+dist_tag: true
+builds:
+- image: git.unkin.net/unkin/almalinux8-rpmbuilder:latest
+  release: '1'
+  repository:
+  - almalinux/el8
+  version: 1.7.1
+- image: artifactapi.k8s.syd1.au.unkin.net/docker-internal/rpmbuilder:0.1.0-alma9
+  release: '1'
+  repository:
+  - almalinux/el9
+  version: 1.7.1

rpms/consul/metadata.yaml

@@ -7,6 +7,7 @@ platform: linux
 maintainer: HashiCorp
 homepage: https://github.com/hashicorp/consul
 license: BUSL-1.1
+dist_tag: true
 builds:
 - repository:
   - almalinux/el8
@@ -15,6 +16,13 @@ builds:
   version: 1.22.7
 - repository:
   - almalinux/el9
-  image: git.unkin.net/unkin/almalinux9-rpmbuilder:latest
+  image: artifactapi.k8s.syd1.au.unkin.net/docker-internal/rpmbuilder:0.1.0-alma9
+  release: 1
+  version: 1.22.7
+- repository:
+  - fedora/42
+  - fedora/43
+  - fedora/44
+  image: artifactapi.k8s.syd1.au.unkin.net/docker-internal/rpmbuilder:0.1.0-alma9
   release: 1
   version: 1.22.7

rpms/etcd/metadata.yaml

@@ -7,14 +7,15 @@ platform: linux
 maintainer: https://etcd.io/
 homepage: https://etcd.io/
 license: Apache-2.0
+dist_tag: true
 builds:
 - repository:
   - almalinux/el8
   image: git.unkin.net/unkin/almalinux8-rpmbuilder:latest
   release: 1
-  version: 3.6.7
+  version: 3.6.10
 - repository:
   - almalinux/el9
-  image: git.unkin.net/unkin/almalinux9-rpmbuilder:latest
+  image: artifactapi.k8s.syd1.au.unkin.net/docker-internal/rpmbuilder:0.1.0-alma9
   release: 1
-  version: 3.6.7
+  version: 3.6.10

rpms/exportarr/metadata.yaml

@@ -7,6 +7,7 @@ platform: linux
 maintainer: onedr0p
 homepage: https://github.com/onedr0p/exportarr
 license: MIT license
+dist_tag: true
 builds:
 - repository:
   - almalinux/el8
@@ -15,6 +16,6 @@ builds:
   version: 2.3.0
 - repository:
   - almalinux/el9
-  image: git.unkin.net/unkin/almalinux9-rpmbuilder:latest
+  image: artifactapi.k8s.syd1.au.unkin.net/docker-internal/rpmbuilder:0.1.0-alma9
   release: 1
   version: 2.3.0

rpms/frr_exporter/metadata.yaml

@@ -6,6 +6,7 @@ platform: linux
 maintainer: Prometheus
 homepage: https://github.com/tynany/frr_exporter
 license: MIT
+dist_tag: true
 builds:
 - repository:
   - almalinux/el8
@@ -14,6 +15,6 @@ builds:
   version: 1.11.0
 - repository:
   - almalinux/el9
-  image: git.unkin.net/unkin/almalinux9-rpmbuilder:latest
+  image: artifactapi.k8s.syd1.au.unkin.net/docker-internal/rpmbuilder:0.1.0-alma9
   release: 1
   version: 1.11.0

rpms/g10k/metadata.yaml

@@ -1,18 +1,20 @@
----
-arch: amd64
-builds:
-  - image: git.unkin.net/unkin/almalinux8-rpmbuilder:latest
-    release: '1'
-    repository: [almalinux/el8]
-    version: 0.9.10
-  - image: git.unkin.net/unkin/almalinux9-rpmbuilder:latest
-    release: '1'
-    repository: [almalinux/el9]
-    version: 0.9.10
-description: An r10k fork written in Go, designed to work somwhat similar like puppetlabs/r10k.
+name: g10k
 github: xorpaul/g10k
+description: An r10k fork written in Go, designed to work somwhat similar like puppetlabs/r10k.
+arch: amd64
+platform: linux
+maintainer: xorpaul
 homepage: https://github.com/xorpaul/g10k
 license: Apache2.0
-maintainer: xorpaul
-name: g10k
-platform: linux
+dist_tag: true
+builds:
+- image: git.unkin.net/unkin/almalinux8-rpmbuilder:latest
+  release: '1'
+  repository:
+  - almalinux/el8
+  version: 0.9.10
+- image: artifactapi.k8s.syd1.au.unkin.net/docker-internal/rpmbuilder:0.1.0-alma9
+  release: '1'
+  repository:
+  - almalinux/el9
+  version: 0.9.10

rpms/git-delta/metadata.yaml

@@ -1,4 +1,3 @@
----
 name: git-delta
 github: dandavison/delta
 description: A syntax-highlighting pager for git, diff, grep, and blame output.
@@ -7,6 +6,7 @@ platform: linux
 maintainer: dandavison
 homepage: https://github.com/dandavison/delta
 license: MIT
+dist_tag: true
 builds:
 - repository:
   - almalinux/el8
@@ -15,6 +15,6 @@ builds:
   version: 0.19.2
 - repository:
   - almalinux/el9
-  image: git.unkin.net/unkin/almalinux9-rpmbuilder:latest
+  image: artifactapi.k8s.syd1.au.unkin.net/docker-internal/rpmbuilder:0.1.0-alma9
   release: 1
   version: 0.19.2

rpms/go-cache-plugin/metadata.yaml

@@ -0,0 +1,22 @@
+name: go-cache-plugin
+github: tailscale/go-cache-plugin
+description: A GOCACHEPROG implementation that backs the Go build cache with S3.
+arch: amd64
+platform: linux
+maintainer: Tailscale
+homepage: https://github.com/tailscale/go-cache-plugin
+license: BSD-3-Clause
+dist_tag: true
+builds:
+- repository:
+  - almalinux/el9
+  image: artifactapi.k8s.syd1.au.unkin.net/docker-internal/rpmbuilder:0.1.0-alma9
+  release: 1
+  version: 2026.7.22
+- repository:
+  - fedora/42
+  - fedora/43
+  - fedora/44
+  image: artifactapi.k8s.syd1.au.unkin.net/docker-internal/rpmbuilder:0.1.0-alma9
+  release: 1
+  version: 2026.7.22

rpms/go-cache-plugin/resources/build.sh

@@ -0,0 +1,17 @@
+#!/usr/bin/bash
+set -e
+
+# Upstream publishes no tags or releases; PACKAGE_VERSION dates this commit.
+COMMIT=3031b5d01c50d2748a32c7c9386ea7049883f38e
+
+# go.mod requires go 1.26.1
+export GOTOOLCHAIN=go1.26.1
+
+# Compile the go-cache-plugin binary using Go
+GOBIN=/app go install github.com/tailscale/go-cache-plugin/cmd/go-cache-plugin@${COMMIT}
+
+# Process nfpm.yaml with envsubst
+envsubst < /app/resources/nfpm.yaml > /app/nfpm.yaml
+
+# Build the RPM
+nfpm pkg --config /app/nfpm.yaml --target /app/dist --packager rpm

rpms/go-cache-plugin/resources/nfpm.yaml

@@ -0,0 +1,31 @@
+# nfpm.yaml
+
+name: ${PACKAGE_NAME}
+version: ${PACKAGE_VERSION}
+release: ${PACKAGE_RELEASE}
+arch: ${PACKAGE_ARCH}
+platform: ${PACKAGE_PLATFORM}
+section: default
+priority: extra
+description: "${PACKAGE_DESCRIPTION}"
+
+maintainer: ${PACKAGE_MAINTAINER}
+homepage: ${PACKAGE_HOMEPAGE}
+license: ${PACKAGE_LICENSE}
+
+disable_globbing: false
+
+replaces:
+  - go-cache-plugin
+
+provides:
+  - go-cache-plugin
+
+# Files to include in the package
+contents:
+  - src: /app/go-cache-plugin
+    dst: /usr/bin/go-cache-plugin
+    file_info:
+      mode: 0755
+      owner: root
+      group: root

rpms/hadolint/metadata.yaml

@@ -1,12 +1,13 @@
----
 name: hadolint
 github: hadolint/hadolint
-description: A smarter Dockerfile linter that helps you build best practice Docker images.
+description: A smarter Dockerfile linter that helps you build best practice Docker
+  images.
 arch: amd64
 platform: linux
 maintainer: hadolint
 homepage: https://github.com/hadolint/hadolint
 license: GPL-3.0
+dist_tag: true
 builds:
 - repository:
   - almalinux/el8
@@ -15,6 +16,6 @@ builds:
   version: 2.14.0
 - repository:
   - almalinux/el9
-  image: git.unkin.net/unkin/almalinux9-rpmbuilder:latest
+  image: artifactapi.k8s.syd1.au.unkin.net/docker-internal/rpmbuilder:0.1.0-alma9
   release: 1
   version: 2.14.0

rpms/helm/metadata.yaml

@@ -6,6 +6,7 @@ platform: linux
 maintainer: Helm Contributors
 homepage: https://github.com/helm/helm
 license: Apache-2.0 license
+dist_tag: true
 builds:
 - repository:
   - almalinux/el8
@@ -14,6 +15,6 @@ builds:
   version: 4.1.4
 - repository:
   - almalinux/el9
-  image: git.unkin.net/unkin/almalinux9-rpmbuilder:latest
+  image: artifactapi.k8s.syd1.au.unkin.net/docker-internal/rpmbuilder:0.1.0-alma9
   release: 1
   version: 4.1.4

rpms/helmfile/metadata.yaml

@@ -8,6 +8,7 @@ platform: linux
 maintainer: Helmfile Contributors
 homepage: https://github.com/helmfile/helmfile
 license: MIT
+dist_tag: true
 builds:
 - repository:
   - almalinux/el8
@@ -16,6 +17,6 @@ builds:
   version: 1.4.4
 - repository:
   - almalinux/el9
-  image: git.unkin.net/unkin/almalinux9-rpmbuilder:latest
+  image: artifactapi.k8s.syd1.au.unkin.net/docker-internal/rpmbuilder:0.1.0-alma9
   release: 1
   version: 1.4.4

rpms/incus/metadata.yaml

@@ -6,9 +6,10 @@ platform: linux
 maintainer: unkin
 homepage: https://linuxcontainers.org/incus/
 license: Apache-2.0
+dist_tag: true
 builds:
 - repository:
   - almalinux/el9
-  image: git.unkin.net/unkin/almalinux9-rpmbuilder:latest
+  image: artifactapi.k8s.syd1.au.unkin.net/docker-internal/rpmbuilder:0.1.0-alma9
   release: 1
-  version: 6.20.0
+  version: 6.23.0

rpms/jellyfin-ffmpeg-bin/metadata.yaml

@@ -6,6 +6,7 @@ platform: linux
 maintainer: unkin
 homepage: https://github.com/jellyfin/jellyfin-ffmpeg
 license: GPL-3.0
+dist_tag: false
 builds:
 - repository:
   - almalinux/el8
@@ -14,6 +15,6 @@ builds:
   version: 7.1.3
 - repository:
   - almalinux/el9
-  image: git.unkin.net/unkin/almalinux9-rpmbuilder:latest
+  image: artifactapi.k8s.syd1.au.unkin.net/docker-internal/rpmbuilder:0.1.0-alma9
   release: 1.1
   version: 7.1.3

rpms/jellyfin-server/metadata.yaml

@@ -1,13 +0,0 @@
----
-builds:
-  - image: git.unkin.net/unkin/almalinux8-rpmbuilder:latest
-    release: '1'
-    repository: [almalinux/el8]
-    version: 10.10.7
-  - image: git.unkin.net/unkin/almalinux9-rpmbuilder:latest
-    release: '1'
-    repository: [almalinux/el9]
-    version: 10.10.7
-description: jellyfin-server package
-github: unknown/jellyfin-server
-name: jellyfin-server

rpms/jellyfin-server/resources/build.sh

@@ -1,21 +0,0 @@
-#!/usr/bin/bash
-
-# Setup rpmbuild directory structure
-mkdir -p /root/rpmbuild/{BUILD,RPMS,SOURCES,SPECS,SRPMS}
-
-# Install .NET SDK for building
-dnf install dotnet-sdk-8.0 -y
-
-# Download source files using spectool
-spectool -g -R /app/resources/jellyfin-server_${PACKAGE_VERSION}.spec
-
-# Copy additional files to SOURCES
-cp /app/resources/fix-envfile-path.patch /root/rpmbuild/SOURCES/fix-envfile-path.patch
-cp /app/resources/tmpfiles.conf /root/rpmbuild/SOURCES/tmpfiles.conf
-
-# Build the RPM
-rpmbuild -ba /app/resources/jellyfin-server_${PACKAGE_VERSION}.spec
-
-# Copy the built RPMs to output directory
-cp /root/rpmbuild/RPMS/x86_64/jellyfin-server-${PACKAGE_VERSION}-${PACKAGE_RELEASE}.x86_64.rpm /app/dist/
-cp /root/rpmbuild/SRPMS/jellyfin-server-${PACKAGE_VERSION}-${PACKAGE_RELEASE}.src.rpm /app/dist/

rpms/jellyfin-server/resources/fix-envfile-path.patch

@@ -1,11 +0,0 @@
---- a/debian/conf/jellyfin.service
-+++ b/debian/conf/jellyfin.service
-@@ -4,7 +4,7 @@ After = network-online.target
-
- [Service]
- Type = simple
--EnvironmentFile = /etc/default/jellyfin
-+EnvironmentFile = /etc/jellyfin/jellyfin.env
- User = jellyfin
- Group = jellyfin
- WorkingDirectory = /var/lib/jellyfin

rpms/jellyfin-server/resources/jellyfin-server_10.10.7.spec

@@ -1,127 +0,0 @@
-%global debug_package %{nil}
-
-%global jellyfin_version 10.10.7
-%global jellyfin_packaging_timestamp 202504051515
-%global jellyfin_packaging_version %{jellyfin_version}-%{jellyfin_packaging_timestamp}
-
-%global dotnet_runtime %( \
-    if [ "%{_arch}" = "x86_64" ]; then \
-        echo -n "linux-x64"; \
-    elif [ "%{_arch}" = "aarch64" ]; then \
-        echo -n "linux-arm64"; \
-    else \
-        echo "Unsupported architecture: %{_arch}"; \
-        exit 1; \
-    fi \
-)
-
-Name:           jellyfin-server
-Version:        %{jellyfin_version}
-Release:        1
-Summary:        The Free Software Media System - Server Backend & API
-
-
-License:        GPL-2.0-or-later
-URL:            https://github.com/jellyfin/jellyfin
-Source0:        https://github.com/jellyfin/jellyfin/archive/refs/tags/v%{version}.tar.gz
-Source1:        https://github.com/jellyfin/jellyfin-packaging/archive/refs/tags/v%{jellyfin_packaging_version}.tar.gz
-Source2:        tmpfiles.conf
-Patch0:         fix-envfile-path.patch
-
-
-ExclusiveArch: x86_64 aarch64
-
-
-BuildRequires: dotnet-sdk-8.0
-BuildRequires: git
-BuildRequires: systemd-rpm-macros
-
-
-Requires: aspnetcore-runtime-8.0
-Requires: bash
-Requires: fontconfig
-Requires: jellyfin-ffmpeg-bin
-Requires: sqlite
-
-
-Recommends: jellyfin-web
-Recommends: google-noto-fonts-common
-
-
-%description
-%{summary}.
-
-
-%prep
-tar --extract --file="%{SOURCE1}" --directory="%{_builddir}"
-pushd %{_builddir}/jellyfin-packaging-%{jellyfin_packaging_version}
-patch -p1 -i "%{PATCH0}"
-popd
-%setup -q -n jellyfin-%{version}
-
-
-%build
-DOTNET_CLI_TELEMETRY_OPTOUT=1 \
-DOTNET_SKIP_FIRST_TIME_EXPERIENCE=1 \
-DOTNET_NOLOGO=1 \
-dotnet \
-    publish \
-    Jellyfin.Server \
-    --configuration Release \
-    --output builddir \
-    --self-contained false \
-    --runtime %{dotnet_runtime} \
-    -p:DebugSymbols=false \
-    -p:DebugType=none
-
-
-%install
-install --directory "%{buildroot}%{_libdir}"
-cp --recursive builddir "%{buildroot}%{_libdir}/jellyfin"
-
-install --directory "%{buildroot}%{_bindir}"
-ln --symbolic --force "%{_libdir}/jellyfin/jellyfin" "%{buildroot}%{_bindir}/jellyfin"
-
-pushd %{_builddir}/jellyfin-packaging-%{jellyfin_packaging_version}/debian/conf
-install -D --mode=644 jellyfin.service "%{buildroot}%{_unitdir}/jellyfin.service"
-install -D --mode=640 jellyfin "%{buildroot}%{_sysconfdir}/jellyfin/jellyfin.env"
-popd
-
-install -D --mode=0644 "%{SOURCE2}" "%{buildroot}%{_tmpfilesdir}/jellyfin.conf"
-
-install --directory --mode=750 "%{buildroot}%{_localstatedir}/cache/jellyfin"
-install --directory --mode=750 "%{buildroot}%{_sharedstatedir}/jellyfin"
-find %{buildroot}
-
-
-%files
-%license LICENSE
-%{_bindir}/jellyfin
-%{_libdir}/jellyfin
-%{_tmpfilesdir}/jellyfin.conf
-%{_unitdir}/jellyfin.service
-%defattr(640,jellyfin,jellyfin,750)
-%dir %{_localstatedir}/cache/jellyfin
-%dir %{_sharedstatedir}/jellyfin
-%dir %{_sysconfdir}/jellyfin
-%config(noreplace) %{_sysconfdir}/jellyfin/jellyfin.env
-
-
-%pre
-getent group jellyfin > /dev/null || groupadd --system jellyfin
-getent passwd jellyfin > /dev/null || \
-  useradd --system --home-dir "%{_sharedstatedir}/jellyfin" --gid jellyfin \
-  -s /sbin/nologin -c "jellyfin daemon" jellyfin
-exit 0
-
-
-%post
-%systemd_post jellyfin.service
-
-
-%preun
-%systemd_preun jellyfin.service
-
-
-%postun
-%systemd_postun jellyfin.service

rpms/jellyfin-server/resources/tmpfiles.conf

@@ -1 +0,0 @@
-d /var/log/jellyfin 0750 jellyfin jellyfin

rpms/jellyfin-web/metadata.yaml

@@ -1,13 +0,0 @@
----
-builds:
-  - image: git.unkin.net/unkin/almalinux8-rpmbuilder:latest
-    release: '1'
-    repository: [almalinux/el8]
-    version: 10.10.7
-  - image: git.unkin.net/unkin/almalinux9-rpmbuilder:latest
-    release: '1'
-    repository: [almalinux/el9]
-    version: 10.10.7
-description: jellyfin-web package
-github: unknown/jellyfin-web
-name: jellyfin-web

rpms/jellyfin-web/resources/build.sh

@@ -1,18 +0,0 @@
-#!/usr/bin/bash
-
-# Setup rpmbuild directory structure
-mkdir -p /root/rpmbuild/{BUILD,RPMS,SOURCES,SPECS,SRPMS}
-
-# Install Node.js for building
-dnf module enable nodejs:20 -y
-dnf install nodejs npm -y
-
-# Download source files using spectool
-spectool -g -R /app/resources/jellyfin-web_${PACKAGE_VERSION}.spec
-
-# Build the RPM
-rpmbuild -ba /app/resources/jellyfin-web_${PACKAGE_VERSION}.spec
-
-# Copy the built RPMs to output directory
-cp /root/rpmbuild/RPMS/noarch/jellyfin-web-${PACKAGE_VERSION}-${PACKAGE_RELEASE}.noarch.rpm /app/dist/
-cp /root/rpmbuild/SRPMS/jellyfin-web-${PACKAGE_VERSION}-${PACKAGE_RELEASE}.src.rpm /app/dist/

rpms/jellyfin-web/resources/jellyfin-web_10.10.7.spec

@@ -1,43 +0,0 @@
-%global jellyfin_version 10.10.7
-
-
-Name:           jellyfin-web
-Version:        %{jellyfin_version}
-Release:        1
-Summary:        The Free Software Media System - Official Web Client
-
-
-License:        GPL-2.0-or-later
-URL:            https://github.com/jellyfin/jellyfin-web
-Source0:        https://github.com/jellyfin/jellyfin-web/archive/refs/tags/v%{version}.tar.gz
-
-
-BuildArch: noarch
-
-
-BuildRequires: git
-BuildRequires: nodejs
-BuildRequires: npm
-
-
-%description
-%{summary}.
-
-
-%prep
-%setup -q -n jellyfin-web-%{version}
-
-
-%build
-SKIP_PREPARE=1 npm ci --no-audit --no-fund --no-update-notifier
-npm run build:production
-
-
-%install
-install --directory "%{buildroot}%{_datadir}/jellyfin/web"
-cp --recursive dist/* "%{buildroot}%{_datadir}/jellyfin/web"
-
-
-%files
-%license LICENSE
-%{_datadir}/jellyfin/web

rpms/jsonnet-language-server/metadata.yaml

@@ -1,20 +1,21 @@
+name: jsonnet-language-server
+github: grafana/jsonnet-language-server
+description: Jsonnet Language Server Protocol implementation for the Jsonnet templating
+  language.
 arch: amd64
+platform: linux
+maintainer: Grafana Labs
+homepage: https://github.com/grafana/jsonnet-language-server
+license: Apache-2.0
+dist_tag: true
 builds:
 - image: git.unkin.net/unkin/almalinux8-rpmbuilder:latest
   release: 1
   repository:
   - almalinux/el8
   version: 0.17.0
-- image: git.unkin.net/unkin/almalinux9-rpmbuilder:latest
+- image: artifactapi.k8s.syd1.au.unkin.net/docker-internal/rpmbuilder:0.1.0-alma9
   release: 1
   repository:
   - almalinux/el9
   version: 0.17.0
-description: Jsonnet Language Server Protocol implementation for the Jsonnet templating
-  language.
-github: grafana/jsonnet-language-server
-homepage: https://github.com/grafana/jsonnet-language-server
-license: Apache-2.0
-maintainer: Grafana Labs
-name: jsonnet-language-server
-platform: linux

rpms/jsonnet-lint/metadata.yaml

@@ -1,19 +1,20 @@
+name: jsonnet-lint
+github: google/go-jsonnet
+description: Linter for Jsonnet
 arch: amd64
+platform: linux
+maintainer: Google
+homepage: https://github.com/google/go-jsonnet
+license: Apache-2.0
+dist_tag: true
 builds:
 - image: git.unkin.net/unkin/almalinux8-rpmbuilder:latest
   release: 1
   repository:
   - almalinux/el8
   version: 0.22.0
-- image: git.unkin.net/unkin/almalinux9-rpmbuilder:latest
+- image: artifactapi.k8s.syd1.au.unkin.net/docker-internal/rpmbuilder:0.1.0-alma9
   release: 1
   repository:
   - almalinux/el9
   version: 0.22.0
-description: Linter for Jsonnet
-github: google/go-jsonnet
-homepage: https://github.com/google/go-jsonnet
-license: Apache-2.0
-maintainer: Google
-name: jsonnet-lint
-platform: linux

rpms/jsonnet/metadata.yaml

@@ -1,18 +1,20 @@
----
-arch: amd64
-builds:
-  - image: git.unkin.net/unkin/almalinux8-rpmbuilder:latest
-    release: '1'
-    repository: [almalinux/el8]
-    version: 0.21.0
-  - image: git.unkin.net/unkin/almalinux9-rpmbuilder:latest
-    release: '1'
-    repository: [almalinux/el9]
-    version: 0.21.0
-description: A data templating language
+name: jsonnet
 github: google/go-jsonnet
+description: A data templating language
+arch: amd64
+platform: linux
+maintainer: Google
 homepage: https://github.com/google/go-jsonnet
 license: Apache-2.0
-maintainer: Google
-name: jsonnet
-platform: linux
+dist_tag: true
+builds:
+- image: git.unkin.net/unkin/almalinux8-rpmbuilder:latest
+  release: 1
+  repository:
+  - almalinux/el8
+  version: 0.22.0
+- image: artifactapi.k8s.syd1.au.unkin.net/docker-internal/rpmbuilder:0.1.0-alma9
+  release: 1
+  repository:
+  - almalinux/el9
+  version: 0.22.0

rpms/k8up/metadata.yaml

@@ -0,0 +1,23 @@
+name: k8up
+github: k8up-io/k8up
+github_release_pattern: ^v2\.
+description: K8up Kubernetes backup operator command line client.
+arch: amd64
+platform: linux
+maintainer: K8up Authors
+homepage: https://github.com/k8up-io/k8up
+license: Apache-2.0
+dist_tag: true
+builds:
+- repository:
+  - almalinux/el9
+  image: artifactapi.k8s.syd1.au.unkin.net/docker-internal/rpmbuilder:0.1.0-alma9
+  release: 1
+  version: 2.16.0
+- repository:
+  - fedora/42
+  - fedora/43
+  - fedora/44
+  image: artifactapi.k8s.syd1.au.unkin.net/docker-internal/rpmbuilder:0.1.0-alma9
+  release: 1
+  version: 2.16.0

rpms/k8up/resources/build.sh

@@ -0,0 +1,17 @@
+#!/usr/bin/bash
+
+set -e
+
+BASE_URL="https://artifactapi.k8s.syd1.au.unkin.net/api/v1/remote/github/k8up-io/k8up/releases/download/v${PACKAGE_VERSION}"
+TARBALL="k8up_${PACKAGE_VERSION}_linux_amd64.tar.gz"
+
+wget -O "/app/${TARBALL}" "${BASE_URL}/${TARBALL}"
+wget -O /app/checksums.txt "${BASE_URL}/checksums.txt"
+
+cd /app
+grep " ${TARBALL}$" checksums.txt | sha256sum --check --strict -
+tar xf "/app/${TARBALL}" -C /app/ k8up
+
+envsubst < /app/resources/nfpm.yaml > /app/nfpm.yaml
+
+nfpm pkg --config /app/nfpm.yaml --target /app/dist --packager rpm

rpms/k8up/resources/completions/_k8up

@@ -0,0 +1,16 @@
+#compdef k8up
+
+local -a opts
+local cur
+cur=${words[-1]}
+if [[ "$cur" == "-"* ]]; then
+  opts=("${(@f)$(${words[@]:0:#words[@]-1} ${cur} --generate-bash-completion 2>/dev/null)}")
+else
+  opts=("${(@f)$(${words[@]:0:#words[@]-1} --generate-bash-completion 2>/dev/null)}")
+fi
+
+if [[ "${opts[1]}" != "" ]]; then
+  _describe 'values' opts
+else
+  _files
+fi

rpms/k8up/resources/completions/k8up

@@ -0,0 +1,34 @@
+
+: ${PROG:=$(basename ${BASH_SOURCE})}
+
+# Macs have bash3 for which the bash-completion package doesn't include
+# _init_completion. This is a minimal version of that function.
+_cli_init_completion() {
+  COMPREPLY=()
+  _get_comp_words_by_ref "$@" cur prev words cword
+}
+
+_cli_bash_autocomplete() {
+  if [[ "${COMP_WORDS[0]}" != "source" ]]; then
+    local cur opts base words
+    COMPREPLY=()
+    cur="${COMP_WORDS[COMP_CWORD]}"
+    if declare -F _init_completion >/dev/null 2>&1; then
+      _init_completion -n "=:" || return
+    else
+      _cli_init_completion -n "=:" || return
+    fi
+    words=("${words[@]:0:$cword}")
+    if [[ "$cur" == "-"* ]]; then
+      requestComp="${words[*]} ${cur} --generate-bash-completion"
+    else
+      requestComp="${words[*]} --generate-bash-completion"
+    fi
+    opts=$(eval "${requestComp}" 2>/dev/null)
+    COMPREPLY=($(compgen -W "${opts}" -- ${cur}))
+    return 0
+  fi
+}
+
+complete -o bashdefault -o default -o nospace -F _cli_bash_autocomplete $PROG
+unset PROG

rpms/k8up/resources/completions/k8up.fish

@@ -0,0 +1,11 @@
+function __k8up_complete
+    set -l words (commandline -opc)
+    set -l cur (commandline -ct)
+    if string match -q -- '-*' $cur
+        $words $cur --generate-bash-completion 2>/dev/null
+    else
+        $words --generate-bash-completion 2>/dev/null
+    end
+end
+
+complete -c k8up -f -a '(__k8up_complete)'

rpms/k8up/resources/nfpm.yaml

@@ -0,0 +1,48 @@
+# nfpm.yaml
+
+name: ${PACKAGE_NAME}
+version: ${PACKAGE_VERSION}
+release: ${PACKAGE_RELEASE}
+arch: ${PACKAGE_ARCH}
+platform: ${PACKAGE_PLATFORM}
+section: default
+priority: extra
+description: "${PACKAGE_DESCRIPTION}"
+
+maintainer: ${PACKAGE_MAINTAINER}
+homepage: ${PACKAGE_HOMEPAGE}
+license: ${PACKAGE_LICENSE}
+
+disable_globbing: false
+
+replaces:
+  - k8up
+
+provides:
+  - k8up
+
+contents:
+  - src: /app/k8up
+    dst: /usr/bin/k8up
+    file_info:
+      mode: 0755
+      owner: root
+      group: root
+  - src: /app/resources/completions/k8up
+    dst: /usr/share/bash-completion/completions/k8up
+    file_info:
+      mode: 0644
+      owner: root
+      group: root
+  - src: /app/resources/completions/_k8up
+    dst: /usr/share/zsh/site-functions/_k8up
+    file_info:
+      mode: 0644
+      owner: root
+      group: root
+  - src: /app/resources/completions/k8up.fish
+    dst: /usr/share/fish/vendor_completions.d/k8up.fish
+    file_info:
+      mode: 0644
+      owner: root
+      group: root

rpms/kubecolor/metadata.yaml

@@ -0,0 +1,27 @@
+name: kubecolor
+github: kubecolor/kubecolor
+description: Colorize your kubectl output
+arch: amd64
+platform: linux
+maintainer: kubecolor
+homepage: https://github.com/kubecolor/kubecolor
+license: Apache-2.0
+dist_tag: true
+builds:
+- repository:
+  - almalinux/el8
+  image: git.unkin.net/unkin/almalinux8-rpmbuilder:latest
+  release: 1
+  version: 0.8.0
+- repository:
+  - almalinux/el9
+  image: artifactapi.k8s.syd1.au.unkin.net/docker-internal/rpmbuilder:0.1.0-alma9
+  release: 1
+  version: 0.8.0
+- repository:
+  - fedora/42
+  - fedora/43
+  - fedora/44
+  image: artifactapi.k8s.syd1.au.unkin.net/docker-internal/rpmbuilder:0.1.0-alma9
+  release: 1
+  version: 0.8.0

rpms/kubecolor/resources/build.sh

@@ -0,0 +1,10 @@
+#!/usr/bin/bash
+
+set -e
+
+wget -O /app/kubecolor_${PACKAGE_VERSION}_linux_amd64.tar.gz https://artifactapi.k8s.syd1.au.unkin.net/api/v1/remote/github/kubecolor/kubecolor/releases/download/v${PACKAGE_VERSION}/kubecolor_${PACKAGE_VERSION}_linux_amd64.tar.gz
+tar xf /app/kubecolor_${PACKAGE_VERSION}_linux_amd64.tar.gz -C /app/ kubecolor
+
+envsubst < /app/resources/nfpm.yaml > /app/nfpm.yaml
+
+nfpm pkg --config /app/nfpm.yaml --target /app/dist --packager rpm

rpms/kubecolor/resources/nfpm.yaml

@@ -0,0 +1,30 @@
+# nfpm.yaml
+
+name: ${PACKAGE_NAME}
+version: ${PACKAGE_VERSION}
+release: ${PACKAGE_RELEASE}
+arch: ${PACKAGE_ARCH}
+platform: ${PACKAGE_PLATFORM}
+section: default
+priority: extra
+description: "${PACKAGE_DESCRIPTION}"
+
+maintainer: ${PACKAGE_MAINTAINER}
+homepage: ${PACKAGE_HOMEPAGE}
+license: ${PACKAGE_LICENSE}
+
+disable_globbing: false
+
+replaces:
+  - kubecolor
+
+provides:
+  - kubecolor
+
+contents:
+  - src: /app/kubecolor
+    dst: /usr/bin/kubecolor
+    file_info:
+      mode: 0755
+      owner: root
+      group: root

rpms/kubeconform/metadata.yaml

@@ -6,6 +6,7 @@ platform: linux
 maintainer: Yann Hamon
 homepage: https://github.com/yannh/kubeconform
 license: Apache-2.0
+dist_tag: true
 builds:
 - repository:
   - almalinux/el8
@@ -14,6 +15,6 @@ builds:
   version: 0.7.0
 - repository:
   - almalinux/el9
-  image: git.unkin.net/unkin/almalinux9-rpmbuilder:latest
+  image: artifactapi.k8s.syd1.au.unkin.net/docker-internal/rpmbuilder:0.1.0-alma9
   release: 1
   version: 0.7.0

rpms/kubectl-cnpg/metadata.yaml

@@ -0,0 +1,22 @@
+name: kubectl-cnpg
+github: cloudnative-pg/cloudnative-pg
+description: CloudNativePG kubectl plugin.
+arch: amd64
+platform: linux
+maintainer: The CloudNativePG Contributors
+homepage: https://github.com/cloudnative-pg/cloudnative-pg
+license: Apache-2.0
+dist_tag: true
+builds:
+- repository:
+  - almalinux/el9
+  image: artifactapi.k8s.syd1.au.unkin.net/docker-internal/rpmbuilder:0.1.0-alma9
+  release: 1
+  version: 1.30.1
+- repository:
+  - fedora/42
+  - fedora/43
+  - fedora/44
+  image: artifactapi.k8s.syd1.au.unkin.net/docker-internal/rpmbuilder:0.1.0-alma9
+  release: 1
+  version: 1.30.1

rpms/kubectl-cnpg/resources/build.sh

@@ -0,0 +1,22 @@
+#!/usr/bin/bash
+
+set -e
+
+BASE_URL="https://artifactapi.k8s.syd1.au.unkin.net/api/v1/remote/github/cloudnative-pg/cloudnative-pg/releases/download/v${PACKAGE_VERSION}"
+TARBALL="kubectl-cnpg_${PACKAGE_VERSION}_linux_x86_64.tar.gz"
+
+wget -O "/app/${TARBALL}" "${BASE_URL}/${TARBALL}"
+wget -O /app/checksums.txt "${BASE_URL}/cnpg-${PACKAGE_VERSION}-checksums.txt"
+
+cd /app
+grep " ${TARBALL}$" checksums.txt | sha256sum --check --strict -
+tar xf "/app/${TARBALL}" -C /app/ kubectl-cnpg
+
+mkdir -p /app/completions
+/app/kubectl-cnpg completion bash > /app/completions/kubectl-cnpg
+/app/kubectl-cnpg completion zsh > /app/completions/_kubectl-cnpg
+/app/kubectl-cnpg completion fish > /app/completions/kubectl-cnpg.fish
+
+envsubst < /app/resources/nfpm.yaml > /app/nfpm.yaml
+
+nfpm pkg --config /app/nfpm.yaml --target /app/dist --packager rpm

rpms/kubectl-cnpg/resources/kubectl_complete-cnpg

@@ -0,0 +1,2 @@
+#!/usr/bin/env sh
+exec kubectl cnpg __complete "$@"

rpms/kubectl-cnpg/resources/nfpm.yaml

@@ -0,0 +1,54 @@
+# nfpm.yaml
+
+name: ${PACKAGE_NAME}
+version: ${PACKAGE_VERSION}
+release: ${PACKAGE_RELEASE}
+arch: ${PACKAGE_ARCH}
+platform: ${PACKAGE_PLATFORM}
+section: default
+priority: extra
+description: "${PACKAGE_DESCRIPTION}"
+
+maintainer: ${PACKAGE_MAINTAINER}
+homepage: ${PACKAGE_HOMEPAGE}
+license: ${PACKAGE_LICENSE}
+
+disable_globbing: false
+
+replaces:
+  - kubectl-cnpg
+
+provides:
+  - kubectl-cnpg
+
+contents:
+  - src: /app/kubectl-cnpg
+    dst: /usr/bin/kubectl-cnpg
+    file_info:
+      mode: 0755
+      owner: root
+      group: root
+  - src: /app/resources/kubectl_complete-cnpg
+    dst: /usr/bin/kubectl_complete-cnpg
+    file_info:
+      mode: 0755
+      owner: root
+      group: root
+  - src: /app/completions/kubectl-cnpg
+    dst: /usr/share/bash-completion/completions/kubectl-cnpg
+    file_info:
+      mode: 0644
+      owner: root
+      group: root
+  - src: /app/completions/_kubectl-cnpg
+    dst: /usr/share/zsh/site-functions/_kubectl-cnpg
+    file_info:
+      mode: 0644
+      owner: root
+      group: root
+  - src: /app/completions/kubectl-cnpg.fish
+    dst: /usr/share/fish/vendor_completions.d/kubectl-cnpg.fish
+    file_info:
+      mode: 0644
+      owner: root
+      group: root

rpms/kubectl-tree/metadata.yaml

@@ -0,0 +1,22 @@
+name: kubectl-tree
+github: ahmetb/kubectl-tree
+description: kubectl plugin to browse Kubernetes object hierarchies as a tree.
+arch: amd64
+platform: linux
+maintainer: Ahmet Alp Balkan
+homepage: https://github.com/ahmetb/kubectl-tree
+license: Apache-2.0
+dist_tag: true
+builds:
+- repository:
+  - almalinux/el9
+  image: artifactapi.k8s.syd1.au.unkin.net/docker-internal/rpmbuilder:0.1.0-alma9
+  release: 1
+  version: 0.6.0
+- repository:
+  - fedora/42
+  - fedora/43
+  - fedora/44
+  image: artifactapi.k8s.syd1.au.unkin.net/docker-internal/rpmbuilder:0.1.0-alma9
+  release: 1
+  version: 0.6.0

rpms/kubectl-tree/resources/build.sh

@@ -0,0 +1,17 @@
+#!/usr/bin/bash
+
+set -e
+
+BASE_URL="https://artifactapi.k8s.syd1.au.unkin.net/api/v1/remote/github/ahmetb/kubectl-tree/releases/download/v${PACKAGE_VERSION}"
+TARBALL="kubectl-tree_v${PACKAGE_VERSION}_linux_amd64.tar.gz"
+
+wget -O "/app/${TARBALL}" "${BASE_URL}/${TARBALL}"
+wget -O /app/checksums.txt "${BASE_URL}/kubectl-tree_${PACKAGE_VERSION}_checksums.txt"
+
+cd /app
+grep " ${TARBALL}$" checksums.txt | sha256sum --check --strict -
+tar xf "/app/${TARBALL}" -C /app/ kubectl-tree
+
+envsubst < /app/resources/nfpm.yaml > /app/nfpm.yaml
+
+nfpm pkg --config /app/nfpm.yaml --target /app/dist --packager rpm

rpms/kubectl-tree/resources/kubectl_complete-tree

@@ -0,0 +1,7 @@
+#!/usr/bin/env sh
+# kubectl-tree only completes flags; its KIND NAME args match kubectl get
+for arg in "$@"; do last=$arg; done
+case "$last" in
+  -*) exec kubectl tree __complete "$@" ;;
+  *) exec kubectl __complete get "$@" ;;
+esac

rpms/kubectl-tree/resources/nfpm.yaml

@@ -0,0 +1,36 @@
+# nfpm.yaml
+
+name: ${PACKAGE_NAME}
+version: ${PACKAGE_VERSION}
+release: ${PACKAGE_RELEASE}
+arch: ${PACKAGE_ARCH}
+platform: ${PACKAGE_PLATFORM}
+section: default
+priority: extra
+description: "${PACKAGE_DESCRIPTION}"
+
+maintainer: ${PACKAGE_MAINTAINER}
+homepage: ${PACKAGE_HOMEPAGE}
+license: ${PACKAGE_LICENSE}
+
+disable_globbing: false
+
+replaces:
+  - kubectl-tree
+
+provides:
+  - kubectl-tree
+
+contents:
+  - src: /app/kubectl-tree
+    dst: /usr/bin/kubectl-tree
+    file_info:
+      mode: 0755
+      owner: root
+      group: root
+  - src: /app/resources/kubectl_complete-tree
+    dst: /usr/bin/kubectl_complete-tree
+    file_info:
+      mode: 0755
+      owner: root
+      group: root

rpms/kubectl-view-secret/metadata.yaml

@@ -0,0 +1,22 @@
+name: kubectl-view-secret
+github: elsesiy/kubectl-view-secret
+description: Kubectl plugin to decode Kubernetes secrets.
+arch: amd64
+platform: linux
+maintainer: Jonas-Taha El Sesiy
+homepage: https://github.com/elsesiy/kubectl-view-secret
+license: MIT
+dist_tag: true
+builds:
+- repository:
+  - almalinux/el9
+  image: artifactapi.k8s.syd1.au.unkin.net/docker-internal/rpmbuilder:0.1.0-alma9
+  release: 1
+  version: 0.16.0
+- repository:
+  - fedora/42
+  - fedora/43
+  - fedora/44
+  image: artifactapi.k8s.syd1.au.unkin.net/docker-internal/rpmbuilder:0.1.0-alma9
+  release: 1
+  version: 0.16.0

rpms/kubectl-view-secret/resources/build.sh

@@ -0,0 +1,24 @@
+#!/usr/bin/bash
+
+set -e
+
+BASE_URL="https://artifactapi.k8s.syd1.au.unkin.net/api/v1/remote/github/elsesiy/kubectl-view-secret/releases/download/v${PACKAGE_VERSION}"
+TARBALL="kubectl-view-secret_v${PACKAGE_VERSION}_linux_amd64.tar.gz"
+
+wget -O "/app/${TARBALL}" "${BASE_URL}/${TARBALL}"
+wget -O /app/checksums.txt "${BASE_URL}/kubectl-view-secret_${PACKAGE_VERSION}_checksums.txt"
+
+cd /app
+grep " ${TARBALL}$" checksums.txt | sha256sum --check --strict -
+tar xf "/app/${TARBALL}" -C /app/ kubectl-view-secret
+
+mkdir -p /app/completions
+# kubectl resolves `kubectl view-secret` to kubectl-view_secret; upstream completions target "view-secret".
+mv /app/kubectl-view-secret /app/kubectl-view_secret
+/app/kubectl-view_secret completion bash | sed 's/view-secret/kubectl-view_secret/g' > /app/completions/kubectl-view_secret
+/app/kubectl-view_secret completion zsh | sed 's/view-secret/kubectl-view_secret/g' > /app/completions/_kubectl-view_secret
+/app/kubectl-view_secret completion fish | sed 's/view-secret/kubectl-view_secret/g' > /app/completions/kubectl-view_secret.fish
+
+envsubst < /app/resources/nfpm.yaml > /app/nfpm.yaml
+
+nfpm pkg --config /app/nfpm.yaml --target /app/dist --packager rpm

rpms/kubectl-view-secret/resources/kubectl_complete-view_secret

@@ -0,0 +1,2 @@
+#!/usr/bin/env sh
+exec kubectl view-secret __complete "$@"

rpms/kubectl-view-secret/resources/nfpm.yaml

@@ -0,0 +1,54 @@
+# nfpm.yaml
+
+name: ${PACKAGE_NAME}
+version: ${PACKAGE_VERSION}
+release: ${PACKAGE_RELEASE}
+arch: ${PACKAGE_ARCH}
+platform: ${PACKAGE_PLATFORM}
+section: default
+priority: extra
+description: "${PACKAGE_DESCRIPTION}"
+
+maintainer: ${PACKAGE_MAINTAINER}
+homepage: ${PACKAGE_HOMEPAGE}
+license: ${PACKAGE_LICENSE}
+
+disable_globbing: false
+
+replaces:
+  - kubectl-view-secret
+
+provides:
+  - kubectl-view-secret
+
+contents:
+  - src: /app/kubectl-view_secret
+    dst: /usr/bin/kubectl-view_secret
+    file_info:
+      mode: 0755
+      owner: root
+      group: root
+  - src: /app/resources/kubectl_complete-view_secret
+    dst: /usr/bin/kubectl_complete-view_secret
+    file_info:
+      mode: 0755
+      owner: root
+      group: root
+  - src: /app/completions/kubectl-view_secret
+    dst: /usr/share/bash-completion/completions/kubectl-view_secret
+    file_info:
+      mode: 0644
+      owner: root
+      group: root
+  - src: /app/completions/_kubectl-view_secret
+    dst: /usr/share/zsh/site-functions/_kubectl-view_secret
+    file_info:
+      mode: 0644
+      owner: root
+      group: root
+  - src: /app/completions/kubectl-view_secret.fish
+    dst: /usr/share/fish/vendor_completions.d/kubectl-view_secret.fish
+    file_info:
+      mode: 0644
+      owner: root
+      group: root

rpms/kubectx/metadata.yaml

@@ -1,4 +1,3 @@
----
 name: kubectx
 github: ahmetb/kubectx
 description: Faster way to switch between clusters and namespaces in kubectl.
@@ -7,6 +6,7 @@ platform: linux
 maintainer: ahmetb
 homepage: https://github.com/ahmetb/kubectx
 license: Apache-2.0
+dist_tag: true
 builds:
 - repository:
   - almalinux/el8
@@ -15,6 +15,6 @@ builds:
   version: 0.11.0
 - repository:
   - almalinux/el9
-  image: git.unkin.net/unkin/almalinux9-rpmbuilder:latest
+  image: artifactapi.k8s.syd1.au.unkin.net/docker-internal/rpmbuilder:0.1.0-alma9
   release: 1
   version: 0.11.0

rpms/kustomize/metadata.yaml

@@ -1,4 +1,3 @@
----
 name: kustomize
 github: kubernetes-sigs/kustomize
 description: Kubernetes native configuration management
@@ -7,13 +6,16 @@ platform: linux
 maintainer: kubernetes-sigs
 homepage: https://github.com/kubernetes-sigs/kustomize
 license: Apache-2.0
+dist_tag: true
 github_release_pattern: ^kustomize/v.*
 builds:
-  - repository: [almalinux/el8]
-    image: git.unkin.net/unkin/almalinux8-rpmbuilder:latest
-    release: '1'
-    version: 5.8.1
-  - repository: [almalinux/el9]
-    image: git.unkin.net/unkin/almalinux9-rpmbuilder:latest
-    release: '1'
-    version: 5.8.1
+- repository:
+  - almalinux/el8
+  image: git.unkin.net/unkin/almalinux8-rpmbuilder:latest
+  release: '1'
+  version: 5.8.1
+- repository:
+  - almalinux/el9
+  image: artifactapi.k8s.syd1.au.unkin.net/docker-internal/rpmbuilder:0.1.0-alma9
+  release: '1'
+  version: 5.8.1

rpms/lazydocker/metadata.yaml

@@ -1,4 +1,3 @@
----
 name: lazydocker
 github: jesseduffield/lazydocker
 description: The lazier way to manage everything docker.
@@ -7,6 +6,7 @@ platform: linux
 maintainer: jesseduffield
 homepage: https://github.com/jesseduffield/lazydocker
 license: MIT
+dist_tag: true
 builds:
 - repository:
   - almalinux/el8
@@ -15,6 +15,6 @@ builds:
   version: 0.25.2
 - repository:
   - almalinux/el9
-  image: git.unkin.net/unkin/almalinux9-rpmbuilder:latest
+  image: artifactapi.k8s.syd1.au.unkin.net/docker-internal/rpmbuilder:0.1.0-alma9
   release: 1
   version: 0.25.2

rpms/libfoundationdb/metadata.yaml

@@ -1,18 +1,20 @@
----
-arch: amd64
-builds:
-  - image: git.unkin.net/unkin/almalinux8-rpmbuilder:latest
-    release: '1'
-    repository: [almalinux/el8]
-    version: 7.3.71
-  - image: git.unkin.net/unkin/almalinux9-rpmbuilder:latest
-    release: '1'
-    repository: [almalinux/el9]
-    version: 7.3.71
-description: FoundationDB client library - Shared library for FoundationDB applications
+name: libfoundationdb
 github: apple/foundationdb
+description: FoundationDB client library - Shared library for FoundationDB applications
+arch: amd64
+platform: linux
+maintainer: FoundationDB Community
 homepage: https://github.com/apple/foundationdb
 license: Apache-2.0
-maintainer: FoundationDB Community
-name: libfoundationdb
-platform: linux
+dist_tag: true
+builds:
+- image: git.unkin.net/unkin/almalinux8-rpmbuilder:latest
+  release: '1'
+  repository:
+  - almalinux/el8
+  version: 7.3.71
+- image: artifactapi.k8s.syd1.au.unkin.net/docker-internal/rpmbuilder:0.1.0-alma9
+  release: '1'
+  repository:
+  - almalinux/el9
+  version: 7.3.71

rpms/neovim-glibc-2.17/metadata.yaml

@@ -1,12 +1,13 @@
----
 name: neovim-glibc-2.17
 github: neovim/neovim-releases
-description: Vim-fork focused on extensibility and usability (glibc 2.17 compatible build).
+description: Vim-fork focused on extensibility and usability (glibc 2.17 compatible
+  build).
 arch: amd64
 platform: linux
 maintainer: neovim
 homepage: https://neovim.io
 license: Apache-2.0
+dist_tag: true
 builds:
 - repository:
   - almalinux/el8
@@ -15,6 +16,6 @@ builds:
   version: 0.12.2
 - repository:
   - almalinux/el9
-  image: git.unkin.net/unkin/almalinux9-rpmbuilder:latest
+  image: artifactapi.k8s.syd1.au.unkin.net/docker-internal/rpmbuilder:0.1.0-alma9
   release: 1
   version: 0.12.2

rpms/neovim/metadata.yaml

@@ -1,4 +1,3 @@
----
 name: neovim
 github: neovim/neovim
 description: Vim-fork focused on extensibility and usability.
@@ -7,6 +6,7 @@ platform: linux
 maintainer: neovim
 homepage: https://neovim.io
 license: Apache-2.0
+dist_tag: true
 builds:
 - repository:
   - almalinux/el8
@@ -15,6 +15,6 @@ builds:
   version: 0.12.2
 - repository:
   - almalinux/el9
-  image: git.unkin.net/unkin/almalinux9-rpmbuilder:latest
+  image: artifactapi.k8s.syd1.au.unkin.net/docker-internal/rpmbuilder:0.1.0-alma9
   release: 1
   version: 0.12.2

rpms/nfpm/metadata.yaml

@@ -7,6 +7,7 @@ platform: linux
 maintainer: GoReleaser
 homepage: https://nfpm.goreleaser.com/
 license: MIT
+dist_tag: true
 builds:
 - repository:
   - almalinux/el8
@@ -15,6 +16,13 @@ builds:
   version: 2.46.3
 - repository:
   - almalinux/el9
-  image: git.unkin.net/unkin/almalinux9-rpmbuilder:latest
+  image: artifactapi.k8s.syd1.au.unkin.net/docker-internal/rpmbuilder:0.1.0-alma9
+  release: 1
+  version: 2.46.3
+- repository:
+  - fedora/42
+  - fedora/43
+  - fedora/44
+  image: artifactapi.k8s.syd1.au.unkin.net/docker-internal/rpmbuilder:0.1.0-alma9
   release: 1
   version: 2.46.3

rpms/node_exporter/metadata.yaml

@@ -6,14 +6,15 @@ platform: linux
 maintainer: Prometheus
 homepage: https://github.com/prometheus/node_exporter
 license: Apache-2.0 license
+dist_tag: true
 builds:
 - repository:
   - almalinux/el8
   image: git.unkin.net/unkin/almalinux8-rpmbuilder:latest
   release: 1
-  version: 1.10.2
+  version: 1.11.1
 - repository:
   - almalinux/el9
-  image: git.unkin.net/unkin/almalinux9-rpmbuilder:latest
+  image: artifactapi.k8s.syd1.au.unkin.net/docker-internal/rpmbuilder:0.1.0-alma9
   release: 1
-  version: 1.10.2
+  version: 1.11.1

rpms/nomad-autoscaler/metadata.yaml

@@ -8,6 +8,7 @@ platform: linux
 maintainer: Hashicorp
 homepage: https://github.com/hashicorp/nomad-autoscaler
 license: Mozilla Public License, version 2.0
+dist_tag: true
 builds:
 - repository:
   - almalinux/el8
@@ -16,6 +17,6 @@ builds:
   version: 0.4.9
 - repository:
   - almalinux/el9
-  image: git.unkin.net/unkin/almalinux9-rpmbuilder:latest
+  image: artifactapi.k8s.syd1.au.unkin.net/docker-internal/rpmbuilder:0.1.0-alma9
   release: 1
   version: 0.4.9

rpms/nomad/metadata.yaml

@@ -1,18 +1,21 @@
----
-arch: amd64
-builds:
-  - image: git.unkin.net/unkin/almalinux8-rpmbuilder:latest
-    release: '1'
-    repository: [almalinux/el8]
-    version: 1.10.1
-  - image: git.unkin.net/unkin/almalinux9-rpmbuilder:latest
-    release: '1'
-    repository: [almalinux/el9]
-    version: 1.10.1
-description: A simple and flexible scheduler and orchestrator to deploy and manage containers and non-containerized applications across on-premises and clouds at scale.
+name: nomad
 github: unknown/nomad
+description: A simple and flexible scheduler and orchestrator to deploy and manage
+  containers and non-containerized applications across on-premises and clouds at scale.
+arch: amd64
+platform: linux
+maintainer: HashiCorp
 homepage: https://www.nomadproject.io/
 license: BUSL-1.1
-maintainer: HashiCorp
-name: nomad
-platform: linux
+dist_tag: true
+builds:
+- image: git.unkin.net/unkin/almalinux8-rpmbuilder:latest
+  release: '1'
+  repository:
+  - almalinux/el8
+  version: 1.10.1
+- image: artifactapi.k8s.syd1.au.unkin.net/docker-internal/rpmbuilder:0.1.0-alma9
+  release: '1'
+  repository:
+  - almalinux/el9
+  version: 1.10.1

rpms/nzbget/metadata.yaml

@@ -7,14 +7,15 @@ platform: linux
 maintainer: nzbgetcom
 homepage: https://github.com/nzbgetcom/nzbget
 license: GPL-2.0
+dist_tag: true
 builds:
 - repository:
   - almalinux/el8
   image: git.unkin.net/unkin/almalinux8-rpmbuilder:latest
   release: 1
-  version: '26.1'
+  version: '26.2'
 - repository:
   - almalinux/el9
-  image: git.unkin.net/unkin/almalinux9-rpmbuilder:latest
+  image: artifactapi.k8s.syd1.au.unkin.net/docker-internal/rpmbuilder:0.1.0-alma9
   release: 1
-  version: '26.1'
+  version: '26.2'

rpms/nzbget/resources/build.sh

@@ -2,6 +2,10 @@
 
 set -e
 
-# Download the pre-built RPM from GitHub releases
+# Download the pre-built RPM from GitHub releases.
+# Upstream always publishes the release-1 asset (nzbget-<version>-1.x86_64.rpm);
+# the source URL must use the upstream asset name, not PACKAGE_RELEASE, which
+# carries the dist tag (e.g. 1.el9) and does not exist upstream. Only the local
+# output filename is dist-tagged, mirroring the code-server package.
 curl -L -o /app/dist/nzbget-${PACKAGE_VERSION}-${PACKAGE_RELEASE}.x86_64.rpm \
-  https://artifactapi.k8s.syd1.au.unkin.net/api/v1/remote/github/nzbgetcom/nzbget/releases/download/v$PACKAGE_VERSION/nzbget-${PACKAGE_VERSION}-${PACKAGE_RELEASE}.x86_64.rpm
+  https://artifactapi.k8s.syd1.au.unkin.net/api/v1/remote/github/nzbgetcom/nzbget/releases/download/v$PACKAGE_VERSION/nzbget-${PACKAGE_VERSION}-1.x86_64.rpm

rpms/nzbget_exporter/metadata.yaml

@@ -1,18 +1,20 @@
----
-arch: amd64
-builds:
-  - image: git.unkin.net/unkin/almalinux8-rpmbuilder:latest
-    release: '1'
-    repository: [almalinux/el8]
-    version: 2025.08.03
-  - image: git.unkin.net/unkin/almalinux9-rpmbuilder:latest
-    release: '1'
-    repository: [almalinux/el9]
-    version: 2025.08.03
-description: Prometheus exporter for NZBGet
+name: nzbget_exporter
 github: frebib/nzbget-exporter
+description: Prometheus exporter for NZBGet
+arch: amd64
+platform: linux
+maintainer: Prometheus
 homepage: https://github.com/frebib/nzbget-exporter
 license: MIT
-maintainer: Prometheus
-name: nzbget_exporter
-platform: linux
+dist_tag: true
+builds:
+- image: git.unkin.net/unkin/almalinux8-rpmbuilder:latest
+  release: '1'
+  repository:
+  - almalinux/el8
+  version: 2025.08.03
+- image: artifactapi.k8s.syd1.au.unkin.net/docker-internal/rpmbuilder:0.1.0-alma9
+  release: '1'
+  repository:
+  - almalinux/el9
+  version: 2025.08.03

rpms/openbao-plugin-secret-consul/metadata.yaml

@@ -1,12 +1,13 @@
 name: openbao-plugin-secret-consul
 github: openbao/openbao-plugins
-github_release_pattern: "^secrets-consul-v.*"
 description: OpenBao secrets engine plugin for HashiCorp Consul
 arch: amd64
 platform: linux
 maintainer: OpenBao Community
 homepage: https://github.com/openbao/openbao-plugins
 license: MPL-2.0
+dist_tag: true
+github_release_pattern: ^secrets-consul-v.*
 builds:
 - repository:
   - almalinux/el8
@@ -15,6 +16,6 @@ builds:
   version: 0.1.0
 - repository:
   - almalinux/el9
-  image: git.unkin.net/unkin/almalinux9-rpmbuilder:latest
+  image: artifactapi.k8s.syd1.au.unkin.net/docker-internal/rpmbuilder:0.1.0-alma9
   release: 1
   version: 0.1.0

rpms/openbao-plugin-secret-nomad/metadata.yaml

@@ -1,12 +1,13 @@
 name: openbao-plugin-secret-nomad
 github: openbao/openbao-plugins
-github_release_pattern: "^secrets-nomad-v.*"
 description: OpenBao secrets engine plugin for HashiCorp Nomad
 arch: amd64
 platform: linux
 maintainer: OpenBao Community
 homepage: https://github.com/openbao/openbao-plugins
 license: MPL-2.0
+dist_tag: true
+github_release_pattern: ^secrets-nomad-v.*
 builds:
 - repository:
   - almalinux/el8
@@ -15,6 +16,6 @@ builds:
   version: 0.1.5
 - repository:
   - almalinux/el9
-  image: git.unkin.net/unkin/almalinux9-rpmbuilder:latest
+  image: artifactapi.k8s.syd1.au.unkin.net/docker-internal/rpmbuilder:0.1.0-alma9
   release: 1
   version: 0.1.5

rpms/openbao-plugins/metadata.yaml

@@ -6,6 +6,7 @@ platform: linux
 maintainer: OpenBao Community
 homepage: https://github.com/openbao/openbao-plugins
 license: MPL-2.0
+dist_tag: true
 builds:
 - repository:
   - almalinux/el8
@@ -14,6 +15,6 @@ builds:
   version: 1.0.0
 - repository:
   - almalinux/el9
-  image: git.unkin.net/unkin/almalinux9-rpmbuilder:latest
+  image: artifactapi.k8s.syd1.au.unkin.net/docker-internal/rpmbuilder:0.1.0-alma9
   release: 1
   version: 1.0.0

rpms/packer/metadata.yaml

@@ -6,6 +6,7 @@ platform: linux
 maintainer: HashiCorp
 homepage: https://www.packer.io/
 license: BUSL-1.1
+dist_tag: true
 builds:
 - repository:
   - almalinux/el8
@@ -14,6 +15,6 @@ builds:
   version: 1.15.3
 - repository:
   - almalinux/el9
-  image: git.unkin.net/unkin/almalinux9-rpmbuilder:latest
+  image: artifactapi.k8s.syd1.au.unkin.net/docker-internal/rpmbuilder:0.1.0-alma9
   release: 1
   version: 1.15.3

rpms/pgbouncer_exporter/metadata.yaml

@@ -1,18 +1,20 @@
----
-arch: amd64
-builds:
-  - image: git.unkin.net/unkin/almalinux8-rpmbuilder:latest
-    release: '1'
-    repository: [almalinux/el8]
-    version: 0.11.0
-  - image: git.unkin.net/unkin/almalinux9-rpmbuilder:latest
-    release: '1'
-    repository: [almalinux/el9]
-    version: 0.11.0
-description: Prometheus exporter for PgBouncer
+name: pgbouncer_exporter
 github: prometheus-community/pgbouncer_exporter
+description: Prometheus exporter for PgBouncer
+arch: amd64
+platform: linux
+maintainer: Prometheus
 homepage: https://github.com/prometheus-community/pgbouncer_exporter
 license: Apache-2.0 license
-maintainer: Prometheus
-name: pgbouncer_exporter
-platform: linux
+dist_tag: true
+builds:
+- image: git.unkin.net/unkin/almalinux8-rpmbuilder:latest
+  release: 1
+  repository:
+  - almalinux/el8
+  version: 0.12.0
+- image: artifactapi.k8s.syd1.au.unkin.net/docker-internal/rpmbuilder:0.1.0-alma9
+  release: 1
+  repository:
+  - almalinux/el9
+  version: 0.12.0

rpms/postgres_exporter/metadata.yaml

@@ -6,6 +6,7 @@ platform: linux
 maintainer: Prometheus
 homepage: https://github.com/prometheus-community/postgres_exporter
 license: Apache-2.0 license
+dist_tag: true
 builds:
 - repository:
   - almalinux/el8
@@ -14,6 +15,6 @@ builds:
   version: 0.19.1
 - repository:
   - almalinux/el9
-  image: git.unkin.net/unkin/almalinux9-rpmbuilder:latest
+  image: artifactapi.k8s.syd1.au.unkin.net/docker-internal/rpmbuilder:0.1.0-alma9
   release: 1
   version: 0.19.1

rpms/puppet-initial/README.md

@@ -0,0 +1,38 @@
+# puppet-initial
+
+A firstrun bootstrap script and oneshot systemd service that initialises a
+freshly-provisioned host into Puppet:
+
+1. Sets the FQDN under `.main.unkin.net`.
+2. Fetches the Puppet CA certificate from the CA service.
+3. Registers the node with a noop agent run against the CA.
+4. Runs the agent a few times against the compile master, then enables the
+   `puppet` service and disables itself.
+
+## Puppet CA endpoint
+
+The CA endpoint defaults to the in-cluster puppetserver CA service
+`puppetca.k8s.syd1.au.unkin.net:8140` (serving the standard
+`/puppet-ca/v1/certificate/ca` API).
+
+It is overridable via the environment. The `puppet-initial.service` unit reads
+`/etc/sysconfig/puppet-initial` (`EnvironmentFile=-`, so the file is optional),
+which the RPM ships as a commented `%config(noreplace)` example:
+
+| Variable        | Default                          | Purpose                                                      |
+|-----------------|----------------------------------|-------------------------------------------------------------|
+| `PUPPETCA_HOST` | `puppetca.k8s.syd1.au.unkin.net` | CA hostname (CA cert fetch + `--server` for registration).  |
+| `PUPPETCA_PORT` | `8140`                           | CA API port.                                                |
+
+### Overriding from kickstart
+
+A kickstart `%post` can point a host at a different CA without rebuilding the
+RPM by writing the sysconfig file before the service starts:
+
+```bash
+%post
+cat > /etc/sysconfig/puppet-initial <<'EOF'
+PUPPETCA_HOST=puppetca.k8s.syd1.au.unkin.net
+PUPPETCA_PORT=8140
+EOF
+```

rpms/puppet-initial/metadata.yaml

@@ -1,17 +1,19 @@
----
-arch: amd64
-builds:
-  - image: git.unkin.net/unkin/almalinux8-rpmbuilder:latest
-    release: '1'
-    repository: [almalinux/el8]
-    version: 1.0.3
-  - image: git.unkin.net/unkin/almalinux9-rpmbuilder:latest
-    release: '1'
-    repository: [almalinux/el9]
-    version: 1.0.3
-description: A script and service to initialise puppet for the unkin environmnet.
-github: unknown/puppet-initial
-license: MIT
-maintainer: UNKIN
 name: puppet-initial
+github: unknown/puppet-initial
+description: A script and service to initialise puppet for the unkin environmnet.
+arch: amd64
 platform: linux
+maintainer: UNKIN
+license: MIT
+dist_tag: true
+builds:
+- image: git.unkin.net/unkin/almalinux8-rpmbuilder:latest
+  release: '1'
+  repository:
+  - almalinux/el8
+  version: 1.0.5
+- image: artifactapi.k8s.syd1.au.unkin.net/docker-internal/rpmbuilder:0.1.0-alma9
+  release: '1'
+  repository:
+  - almalinux/el9
+  version: 1.0.5

rpms/puppet-initial/resources/nfpm.yaml

@@ -15,7 +15,7 @@ license: ${PACKAGE_LICENSE}
 disable_globbing: false
 
 depends:
-  - puppet-agent
+  - openvox-agent
 
 # Files to include in the package
 contents:
@@ -31,6 +31,13 @@ contents:
       mode: 0644
       owner: root
       group: root
+  - src: /app/resources/puppet-initial.sysconfig
+    dst: /etc/sysconfig/puppet-initial
+    type: config|noreplace
+    file_info:
+      mode: 0644
+      owner: root
+      group: root
 
 # Scripts to run during installation/removal (optional)
 scripts:

rpms/puppet-initial/resources/puppet-initial

@@ -1,14 +1,21 @@
 #!/bin/bash
 
+# Puppet CA endpoint. Overridable via the environment (systemd reads
+# /etc/sysconfig/puppet-initial via EnvironmentFile), so kickstart %post can
+# point a host at a different CA without rebuilding the RPM. Defaults to the
+# in-cluster puppetserver CA service.
+PUPPETCA_HOST="${PUPPETCA_HOST:-puppetca.k8s.syd1.au.unkin.net}"
+PUPPETCA_PORT="${PUPPETCA_PORT:-8140}"
+
 # Ensure the hostname is set
 hostnamectl set-hostname $(hostname -s).main.unkin.net
 grep '^HOSTNAME=' /etc/sysconfig/network | cut -d= -f2 | grep -q '\.' || sed -i 's/^\(HOSTNAME=[^\.]*\)$/\1.main.unkin.net/' /etc/sysconfig/network
 
 # Install CA for Puppet
-test -f /etc/puppetlabs/puppet/ssl/certs/ca.pem || mkdir -p /etc/puppetlabs/puppet/ssl/certs && wget --no-check-certificate https://puppetca.query.consul:8140/puppet-ca/v1/certificate/ca -O /etc/puppetlabs/puppet/ssl/certs/ca.pem
+test -f /etc/puppetlabs/puppet/ssl/certs/ca.pem || mkdir -p /etc/puppetlabs/puppet/ssl/certs && wget --no-check-certificate "https://${PUPPETCA_HOST}:${PUPPETCA_PORT}/puppet-ca/v1/certificate/ca" -O /etc/puppetlabs/puppet/ssl/certs/ca.pem
 
 # Registering to Puppet server
-/opt/puppetlabs/bin/puppet agent --test --server puppetca.query.consul --noop --onetime --no-daemonize --verbose
+/opt/puppetlabs/bin/puppet agent --test --server "${PUPPETCA_HOST}" --noop --onetime --no-daemonize --verbose
 
 # Running Puppet agent five times with a 30-second gap between each run, stop puppet service at the end of each run
 for i in {1..5}; do

rpms/puppet-initial/resources/puppet-initial.service

@@ -5,6 +5,7 @@ Wants=network-online.target
 
 [Service]
 Type=simple
+EnvironmentFile=-/etc/sysconfig/puppet-initial
 ExecStart=/usr/local/bin/puppet-initial
 RemainAfterExit=true
 ExecStop=/bin/true

rpms/puppet-initial/resources/puppet-initial.sysconfig

@@ -0,0 +1,13 @@
+# Environment overrides for the puppet-initial firstrun bootstrap.
+# Read by the puppet-initial.service unit (EnvironmentFile=-/etc/sysconfig/puppet-initial).
+# A kickstart %post can write this file to point a host at a different Puppet CA
+# without rebuilding the RPM. All values are optional; the defaults below match
+# the shipped in-cluster puppetserver CA service.
+
+# Hostname of the Puppet CA service. Used both to fetch the CA certificate
+# (https://<host>:<port>/puppet-ca/v1/certificate/ca) and as --server for the
+# initial noop agent registration run.
+#PUPPETCA_HOST=puppetca.k8s.syd1.au.unkin.net
+
+# Port the Puppet CA API listens on.
+#PUPPETCA_PORT=8140