jellyfin-ha bakes the LDAP and SSO auth plugins into its image, and all
outside artifacts must be fetched via artifactapi rather than direct.
- Add remote_generic/jellyfin.yaml proxying repo.jellyfin.org, scoped to
the ldap-authentication plugin zip.
- Add a github.yaml pattern for 9p4/jellyfin-plugin-sso release zips
(GitHub redirects release downloads to objects.githubusercontent.com,
which the existing github remote already follows).
PR plan pipelines were failing with "Error acquiring the state lock"
when they collided with a concurrent apply (or another plan) holding
the lock on the same Consul-backed state.
- plan: pass -lock=false to terragrunt plan; apply keeps locking
Adds the ^oauth2-proxy/ pattern to the quay.io remote so the
artifactapi caching proxy will serve quay.io/oauth2-proxy/oauth2-proxy.
Needed so the arrproxy oauth2-proxy sidecar can pull the real upstream
quay.io address via the rke2 registries.yaml mirror.
Rackspace (syd.mirror.rackspace.com) never synced Fedora 44: it serves
releases/43 but 404s on releases/44/.../repomd.xml, breaking dnf makecache
for F44 through the caching proxy. Repoint to gsl-syd.mm.fcix.net, a
Sydney-local FCIX tier-1 mirror that is fully synced for F44 (releases +
updates + Packages, verified 200, ~25ms), using the standard
/fedora/linux layout root.
The k8up operator (deployed via the k8up-system app) and its restic
backup/prune/check jobs both run ghcr.io/k8up-io/k8up, which the
containerd mirror only serves when the image path is allowlisted.
- Add ^k8up-io/ to the ghcr remote patterns
Adds a valkey helm remote and allowlists the operator/exporter images so the
valkey-operator install in argocd-apps resolves everything through artifactapi.
- Add config/remote_helm/valkey.yaml proxying https://valkey.io/valkey-helm
- Add valkey to the virtual/helm member list
- Allow ^valkey-io/ on the ghcr remote (operator image ghcr.io/valkey-io/valkey-operator)
- Allow ^oliver006/redis_exporter on dockerhub (Valkey metrics exporter)
The k8up backup operator will be installed via ArgoCD, which pulls charts
through the artifactapi virtual helm proxy. That proxy resolves only the
remotes listed as members, so the upstream k8up repo must be registered.
- Add config/remote_helm/k8up.yaml pointing at https://k8up-io.github.io/k8up
- Register k8up as a member of the virtual helm repository
Expose the provider v0.5.1 mirror_strategy field through the config module
so rpm and alpine(apk) remotes can select how upstream mirrors are chosen
(round_robin | least_conn) across base_url + mirrorlist. Completes the
mirror IaC surface started in #24.
- remote_rpm / remote_alpine object vars gain mirror_strategy = optional(string, null)
- pass mirror_strategy through to the corresponding remote resources
- provider constraint stays ~> 0.5 (already resolves v0.5.1, which adds the attr)
Additive and optional; no real remote config changes.
Expose the provider v0.5.0 mirrorlist field through the config module so
rpm and alpine(apk) remotes can declare extra upstream mirror base URLs
(load-balanced with failover across base_url + mirrorlist).
- remote_rpm / remote_alpine object vars gain mirrorlist = optional(list(string), [])
- pass mirrorlist through to the corresponding remote resources
- bump artifactapi provider constraint to ~> 0.5
Additive and optional; no real remote config changes (deferred follow-up).
dl.fedoraproject.org is the throttled master, causing F44 cold-fetch
timeouts. uni-stuttgart is a fast tier-1 mirror carrying the full
releases+updates tree.
The fcix micromirror (gsl-syd.mm.fcix.net) does not carry F44, so dnf
gets HTTP 404 for releases/44/Everything/x86_64/os/repodata/repomd.xml.
dl.fedoraproject.org is the canonical always-current Fedora source.
Pin the artifactapi Terraform provider to v0.2.0, which adds the artifactapi_remote_github_rpm resource (GitHub releases served as a yum repo). Verified v0.2.0 resolves and installs from the terraform-unkin registry.
The k8s Gitea deployment pulls gitea/gitea (rootless) from Docker Hub via the
artifactapi mirror. Add it to the dockerhub allowlist.
- add "^gitea/gitea" to config/remote_docker/dockerhub.yaml patterns
Claude-Session: https://claude.ai/code/session_015ur3i7D2azsMAWTSVABApv
Declares a local generic (raw-file) repo for bootapi's node rootfs tarballs and
wires the local_generic kind through the module. Depends on
terraform-provider-artifactapi #12 releasing v0.1.4 (adds artifactapi_local_generic);
the provider version pin is bumped to 0.1.4, so plan/validate stay red until that
release is available.
- config/local_generic/rootfs-images.yaml (new repo).
- local_generic wiring: config.hcl, module variables.tf + main.tf, env
terragrunt.hcl inputs; provider pin 0.1.3 -> 0.1.4.
Claude-Session: https://claude.ai/code/session_015ur3i7D2azsMAWTSVABApv
NetBox is being deployed to k8s (argocd-apps) as the source of truth for
host/interface/IPAM data. Its image is ghcr.io/netbox-community/netbox, pulled
through the artifactapi ghcr mirror, so add the ^netbox-community/ pattern to
the ghcr remote allowlist.
Claude-Session: https://claude.ai/code/session_015ur3i7D2azsMAWTSVABApv
The puppet AlmaLinux hosts now consume a general rpm-vendor repo (alongside
the per-distro rpm-vendor-elN repos), mirroring the rpm-internal split. Add
the backing local rpm repo so the baseurl resolves.
- add config/local_rpm/rpm-vendor.yaml
Claude-Session: https://claude.ai/code/session_015ur3i7D2azsMAWTSVABApv
benvin
unkin-agent
unkin-agent
unkinben