The k8up operator (deployed via the k8up-system app) and its restic
backup/prune/check jobs both run ghcr.io/k8up-io/k8up, which the
containerd mirror only serves when the image path is allowlisted.
- Add ^k8up-io/ to the ghcr remote patterns
The k8up backup operator will be installed via ArgoCD, which pulls charts
through the artifactapi virtual helm proxy. That proxy resolves only the
remotes listed as members, so the upstream k8up repo must be registered.
- Add config/remote_helm/k8up.yaml pointing at https://k8up-io.github.io/k8up
- Register k8up as a member of the virtual helm repository
Expose the provider v0.5.1 mirror_strategy field through the config module
so rpm and alpine(apk) remotes can select how upstream mirrors are chosen
(round_robin | least_conn) across base_url + mirrorlist. Completes the
mirror IaC surface started in #24.
- remote_rpm / remote_alpine object vars gain mirror_strategy = optional(string, null)
- pass mirror_strategy through to the corresponding remote resources
- provider constraint stays ~> 0.5 (already resolves v0.5.1, which adds the attr)
Additive and optional; no real remote config changes.
Expose the provider v0.5.0 mirrorlist field through the config module so
rpm and alpine(apk) remotes can declare extra upstream mirror base URLs
(load-balanced with failover across base_url + mirrorlist).
- remote_rpm / remote_alpine object vars gain mirrorlist = optional(list(string), [])
- pass mirrorlist through to the corresponding remote resources
- bump artifactapi provider constraint to ~> 0.5
Additive and optional; no real remote config changes (deferred follow-up).
dl.fedoraproject.org is the throttled master, causing F44 cold-fetch
timeouts. uni-stuttgart is a fast tier-1 mirror carrying the full
releases+updates tree.
The fcix micromirror (gsl-syd.mm.fcix.net) does not carry F44, so dnf
gets HTTP 404 for releases/44/Everything/x86_64/os/repodata/repomd.xml.
dl.fedoraproject.org is the canonical always-current Fedora source.
Pin the artifactapi Terraform provider to v0.2.0, which adds the artifactapi_remote_github_rpm resource (GitHub releases served as a yum repo). Verified v0.2.0 resolves and installs from the terraform-unkin registry.
The k8s Gitea deployment pulls gitea/gitea (rootless) from Docker Hub via the
artifactapi mirror. Add it to the dockerhub allowlist.
- add "^gitea/gitea" to config/remote_docker/dockerhub.yaml patterns
Claude-Session: https://claude.ai/code/session_015ur3i7D2azsMAWTSVABApv
Declares a local generic (raw-file) repo for bootapi's node rootfs tarballs and
wires the local_generic kind through the module. Depends on
terraform-provider-artifactapi #12 releasing v0.1.4 (adds artifactapi_local_generic);
the provider version pin is bumped to 0.1.4, so plan/validate stay red until that
release is available.
- config/local_generic/rootfs-images.yaml (new repo).
- local_generic wiring: config.hcl, module variables.tf + main.tf, env
terragrunt.hcl inputs; provider pin 0.1.3 -> 0.1.4.
Claude-Session: https://claude.ai/code/session_015ur3i7D2azsMAWTSVABApv
NetBox is being deployed to k8s (argocd-apps) as the source of truth for
host/interface/IPAM data. Its image is ghcr.io/netbox-community/netbox, pulled
through the artifactapi ghcr mirror, so add the ^netbox-community/ pattern to
the ghcr remote allowlist.
Claude-Session: https://claude.ai/code/session_015ur3i7D2azsMAWTSVABApv
The puppet AlmaLinux hosts now consume a general rpm-vendor repo (alongside
the per-distro rpm-vendor-elN repos), mirroring the rpm-internal split. Add
the backing local rpm repo so the baseurl resolves.
- add config/local_rpm/rpm-vendor.yaml
Claude-Session: https://claude.ai/code/session_015ur3i7D2azsMAWTSVABApv
The VerticalPodAutoscaler rollout pulls registry.k8s.io/autoscaling/vpa-recommender.
Serve it through the existing k8s-registry pull-through cache, consistent with how
external-dns and sig-storage images from registry.k8s.io are already gated.
CI installed vault by shelling out to `dnf install vault -y`, which reads
metadata for every enabled repo (appstream/baseos/crb/epel/ha) and downloads
the 169MB vendored vault RPM from the unkin repo on every pipeline run
(~39s per plan/apply job).
- Replace the dnf install with a pinned curl of the upstream vault zip from
the artifactapi hashicorp-releases remote proxy, extracted with python3 to
/usr/local/bin/vault.
- Pin the version via a VAULT_VERSION env var (1.20.0).
The iplocate patterns were added to mutable_patterns only, which tags TTL but
does not allowlist — requests 403'd 'access denied'. Verified: existing
mutable_patterns-only paths (branch archives, webadmin) also 403, while patterns
entries (uv) return 200. Add the iplocate patterns to patterns (the allowlist),
keeping them in mutable_patterns so the daily-updated DB stays mutable.
Add patterns to the github.com generic remote for the iplocate ip-to-asn /
ip-to-country databases rather than standing up a new remote. The files are
Git-LFS, so the /raw/ path redirects to media.githubusercontent.com; the github
remote already follows github's cross-host redirects (as it does for release
assets), and the raw path returns the real bytes (verified: 12MB zip / 78MB mmdb).
Marked mutable (branch content).
repodata (repomd.xml and its referenced index files) is a mutable index that
upstream RPM repos rotate frequently. Marking it immutable (immutable_ttl: 0)
makes artifactapi cache repomd.xml forever: classifier.go checks
immutable_patterns before the RPM provider's own rule (which already classifies
repodata/ as mutable), and SetTTL with ttl=0 writes a Redis key with no expiry.
The result is a stale repomd.xml that keeps pointing at checksum-named metadata
files upstream has already deleted -> 404 on dnf metadata refresh. This broke
rpmbuilder's almalinux8 builds via the epel remote and would eventually hit any
rolling RPM remote.
Remove the repodata immutable patterns from every remote_rpm config so repodata
falls through to the provider's Mutable classification and is re-fetched every
mutable_ttl. RPMs, noarch, GPG keys and .img files stay immutable.
- Drop ".*/repodata/.*\.{xml,sqlite,yaml}.*$" from all config/remote_rpm/*.yaml
(14 files, 20 lines).
After apply, the already-cached stale repodata entries must be evicted (they
have no expiry); that is done per-remote as a follow-up.
The rpmfusion-free / rpmfusion-nonfree repos have no artifactapi remote,
so nodes still point at the retired packagerepo.service.consul mirror and
dnf fails to fetch repomd.xml.
Add caching remote proxies for both trees, pointed at the upstream
download1.rpmfusion.org origin, so el nodes can install RPM Fusion
packages (ffmpeg, etc.) through artifactapi.
Claude-Session: https://claude.ai/code/session_01VZ81u2JtjvaPq8Z3EDTSMb
rpmbuilder publishes vendored third-party RPMs (vault, consul, helm, ...)
which currently go to Gitea's RPM registry. Move them onto artifactapi so
they live in real yum repos alongside rpm-internal, and keep vendored
packages separate from in-house software. rpmbuilder targets EL8, EL9 and
Fedora 42/43/44, so each distro gets its own repo to avoid EL/Fedora RPMs
colliding in a single repodata set.
- Add config/local_rpm/rpm-vendor-el8.yaml
- Add config/local_rpm/rpm-vendor-el9.yaml
- Add config/local_rpm/rpm-vendor-f42.yaml
- Add config/local_rpm/rpm-vendor-f43.yaml
- Add config/local_rpm/rpm-vendor-f44.yaml
config.hcl already globs local_rpm/*.yaml, so no wiring change is needed.
unkin-agent
benvin
benvin
unkinben