The autobackup-operator project needs a place to push its container
image in the artifactapi local docker registry during CI releases.
Add config/local_docker/autobackup-operator.yaml declaring the local
docker repo (description only, matching sibling convention).
Expose the provider v0.5.1 mirror_strategy field through the config module
so rpm and alpine(apk) remotes can select how upstream mirrors are chosen
(round_robin | least_conn) across base_url + mirrorlist. Completes the
mirror IaC surface started in #24.
- remote_rpm / remote_alpine object vars gain mirror_strategy = optional(string, null)
- pass mirror_strategy through to the corresponding remote resources
- provider constraint stays ~> 0.5 (already resolves v0.5.1, which adds the attr)
Additive and optional; no real remote config changes.
Expose the provider v0.5.0 mirrorlist field through the config module so
rpm and alpine(apk) remotes can declare extra upstream mirror base URLs
(load-balanced with failover across base_url + mirrorlist).
- remote_rpm / remote_alpine object vars gain mirrorlist = optional(list(string), [])
- pass mirrorlist through to the corresponding remote resources
- bump artifactapi provider constraint to ~> 0.5
Additive and optional; no real remote config changes (deferred follow-up).
dl.fedoraproject.org is the throttled master, causing F44 cold-fetch
timeouts. uni-stuttgart is a fast tier-1 mirror carrying the full
releases+updates tree.
The fcix micromirror (gsl-syd.mm.fcix.net) does not carry F44, so dnf
gets HTTP 404 for releases/44/Everything/x86_64/os/repodata/repomd.xml.
dl.fedoraproject.org is the canonical always-current Fedora source.
Pin the artifactapi Terraform provider to v0.2.0, which adds the artifactapi_remote_github_rpm resource (GitHub releases served as a yum repo). Verified v0.2.0 resolves and installs from the terraform-unkin registry.
The k8s Gitea deployment pulls gitea/gitea (rootless) from Docker Hub via the
artifactapi mirror. Add it to the dockerhub allowlist.
- add "^gitea/gitea" to config/remote_docker/dockerhub.yaml patterns
Claude-Session: https://claude.ai/code/session_015ur3i7D2azsMAWTSVABApv
Declares a local generic (raw-file) repo for bootapi's node rootfs tarballs and
wires the local_generic kind through the module. Depends on
terraform-provider-artifactapi #12 releasing v0.1.4 (adds artifactapi_local_generic);
the provider version pin is bumped to 0.1.4, so plan/validate stay red until that
release is available.
- config/local_generic/rootfs-images.yaml (new repo).
- local_generic wiring: config.hcl, module variables.tf + main.tf, env
terragrunt.hcl inputs; provider pin 0.1.3 -> 0.1.4.
Claude-Session: https://claude.ai/code/session_015ur3i7D2azsMAWTSVABApv
NetBox is being deployed to k8s (argocd-apps) as the source of truth for
host/interface/IPAM data. Its image is ghcr.io/netbox-community/netbox, pulled
through the artifactapi ghcr mirror, so add the ^netbox-community/ pattern to
the ghcr remote allowlist.
Claude-Session: https://claude.ai/code/session_015ur3i7D2azsMAWTSVABApv
The puppet AlmaLinux hosts now consume a general rpm-vendor repo (alongside
the per-distro rpm-vendor-elN repos), mirroring the rpm-internal split. Add
the backing local rpm repo so the baseurl resolves.
- add config/local_rpm/rpm-vendor.yaml
Claude-Session: https://claude.ai/code/session_015ur3i7D2azsMAWTSVABApv
The VerticalPodAutoscaler rollout pulls registry.k8s.io/autoscaling/vpa-recommender.
Serve it through the existing k8s-registry pull-through cache, consistent with how
external-dns and sig-storage images from registry.k8s.io are already gated.
CI installed vault by shelling out to `dnf install vault -y`, which reads
metadata for every enabled repo (appstream/baseos/crb/epel/ha) and downloads
the 169MB vendored vault RPM from the unkin repo on every pipeline run
(~39s per plan/apply job).
- Replace the dnf install with a pinned curl of the upstream vault zip from
the artifactapi hashicorp-releases remote proxy, extracted with python3 to
/usr/local/bin/vault.
- Pin the version via a VAULT_VERSION env var (1.20.0).
The iplocate patterns were added to mutable_patterns only, which tags TTL but
does not allowlist — requests 403'd 'access denied'. Verified: existing
mutable_patterns-only paths (branch archives, webadmin) also 403, while patterns
entries (uv) return 200. Add the iplocate patterns to patterns (the allowlist),
keeping them in mutable_patterns so the daily-updated DB stays mutable.
Add patterns to the github.com generic remote for the iplocate ip-to-asn /
ip-to-country databases rather than standing up a new remote. The files are
Git-LFS, so the /raw/ path redirects to media.githubusercontent.com; the github
remote already follows github's cross-host redirects (as it does for release
assets), and the raw path returns the real bytes (verified: 12MB zip / 78MB mmdb).
Marked mutable (branch content).
2026-07-21 22:33:01 +10:00
17 changed files with 71 additions and 4 deletions
Blocking a user prevents them from interacting with repositories, such as opening or commenting on pull requests or issues. Learn more about blocking a user.
unkin-agent
benvin
benvin
unkinben