feat: manage local docker registries

ArtifactAPI now serves local docker repos as real container registries and the
provider exposes an artifactapi_local_docker resource, but this config had no
way to declare one.

- Add a local_docker variable, module resource, config loader wiring, and
  terragrunt input, mirroring the other local_* kinds.
- Declare a docker-internal registry.
- Expand the README to cover the local_* and virtual kinds.

Depends on a terraform-provider-artifactapi release exposing
artifactapi_local_docker (and a matching .terraform.lock.hcl bump) before apply.

README.md

@@ -1,3 +1,11 @@
 # terraform-artifactapi
 
-Terraform configuration for managing ArtifactAPI remote and virtual repositories
+Terraform configuration for managing ArtifactAPI remote, local, and virtual repositories.
+
+Repositories are declared as YAML files under `config/<kind>/<name>.yaml`, where the
+filename is the repository name. `make plan` / `make apply` (via Terragrunt) reconcile
+them against the ArtifactAPI instance.
+
+Kinds: `remote_*` (caching proxies of an upstream), `local_*` (real registries hosted
+directly — `local_docker`, `local_pypi`, `local_rpm`, `local_terraform`), and `virtual`
+(merged views over members of one package type).

config/config.hcl

@@ -57,6 +57,11 @@ locals {
       trimsuffix(basename(file_path), ".yaml") => content
       if startswith(file_path, "local_rpm/")
     }
+    local_docker = {
+      for file_path, content in local.all_configs :
+      trimsuffix(basename(file_path), ".yaml") => content
+      if startswith(file_path, "local_docker/")
+    }
     virtual = {
       for file_path, content in local.all_configs :
       trimsuffix(basename(file_path), ".yaml") => content

config/local_docker/docker-internal.yaml

@@ -0,0 +1 @@
+description: "Internal container image registry"

config/local_rpm/rpm-internal-el10.yaml

@@ -0,0 +1 @@
+description: "Internal RPM packages for Enterprise Linux 10 (RHEL/AlmaLinux/Rocky 10)"

config/local_rpm/rpm-internal-el8.yaml

@@ -0,0 +1 @@
+description: "Internal RPM packages for Enterprise Linux 8 (RHEL/AlmaLinux/Rocky 8)"

config/local_rpm/rpm-internal-el9.yaml

@@ -0,0 +1 @@
+description: "Internal RPM packages for Enterprise Linux 9 (RHEL/AlmaLinux/Rocky 9)"

config/local_rpm/rpm-internal-f42.yaml

@@ -0,0 +1 @@
+description: "Internal RPM packages for Fedora 42"

config/local_rpm/rpm-internal-f43.yaml

@@ -0,0 +1 @@
+description: "Internal RPM packages for Fedora 43"

config/local_rpm/rpm-internal-f44.yaml

@@ -0,0 +1 @@
+description: "Internal RPM packages for Fedora 44"

config/local_rpm/rpm-internal.yaml

@@ -1 +1 @@
-description: "Internal RPM packages"
+description: "Internal RPM packages (distribution-agnostic)"

config/remote_docker/dockerhub.yaml

@@ -3,7 +3,9 @@ description: Docker Hub registry
 immutable_ttl: 0
 mutable_ttl: 300
 patterns:
+  - "^alpine/"
   - "^library/almalinux"
+  - "^library/alpine"
   - "^library/busybox"
   - "^library/debian"
   - "^library/fedora"
@@ -16,10 +18,15 @@ patterns:
   - "^emberstack/kubernetes-reflector"
   - "^hashicorp/consul"
   - "^hashicorp/vault"
+  - "^intel/"
+  - "^internetsystemsconsortium/bind9"
   - "^jfrog/"
+  - "^jpgouin/"
   - "^kanidm/"
+  - "^osixia/"
   - "^rancher/"
   - "^rspamd/rspamd"
+  - "^tiredofit/"
   - "^tozd/postfix"
   - "^traefik/"
   - "^valkey/valkey"

config/remote_docker/ecr-public.yaml

@@ -0,0 +1,6 @@
+base_url: https://public.ecr.aws
+description: Amazon ECR Public registry
+immutable_ttl: 0
+mutable_ttl: 300
+patterns:
+  - "^docker/library/"

config/remote_docker/ghcr.yaml

@@ -3,10 +3,18 @@ description: GitHub Container Registry
 immutable_ttl: 0
 mutable_ttl: 300
 patterns:
-  - "^cloudnative-pg/cloudnative-pg"
+  - "^cloudnative-pg/"
+  - "^dexidp/"
   - "^emberstack/helm-charts"
+  - "^fallenbagel/"
+  - "^goauthentik/"
+  - "^home-operations/"
+  - "^jellyfin/"
+  - "^onedr0p/"
   - "^open-webui/open-webui"
   - "^openvoxproject/"
+  - "^paperclipai/"
+  - "^plexguide/"
   - "^stakater/reloader"
   - "^stalwartlabs/stalwart"
   - "^voxpupuli/puppetboard"

config/remote_docker/litellm.yaml

@@ -0,0 +1,6 @@
+base_url: https://docker.litellm.ai
+description: LiteLLM container registry
+immutable_ttl: 0
+mutable_ttl: 300
+patterns:
+  - "^berriai/"

config/remote_docker/quay.yaml

@@ -3,6 +3,7 @@ description: Quay.io container registry
 immutable_ttl: 0
 mutable_ttl: 300
 patterns:
+  - "^argoproj/"
   - "^brancz/kube-rbac-proxy"
   - "^cephcsi/cephcsi"
   - "^jetstack/cert-manager-"

config/remote_generic/github_user.yaml

@@ -4,5 +4,6 @@ immutable_ttl: 0
 mutable_ttl: 7200
 patterns:
   - "argoproj/argo-cd/.*.yaml$"
-  - "yannh/kubernetes-json-schema/master/.*.json$"
   - "datreeio/CRDs-catalog/main/.*.json$"
+  - "kubernetes/kubernetes/.*.json$"
+  - "yannh/kubernetes-json-schema/master/.*.json$"

config/remote_helm/authentik.yaml

@@ -0,0 +1,7 @@
+base_url: https://charts.goauthentik.io
+description: Authentik Charts
+immutable_ttl: 0
+mutable_ttl: 3600
+check_mutable: true
+immutable_patterns:
+  - "\\.tgz$"

config/remote_helm/grafana.yaml

@@ -0,0 +1,7 @@
+base_url: https://grafana.github.io/helm-charts
+description: Grafana Helm charts
+immutable_ttl: 0
+mutable_ttl: 3600
+check_mutable: true
+immutable_patterns:
+  - "\\.tgz$"

config/remote_rpm/claude-code.yaml

@@ -0,0 +1,6 @@
+base_url: "https://downloads.claude.ai/claude-code/rpm/stable"
+description: "Claude Code RPM repository"
+immutable_patterns:
+  - ".*/x86_64/.*\\.rpm$"
+  - ".*/noarch/.*\\.rpm$"
+  - ".*/repodata/.*\\.xml.*$"

config/virtual/helm.yaml

@@ -1,10 +1,12 @@
 package_type: helm
 description: "Virtual repository merging all helm remotes — member order is priority order for duplicate chart+version"
 members:
+  - authentik
   - ceph-csi
   - cnpg
   - elastic-helm
   - external-dns
+  - grafana
   - hashicorp-helm
   - intel-helm
   - jetstack

environments/artifactapi.k8s.syd1.au.unkin.net/terragrunt.hcl

@@ -13,7 +13,7 @@ locals {
 }
 
 terraform {
-  source = "../../../modules/artifactapi"
+  source = "../../modules/artifactapi"
 }
 
 inputs = {
@@ -27,5 +27,6 @@ inputs = {
   local_terraform = local.config.local_terraform
   local_pypi      = local.config.local_pypi
   local_rpm       = local.config.local_rpm
+  local_docker    = local.config.local_docker
   virtual         = local.config.virtual
 }

environments/root.hcl

@@ -3,7 +3,7 @@ generate "backend" {
   if_exists = "overwrite"
   contents  = <<EOF
 provider "artifactapi" {
-  endpoint = "https://artifactapi.k8s.syd1.au.unkin.net"
+  endpoint = "https://${path_relative_to_include()}"
 }
 
 terraform {
@@ -15,12 +15,6 @@ terraform {
     ca_file = "/etc/pki/tls/certs/ca-bundle.crt"
   }
   required_version = ">= 1.10"
-  required_providers {
-    artifactapi = {
-      source  = "git.unkin.net/unkin/artifactapi"
-      version = "0.0.1"
-    }
-  }
 }
 EOF
 }

modules/artifactapi/main.tf

@@ -110,6 +110,13 @@ resource "artifactapi_local_rpm" "this" {
   description = each.value.description
 }
 
+resource "artifactapi_local_docker" "this" {
+  for_each = var.local_docker
+
+  name        = each.key
+  description = each.value.description
+}
+
 resource "artifactapi_virtual" "this" {
   for_each = var.virtual
 

modules/artifactapi/variables.tf

@@ -96,14 +96,6 @@ variable "remote_pypi" {
   default = {}
 }
 
-variable "local_terraform" {
-  description = "Map of local Terraform registry repositories"
-  type = map(object({
-    description = optional(string, "")
-  }))
-  default = {}
-}
-
 variable "local_pypi" {
   description = "Map of local PyPI repositories"
   type = map(object({
@@ -120,6 +112,22 @@ variable "local_rpm" {
   default = {}
 }
 
+variable "local_terraform" {
+  description = "Map of local Terraform repositories"
+  type = map(object({
+    description = optional(string, "")
+  }))
+  default = {}
+}
+
+variable "local_docker" {
+  description = "Map of local Docker repositories (real container registries)"
+  type = map(object({
+    description = optional(string, "")
+  }))
+  default = {}
+}
+
 variable "virtual" {
   description = "Map of virtual repositories"
   type = map(object({

modules/artifactapi/versions.tf

@@ -0,0 +1,9 @@
+terraform {
+  required_version = ">= 1.10"
+  required_providers {
+    artifactapi = {
+      source  = "artifactapi.k8s.syd1.au.unkin.net/terraform-unkin/artifactapi"
+      version = "0.1.3"
+    }
+  }
+}