feat: manage local docker registries

ArtifactAPI now serves local docker repos as real container registries and the provider exposes an artifactapi_local_docker resource, but this config had no way to declare one. - Add a local_docker variable, module resource, config loader wiring, and terragrunt input, mirroring the other local_* kinds. - Declare a docker-internal registry. - Expand the README to cover the local_* and virtual kinds. Depends on a terraform-provider-artifactapi release exposing artifactapi_local_docker (and a matching .terraform.lock.hcl bump) before apply.
2026-07-05 17:08:31 +10:00
42 changed files with 24 additions and 121 deletions
@@ -7,9 +7,8 @@ steps:
    image: git.unkin.net/unkin/almalinux9-opentofu:20260606
    environment:
      VAULT_AUTH_METHOD: kubernetes
-      VAULT_VERSION: "1.20.0"
    commands:
-      - curl -fsSL -o /tmp/vault.zip "https://artifactapi.k8s.syd1.au.unkin.net/api/v1/remote/hashicorp-releases/vault/$${VAULT_VERSION}/vault_$${VAULT_VERSION}_linux_amd64.zip" && python3 -m zipfile -e /tmp/vault.zip /tmp/ && install -m0755 /tmp/vault /usr/local/bin/vault && rm -f /tmp/vault.zip /tmp/vault /tmp/LICENSE.txt
+      - dnf install vault -y
      - make plan
      - make apply
    backend_options:
@@ -6,9 +6,8 @@ steps:
    image: git.unkin.net/unkin/almalinux9-opentofu:20260606
    environment:
      VAULT_AUTH_METHOD: kubernetes
-      VAULT_VERSION: "1.20.0"
    commands:
-      - curl -fsSL -o /tmp/vault.zip "https://artifactapi.k8s.syd1.au.unkin.net/api/v1/remote/hashicorp-releases/vault/$${VAULT_VERSION}/vault_$${VAULT_VERSION}_linux_amd64.zip" && python3 -m zipfile -e /tmp/vault.zip /tmp/ && install -m0755 /tmp/vault /usr/local/bin/vault && rm -f /tmp/vault.zip /tmp/vault /tmp/LICENSE.txt
+      - dnf install vault -y
      - make plan
    backend_options:
      kubernetes:
@@ -21,7 +21,7 @@ init:

 plan: init
 	@$(call vault_env) && \
-	terragrunt run --all --parallelism 4 --non-interactive plan -- -lock=false
+	terragrunt run --all --parallelism 4 --non-interactive plan

 apply: init
 	@$(call vault_env) && \
@@ -62,11 +62,6 @@ locals {
      trimsuffix(basename(file_path), ".yaml") => content
      if startswith(file_path, "local_docker/")
    }
-    local_generic = {
-      for file_path, content in local.all_configs :
-      trimsuffix(basename(file_path), ".yaml") => content
-      if startswith(file_path, "local_generic/")
-    }
    virtual = {
      for file_path, content in local.all_configs :
      trimsuffix(basename(file_path), ".yaml") => content
@@ -1,2 +0,0 @@
---
-description: "Prebuilt node rootfs tarballs for bootapi image-based provisioning (almalinux9-node-*.tar.zst)"
@@ -1 +0,0 @@
-description: "Vendored third-party RPM packages for Enterprise Linux 8 (RHEL/AlmaLinux/Rocky 8), built by rpmbuilder"
@@ -1 +0,0 @@
-description: "Vendored third-party RPM packages for Enterprise Linux 9 (RHEL/AlmaLinux/Rocky 9), built by rpmbuilder"
@@ -1 +0,0 @@
-description: "Vendored third-party RPM packages for Fedora 42, built by rpmbuilder"
@@ -1 +0,0 @@
-description: "Vendored third-party RPM packages for Fedora 43, built by rpmbuilder"
@@ -1 +0,0 @@
-description: "Vendored third-party RPM packages for Fedora 44, built by rpmbuilder"
@@ -1 +0,0 @@
-description: "Vendored third-party RPM packages (distribution-agnostic)"
@@ -4,23 +4,18 @@ immutable_ttl: 0
 mutable_ttl: 300
 patterns:
  - "^alpine/"
-  - "^altinity/"
  - "^library/almalinux"
  - "^library/alpine"
  - "^library/busybox"
  - "^library/debian"
  - "^library/fedora"
-  - "^library/nats"
  - "^library/nginx"
  - "^library/postgres"
  - "^library/redis"
  - "^beats/filebeat"
  - "^bitnami/"
-  - "^clickhouse/"
  - "^curlimages/curl"
  - "^emberstack/kubernetes-reflector"
-  - "^gitea/gitea"
-  - "^grafana/"
  - "^hashicorp/consul"
  - "^hashicorp/vault"
  - "^intel/"
@@ -28,14 +23,10 @@ patterns:
  - "^jfrog/"
  - "^jpgouin/"
  - "^kanidm/"
-  - "^linuxserver/"
-  - "^natsio/"
-  - "^oliver006/redis_exporter"
  - "^osixia/"
  - "^rancher/"
  - "^rspamd/rspamd"
  - "^tiredofit/"
-  - "^timberio/vector"
  - "^tozd/postfix"
  - "^traefik/"
  - "^valkey/valkey"
@@ -3,18 +3,13 @@ description: GitHub Container Registry
 immutable_ttl: 0
 mutable_ttl: 300
 patterns:
-  - "^arabcoders/watchstate"
  - "^cloudnative-pg/"
  - "^dexidp/"
  - "^emberstack/helm-charts"
  - "^fallenbagel/"
  - "^goauthentik/"
-  - "^goodtune/ghp"
  - "^home-operations/"
  - "^jellyfin/"
-  - "^k8up-io/"
-  - "^netbox-community/"
-  - "^oauth2-proxy/"
  - "^onedr0p/"
  - "^open-webui/open-webui"
  - "^openvoxproject/"
@@ -22,6 +17,5 @@ patterns:
  - "^plexguide/"
  - "^stakater/reloader"
  - "^stalwartlabs/stalwart"
-  - "^valkey-io/"
  - "^voxpupuli/puppetboard"
  - "^woodpecker-ci/helm"
@@ -3,7 +3,5 @@ description: Kubernetes container registry
 immutable_ttl: 0
 mutable_ttl: 300
 patterns:
-  - "^autoscaling/vpa-"
  - "^external-dns/external-dns"
-  - "^kube-state-metrics/"
  - "^sig-storage/"
@@ -7,4 +7,3 @@ patterns:
  - "^brancz/kube-rbac-proxy"
  - "^cephcsi/cephcsi"
  - "^jetstack/cert-manager-"
-  - "^oauth2-proxy/"
@@ -5,12 +5,8 @@ mutable_ttl: 7200
 mutable_patterns:
  - ".*/archive/refs/heads/.*.tar.gz$"
  - "stalwartlabs/webadmin/releases/latest/download/webadmin.zip$"
-  # iplocate IP databases (Git-LFS; the /raw/ path redirects to the LFS media host).
-  - "iplocate/ip-address-databases/raw/.*/ip-to-asn/.*"
-  - "iplocate/ip-address-databases/raw/.*/ip-to-country/.*"
 patterns:
  - ".*/archive/refs/tags/.*.tar.gz$"
-  - "9p4/jellyfin-plugin-sso/.*/sso-authentication_.*.zip$"
  - "ahmetb/kubectx/.*/kubectx_.*_linux_x86_64.tar.gz$"
  - "ahmetb/kubectx/.*/kubens_.*_linux_x86_64.tar.gz$"
  - "apple/foundationdb/.*/libfdb_c.x86_64.so$"
@@ -29,15 +25,10 @@ patterns:
  - "hadolint/hadolint/.*/hadolint-linux-x86_64$"
  - "helmfile/helmfile/.*/helmfile_.*_linux_amd64.tar.gz$"
  - "helmfile/vals/.*/vals_.*_linux_amd64.tar.gz$"
-  # iplocate IP databases (also in mutable_patterns so the daily-updated branch
-  # content is re-checked rather than cached immutably).
-  - "iplocate/ip-address-databases/raw/.*/ip-to-asn/.*"
-  - "iplocate/ip-address-databases/raw/.*/ip-to-country/.*"
  - "jesseduffield/lazydocker/.*/lazydocker_.*_Linux_x86_64.tar.gz$"
  - "kubecolor/kubecolor/.*/kubecolor_.*_linux_amd64.tar.gz$"
  - "kubernetes-sigs/gateway-api/.*/standard-install.yaml$"
  - "kubernetes-sigs/kustomize/.*/kustomize_.*_linux_amd64.tar.gz$"
-  - "kubernetes/autoscaler/raw/.*/vertical-pod-autoscaler/deploy/vpa-v1-crd-gen.yaml$"
  - "lxc/incus/.*.tar.gz$"
  - "mikefarah/yq/.*/yq_linux_amd64$"
  - "neovim/neovim-releases/.*/nvim-linux-x86_64.tar.gz$"
@@ -1,6 +0,0 @@
-base_url: https://repo.jellyfin.org
-description: Jellyfin official plugin repository
-immutable_ttl: 0
-mutable_ttl: 7200
-patterns:
-  - "files/plugin/ldap-authentication/ldap-authentication_.*.zip$"
@@ -1,7 +0,0 @@
-base_url: https://k8up-io.github.io/k8up
-description: K8up backup operator Helm charts
-immutable_ttl: 0
-mutable_ttl: 3600
-check_mutable: true
-immutable_patterns:
-  - "\\.tgz$"
@@ -1,7 +0,0 @@
-base_url: https://valkey.io/valkey-helm
-description: Valkey Helm charts (valkey-operator)
-immutable_ttl: 0
-mutable_ttl: 3600
-check_mutable: true
-immutable_patterns:
-  - "\\.tgz$"
@@ -5,6 +5,9 @@ mutable_ttl: 7200
 immutable_patterns:
  - ".*/x86_64/.*\\.rpm$"
  - ".*/noarch/.*\\.rpm$"
+  - ".*/repodata/.*\\.sqlite.*$"
+  - ".*/repodata/.*\\.xml.*$"
+  - ".*/repodata/.*\\.yaml.*$"
  - ".*/install.img"
  - ".*/squashfs.img"
  - ".*/updates.img"
@@ -5,6 +5,9 @@ mutable_ttl: 7200
 immutable_patterns:
  - ".*/x86_64/.*\\.rpm$"
  - ".*/noarch/.*\\.rpm$"
+  - ".*/repodata/.*\\.sqlite.*$"
+  - ".*/repodata/.*\\.xml.*$"
+  - ".*/repodata/.*\\.yaml.*$"
  - ".*/install.img"
  - ".*/squashfs.img"
  - ".*/updates.img"
@@ -5,3 +5,4 @@ mutable_ttl: 7200
 immutable_patterns:
  - ".*/x86_64/.*\\.rpm$"
  - ".*/noarch/.*\\.rpm$"
+  - ".*/repodata/.*\\.xml.*$"
@@ -5,3 +5,4 @@ mutable_ttl: 7200
 immutable_patterns:
  - ".*/x86_64/.*\\.rpm$"
  - ".*/noarch/.*\\.rpm$"
+  - ".*/repodata/.*\\.xml.*$"
@@ -5,3 +5,4 @@ mutable_ttl: 7200
 immutable_patterns:
  - ".*/x86_64/.*\\.rpm$"
  - ".*/noarch/.*\\.rpm$"
+  - ".*/repodata/.*\\.xml.*$"
@@ -3,3 +3,4 @@ description: "Claude Code RPM repository"
 immutable_patterns:
  - ".*/x86_64/.*\\.rpm$"
  - ".*/noarch/.*\\.rpm$"
+  - ".*/repodata/.*\\.xml.*$"
@@ -5,4 +5,7 @@ mutable_ttl: 7200
 immutable_patterns:
  - ".*/Everything/x86_64/.*\\.rpm$"
  - ".*/noarch/.*\\.rpm$"
+  - ".*/repodata/.*\\.sqlite.*$"
+  - ".*/repodata/.*\\.xml.*$"
+  - ".*/repodata/.*\\.yaml.*$"
  - "RPM-GPG-KEY-.*$"
@@ -1,8 +0,0 @@
-base_url: https://archive.fedoraproject.org/pub/archive/fedora/linux
-description: Fedora Linux archive mirror for EOL releases (e.g. F42); content is frozen upstream
-immutable_ttl: 0
-mutable_ttl: 86400
-immutable_patterns:
-  - "releases/.*/Everything/x86_64/.*\\.rpm$"
-  - "updates/.*/Everything/x86_64/.*\\.rpm$"
-  - ".*/noarch/.*\\.rpm$"
@@ -7,3 +7,4 @@ immutable_patterns:
  - "updates/.*/Everything/x86_64/.*\\.rpm$"
  - "development/.*/Everything/x86_64/.*\\.rpm$"
  - ".*/noarch/.*\\.rpm$"
+  - ".*/repodata/.*\\.xml.*$"
@@ -4,3 +4,4 @@ immutable_ttl: 0
 mutable_ttl: 7200
 immutable_patterns:
  - ".*\\.rpm$"
+  - ".*/repodata/.*\\.xml.*$"
@@ -1,7 +0,0 @@
-base_url: "https://pkgs.k8s.io/core:/stable:"
-description: Kubernetes upstream RPMs (kubectl/kubeadm/kubelet); version-agnostic, consumers pick the minor via path (e.g. v1.33/rpm)
-immutable_ttl: 0
-mutable_ttl: 7200
-immutable_patterns:
-  - ".*\\.rpm$"
-  - "repodata/[a-f0-9]{16,}-.*$"
@@ -4,4 +4,5 @@ immutable_ttl: 0
 mutable_ttl: 7200
 immutable_patterns:
  - ".*\\.rpm$"
+  - ".*/repodata/.*\\.xml.*$"
  - ".*/RPM-GPG-KEY-.*$"
@@ -4,4 +4,5 @@ immutable_ttl: 0
 mutable_ttl: 7200
 immutable_patterns:
  - ".*\\.rpm$"
+  - ".*/repodata/.*\\.xml.*$"
  - "GPG-KEY-.*$"
@@ -4,5 +4,6 @@ immutable_ttl: 0
 mutable_ttl: 7200
 immutable_patterns:
  - ".*\\.rpm$"
+  - ".*/repodata/.*\\.xml.*$"
  - ".*/RPM-GPG-KEY-.*$"
  - ".*/PGDG-RPM-GPG-KEY-.*$"
@@ -4,4 +4,5 @@ immutable_ttl: 0
 mutable_ttl: 7200
 immutable_patterns:
  - ".*\\.rpm$"
+  - ".*/repodata/.*\\.xml.*$"
  - "public.key$"
@@ -1,7 +0,0 @@
-base_url: https://download1.rpmfusion.org/free
-description: RPM Fusion free RPM package repository
-immutable_ttl: 0
-mutable_ttl: 7200
-immutable_patterns:
-  - ".*\\.rpm$"
-  - "RPM-GPG-KEY-.*$"
@@ -1,7 +0,0 @@
-base_url: https://download1.rpmfusion.org/nonfree
-description: RPM Fusion nonfree RPM package repository
-immutable_ttl: 0
-mutable_ttl: 7200
-immutable_patterns:
-  - ".*\\.rpm$"
-  - "RPM-GPG-KEY-.*$"
@@ -4,3 +4,4 @@ immutable_ttl: 0
 mutable_ttl: 7200
 immutable_patterns:
  - ".*\\.rpm$"
+  - ".*/repodata/.*\\.xml.*$"
@@ -10,11 +10,9 @@ members:
  - hashicorp-helm
  - intel-helm
  - jetstack
-  - k8up
  - purelb
  - rancher-stable
  - stakater
  - traefik
-  - valkey
  - victoriametrics
  - argo-helm
@@ -28,6 +28,5 @@ inputs = {
  local_pypi      = local.config.local_pypi
  local_rpm       = local.config.local_rpm
  local_docker    = local.config.local_docker
-  local_generic   = local.config.local_generic
  virtual         = local.config.virtual
 }
@@ -9,8 +9,6 @@ resource "artifactapi_remote_alpine" "this" {
  immutable_patterns = each.value.immutable_patterns
  mutable_patterns   = each.value.mutable_patterns
  stale_on_error     = each.value.stale_on_error
-  mirrorlist         = each.value.mirrorlist
-  mirror_strategy    = each.value.mirror_strategy
 }

 resource "artifactapi_remote_docker" "this" {
@@ -76,8 +74,6 @@ resource "artifactapi_remote_rpm" "this" {
  immutable_patterns = each.value.immutable_patterns
  mutable_patterns   = each.value.mutable_patterns
  stale_on_error     = each.value.stale_on_error
-  mirrorlist         = each.value.mirrorlist
-  mirror_strategy    = each.value.mirror_strategy
 }

 resource "artifactapi_remote_pypi" "this" {
@@ -121,13 +117,6 @@ resource "artifactapi_local_docker" "this" {
  description = each.value.description
 }

-resource "artifactapi_local_generic" "this" {
-  for_each = var.local_generic
-
-  name        = each.key
-  description = each.value.description
-}
-
 resource "artifactapi_virtual" "this" {
  for_each = var.virtual

@@ -8,8 +8,6 @@ variable "remote_alpine" {
    immutable_patterns = optional(list(string), [])
    mutable_patterns   = optional(list(string), [])
    stale_on_error     = optional(bool, true)
-    mirrorlist         = optional(list(string), [])
-    mirror_strategy    = optional(string, null)
  }))
  default = {}
 }
@@ -80,8 +78,6 @@ variable "remote_rpm" {
    immutable_patterns = optional(list(string), [])
    mutable_patterns   = optional(list(string), [])
    stale_on_error     = optional(bool, true)
-    mirrorlist         = optional(list(string), [])
-    mirror_strategy    = optional(string, null)
  }))
  default = {}
 }
@@ -116,14 +112,6 @@ variable "local_rpm" {
  default = {}
 }

-variable "local_generic" {
-  description = "Map of local generic (raw-file) repositories"
-  type = map(object({
-    description = optional(string, "")
-  }))
-  default = {}
-}
-
 variable "local_terraform" {
  description = "Map of local Terraform repositories"
  type = map(object({
@@ -3,7 +3,7 @@ terraform {
  required_providers {
    artifactapi = {
      source  = "artifactapi.k8s.syd1.au.unkin.net/terraform-unkin/artifactapi"
-      version = "~> 0.5"
+      version = "== 0.1.3"
    }
  }
 }
				`@@ -1 +0,0 @@`
				`description: "Vendored third-party RPM packages for Enterprise Linux 8 (RHEL/AlmaLinux/Rocky 8), built by rpmbuilder"`