feat: add artifactapi_local_docker resource

The artifactapi server now serves local docker repos as real container
registries, but the provider had no resource to declare one — only remote
docker proxies and local terraform/pypi/rpm repos.

- Add the artifactapi_local_docker resource (package_type=docker,
  repo_type=local), mirroring the other local resources: name + description,
  managed via /api/v2/remotes.
- Register it in the provider and update the resource-count/type tests.
- Add unit tests, an example, and a Local Resources section to the README.

.woodpecker/build.yml

@@ -6,3 +6,13 @@ steps:
     image: golang:1.25
     commands:
       - make build
+    backend_options:
+      kubernetes:
+        serviceAccountName: default
+        resources:
+          requests:
+            memory: 512Mi
+            cpu: 1
+          limits:
+            memory: 2Gi
+            cpu: 2

.woodpecker/release.yml

@@ -6,6 +6,16 @@ steps:
     image: git.unkin.net/unkin/almalinux9-gobuilder:20260606
     commands:
       - make package VERSION=${CI_COMMIT_TAG}
+    backend_options:
+      kubernetes:
+        serviceAccountName: default
+        resources:
+          requests:
+            memory: 512Mi
+            cpu: 1
+          limits:
+            memory: 2Gi
+            cpu: 2
 
   - name: upload
     image: git.unkin.net/unkin/almalinux9-base:20260606
@@ -14,6 +24,17 @@ steps:
         VERSION=$$(echo ${CI_COMMIT_TAG} | sed 's/^v//')
         FILE="terraform-provider-artifactapi_$${VERSION}_linux_amd64.zip"
         curl -f -X PUT \
-          "https://artifactapi3.k8s.syd1.au.unkin.net/api/v2/remotes/terraform-unkin/files/unkin/artifactapi/$${FILE}" \
+          "https://artifactapi.k8s.syd1.au.unkin.net/api/v2/remotes/terraform-unkin/files/unkin/artifactapi/$${FILE}" \
           -H "Content-Type: application/zip" \
           --data-binary @"$${FILE}"
+    depends_on: [package]
+    backend_options:
+      kubernetes:
+        serviceAccountName: default
+        resources:
+          requests:
+            memory: 128Mi
+            cpu: 100m
+          limits:
+            memory: 512Mi
+            cpu: 500m

.woodpecker/test.yml

@@ -6,8 +6,28 @@ steps:
     image: golang:1.25
     commands:
       - make lint
+    backend_options:
+      kubernetes:
+        serviceAccountName: default
+        resources:
+          requests:
+            memory: 512Mi
+            cpu: 1
+          limits:
+            memory: 2Gi
+            cpu: 2
 
   - name: test
     image: golang:1.25
     commands:
       - make test
+    backend_options:
+      kubernetes:
+        serviceAccountName: default
+        resources:
+          requests:
+            memory: 512Mi
+            cpu: 1
+          limits:
+            memory: 2Gi
+            cpu: 2

README.md

@@ -118,6 +118,31 @@ resource "artifactapi_remote_docker" "dockerhub" {
 }
 ```
 
+### Local Resources
+
+Local resources manage repositories that ArtifactAPI hosts directly (rather than
+proxying an upstream) — each is a real registry for its package type.
+
+Available resource types:
+
+- `artifactapi_local_docker` — a container registry (Docker Registry HTTP API V2, push and pull)
+- `artifactapi_local_pypi`
+- `artifactapi_local_rpm`
+- `artifactapi_local_terraform`
+
+Each takes just `name` (required, forces replacement) and an optional
+`description`.
+
+```hcl
+resource "artifactapi_local_docker" "internal" {
+  name        = "docker-internal"
+  description = "Internal container image registry"
+}
+```
+
+Images push and pull against `<endpoint>/<name>/<image>:<tag>`, e.g.
+`docker push artifactapi.example.com/docker-internal/myapp:latest`.
+
 ### Virtual Resources
 
 Virtual repositories merge multiple remotes of the same package type into a single endpoint.

examples/resources/artifactapi_local_docker/main.tf

@@ -0,0 +1,4 @@
+resource "artifactapi_local_docker" "internal" {
+  name        = "docker-internal"
+  description = "Internal container image registry"
+}

internal/provider/provider.go

@@ -71,6 +71,7 @@ func (p *ArtifactAPIProvider) Resources(_ context.Context) []func() resource.Res
 		NewLocalTerraformResource,
 		NewLocalPyPIResource,
 		NewLocalRPMResource,
+		NewLocalDockerResource,
 	}
 }
 

internal/provider/provider_test.go

@@ -66,8 +66,8 @@ func TestProvider_Resources(t *testing.T) {
 	p := &ArtifactAPIProvider{version: "1.0.0"}
 	resources := p.Resources(context.Background())
 
-	// 10 remote resource types + 1 virtual + 1 local_terraform + 1 local_pypi + 1 local_rpm = 14
+	// 10 remote resource types + 1 virtual + 1 local_terraform + 1 local_pypi + 1 local_rpm + 1 local_docker = 15
-	expectedCount := 14
+	expectedCount := 15
 	if len(resources) != expectedCount {
 		t.Fatalf("expected %d resources, got %d", expectedCount, len(resources))
 	}
@@ -110,6 +110,7 @@ func TestProvider_Resources_ContainsExpectedTypes(t *testing.T) {
 		"artifactapi_local_terraform",
 		"artifactapi_local_pypi",
 		"artifactapi_local_rpm",
+		"artifactapi_local_docker",
 	}
 
 	for _, name := range expected {

internal/provider/resource_local_docker.go

@@ -0,0 +1,164 @@
+package provider
+
+import (
+	"context"
+	"fmt"
+
+	"github.com/hashicorp/terraform-plugin-framework/path"
+	"github.com/hashicorp/terraform-plugin-framework/resource"
+	"github.com/hashicorp/terraform-plugin-framework/resource/schema"
+	"github.com/hashicorp/terraform-plugin-framework/resource/schema/planmodifier"
+	"github.com/hashicorp/terraform-plugin-framework/resource/schema/stringdefault"
+	"github.com/hashicorp/terraform-plugin-framework/resource/schema/stringplanmodifier"
+	"github.com/hashicorp/terraform-plugin-framework/types"
+)
+
+var (
+	_ resource.Resource                = &localDockerResource{}
+	_ resource.ResourceWithImportState = &localDockerResource{}
+)
+
+type localDockerResource struct {
+	client *apiClient
+}
+
+type localDockerResourceModel struct {
+	Name        types.String `tfsdk:"name"`
+	Description types.String `tfsdk:"description"`
+}
+
+func NewLocalDockerResource() resource.Resource {
+	return &localDockerResource{}
+}
+
+func (r *localDockerResource) Metadata(_ context.Context, req resource.MetadataRequest, resp *resource.MetadataResponse) {
+	resp.TypeName = req.ProviderTypeName + "_local_docker"
+}
+
+func (r *localDockerResource) Schema(_ context.Context, _ resource.SchemaRequest, resp *resource.SchemaResponse) {
+	resp.Schema = schema.Schema{
+		Description: "Manages a local ArtifactAPI Docker repository — a real container registry serving the Docker Registry HTTP API V2 for push and pull.",
+		Attributes: map[string]schema.Attribute{
+			"name": schema.StringAttribute{
+				Description: "Unique name of the local Docker repository. Becomes the first path segment of pushed image references (e.g. <endpoint>/<name>/<image>:<tag>).",
+				Required:    true,
+				PlanModifiers: []planmodifier.String{
+					stringplanmodifier.RequiresReplace(),
+				},
+			},
+			"description": schema.StringAttribute{
+				Description: "Human-readable description.",
+				Optional:    true,
+				Computed:    true,
+				Default:     stringdefault.StaticString(""),
+			},
+		},
+	}
+}
+
+func (r *localDockerResource) Configure(_ context.Context, req resource.ConfigureRequest, resp *resource.ConfigureResponse) {
+	if req.ProviderData == nil {
+		return
+	}
+	client, ok := req.ProviderData.(*apiClient)
+	if !ok {
+		resp.Diagnostics.AddError("unexpected provider data type", fmt.Sprintf("got %T", req.ProviderData))
+		return
+	}
+	r.client = client
+}
+
+func (r *localDockerResource) Create(ctx context.Context, req resource.CreateRequest, resp *resource.CreateResponse) {
+	var plan localDockerResourceModel
+	resp.Diagnostics.Append(req.Plan.Get(ctx, &plan)...)
+	if resp.Diagnostics.HasError() {
+		return
+	}
+
+	api := localDockerModelToAPI(plan)
+	api.ManagedBy = "terraform"
+
+	var created remoteAPI
+	if err := r.client.post(ctx, "/api/v2/remotes", api, &created); err != nil {
+		resp.Diagnostics.AddError("create local docker failed", err.Error())
+		return
+	}
+
+	state := localDockerAPIToModel(created)
+	resp.Diagnostics.Append(resp.State.Set(ctx, state)...)
+}
+
+func (r *localDockerResource) Read(ctx context.Context, req resource.ReadRequest, resp *resource.ReadResponse) {
+	var state localDockerResourceModel
+	resp.Diagnostics.Append(req.State.Get(ctx, &state)...)
+	if resp.Diagnostics.HasError() {
+		return
+	}
+
+	var remote remoteAPI
+	err := r.client.get(ctx, "/api/v2/remotes/"+state.Name.ValueString(), &remote)
+	if err != nil {
+		if isNotFound(err) {
+			resp.State.RemoveResource(ctx)
+			return
+		}
+		resp.Diagnostics.AddError("read local docker failed", err.Error())
+		return
+	}
+
+	newState := localDockerAPIToModel(remote)
+	resp.Diagnostics.Append(resp.State.Set(ctx, newState)...)
+}
+
+func (r *localDockerResource) Update(ctx context.Context, req resource.UpdateRequest, resp *resource.UpdateResponse) {
+	var plan localDockerResourceModel
+	resp.Diagnostics.Append(req.Plan.Get(ctx, &plan)...)
+	if resp.Diagnostics.HasError() {
+		return
+	}
+
+	api := localDockerModelToAPI(plan)
+	api.ManagedBy = "terraform"
+
+	var updated remoteAPI
+	if err := r.client.put(ctx, "/api/v2/remotes/"+plan.Name.ValueString(), api, &updated); err != nil {
+		resp.Diagnostics.AddError("update local docker failed", err.Error())
+		return
+	}
+
+	state := localDockerAPIToModel(updated)
+	resp.Diagnostics.Append(resp.State.Set(ctx, state)...)
+}
+
+func (r *localDockerResource) Delete(ctx context.Context, req resource.DeleteRequest, resp *resource.DeleteResponse) {
+	var state localDockerResourceModel
+	resp.Diagnostics.Append(req.State.Get(ctx, &state)...)
+	if resp.Diagnostics.HasError() {
+		return
+	}
+
+	if err := r.client.del(ctx, "/api/v2/remotes/"+state.Name.ValueString()); err != nil {
+		resp.Diagnostics.AddError("delete local docker failed", err.Error())
+		return
+	}
+}
+
+func (r *localDockerResource) ImportState(ctx context.Context, req resource.ImportStateRequest, resp *resource.ImportStateResponse) {
+	resource.ImportStatePassthroughID(ctx, path.Root("name"), req, resp)
+}
+
+func localDockerModelToAPI(m localDockerResourceModel) remoteAPI {
+	return remoteAPI{
+		Name:        m.Name.ValueString(),
+		PackageType: "docker",
+		RepoType:    "local",
+		Description: m.Description.ValueString(),
+	}
+}
+
+func localDockerAPIToModel(api remoteAPI) localDockerResourceModel {
+	return localDockerResourceModel{
+		Name:        types.StringValue(api.Name),
+		Description: types.StringValue(api.Description),
+	}
+}

internal/provider/resource_local_docker_test.go

@@ -0,0 +1,125 @@
+package provider
+
+import (
+	"context"
+	"testing"
+
+	"github.com/hashicorp/terraform-plugin-framework/resource"
+	"github.com/hashicorp/terraform-plugin-framework/types"
+)
+
+func TestLocalDockerModelToAPI(t *testing.T) {
+	model := localDockerResourceModel{
+		Name:        types.StringValue("docker-internal"),
+		Description: types.StringValue("Internal container registry"),
+	}
+
+	api := localDockerModelToAPI(model)
+
+	if api.Name != "docker-internal" {
+		t.Errorf("Name: expected docker-internal, got %s", api.Name)
+	}
+	if api.PackageType != "docker" {
+		t.Errorf("PackageType: expected docker, got %s", api.PackageType)
+	}
+	if api.RepoType != "local" {
+		t.Errorf("RepoType: expected local, got %s", api.RepoType)
+	}
+	if api.Description != "Internal container registry" {
+		t.Errorf("Description: expected 'Internal container registry', got %s", api.Description)
+	}
+}
+
+func TestLocalDockerModelToAPI_EmptyDescription(t *testing.T) {
+	model := localDockerResourceModel{
+		Name:        types.StringValue("docker-empty"),
+		Description: types.StringValue(""),
+	}
+
+	api := localDockerModelToAPI(model)
+
+	if api.Name != "docker-empty" {
+		t.Errorf("Name: expected docker-empty, got %s", api.Name)
+	}
+	if api.Description != "" {
+		t.Errorf("Description: expected empty string, got %s", api.Description)
+	}
+	if api.PackageType != "docker" {
+		t.Errorf("PackageType: expected docker, got %s", api.PackageType)
+	}
+	if api.RepoType != "local" {
+		t.Errorf("RepoType: expected local, got %s", api.RepoType)
+	}
+}
+
+func TestLocalDockerAPIToModel(t *testing.T) {
+	api := remoteAPI{
+		Name:        "docker-internal",
+		PackageType: "docker",
+		RepoType:    "local",
+		Description: "Internal container registry",
+		ManagedBy:   "terraform",
+	}
+
+	model := localDockerAPIToModel(api)
+
+	if model.Name.ValueString() != "docker-internal" {
+		t.Errorf("Name: expected docker-internal, got %s", model.Name.ValueString())
+	}
+	if model.Description.ValueString() != "Internal container registry" {
+		t.Errorf("Description: expected 'Internal container registry', got %s", model.Description.ValueString())
+	}
+}
+
+func TestLocalDockerRoundTrip(t *testing.T) {
+	original := localDockerResourceModel{
+		Name:        types.StringValue("roundtrip-docker"),
+		Description: types.StringValue("Round trip test"),
+	}
+
+	api := localDockerModelToAPI(original)
+	result := localDockerAPIToModel(api)
+
+	if result.Name.ValueString() != original.Name.ValueString() {
+		t.Errorf("Name: expected %s, got %s", original.Name.ValueString(), result.Name.ValueString())
+	}
+	if result.Description.ValueString() != original.Description.ValueString() {
+		t.Errorf("Description: expected %s, got %s", original.Description.ValueString(), result.Description.ValueString())
+	}
+}
+
+func TestLocalDockerResource_Metadata(t *testing.T) {
+	r := NewLocalDockerResource()
+	req := resource.MetadataRequest{ProviderTypeName: "artifactapi"}
+	var resp resource.MetadataResponse
+	r.Metadata(context.Background(), req, &resp)
+	if resp.TypeName != "artifactapi_local_docker" {
+		t.Errorf("expected artifactapi_local_docker, got %s", resp.TypeName)
+	}
+}
+
+func TestLocalDockerResource_Schema(t *testing.T) {
+	r := NewLocalDockerResource()
+	req := resource.SchemaRequest{}
+	var resp resource.SchemaResponse
+	r.Schema(context.Background(), req, &resp)
+
+	expectedAttrs := []string{"name", "description"}
+	for _, attr := range expectedAttrs {
+		if _, ok := resp.Schema.Attributes[attr]; !ok {
+			t.Errorf("missing expected attribute: %s", attr)
+		}
+	}
+
+	if len(resp.Schema.Attributes) != len(expectedAttrs) {
+		t.Errorf("expected %d attributes, got %d", len(expectedAttrs), len(resp.Schema.Attributes))
+	}
+}
+
+func TestNewLocalDockerResource_Type(t *testing.T) {
+	r := NewLocalDockerResource()
+	_, ok := r.(*localDockerResource)
+	if !ok {
+		t.Error("expected *localDockerResource")
+	}
+}