panxiao81/homelab-infra
1
0
Fork 0
Code Issues 10 Pull Requests Actions Packages Projects Releases Wiki Activity

纳管并验收 Nexus OCI 仓库 #109

Merged
panxiao81 merged 1 commits from feat/nexus-oci-poc into main 2026-09-20 20:47:04 +00:00
Conversation 0 Commits 1 Files Changed 6
+198 -12
panxiao81 commented 2026-09-20 20:46:46 +00:00
Owner
Copy Link
Copy Source

变化

  • 用实例 Swagger 固定的 JSON 与幂等 REST 调和器管理 oci-hosted、oci-proxy、oci-public
  • Terraform 启用 OciBearerToken Realm，并将匿名权限限制到 public/proxy
  • 使用 path-based routing，不新增端口，不修改 zot
  • 记录 OCI、Helm、Cosign/referrers 与 BuildKit cache 现场验收

现场验证

  • REST --check：三个 OCI repository 均 in sync
  • Terraform plan：No changes
  • oci-public 匿名 Alpine 拉取 4.75s → 0.80s，digest 一致
  • oci-hosted 认证 push/pull 成功，匿名 pull 为 401
  • amd64/arm64 OCI index push/inspect 成功
  • Helm OCI push/pull digest 与 tarball SHA-256 一致
  • Cosign 3.1.3 签名/验证成功，OCI 1.1 referrers 返回 1 个 Sigstore bundle
  • 两个独立 buildx builder 完成 mode=max registry cache 导出/导入，第二轮 RUN 均 CACHED

静态检查

  • jq empty oci/*.json
  • bash -n reconcile-oci.sh
  • terraform fmt -check -recursive
  • terraform validate
  • git diff --check

当前 CI runner 正在重构，以上为人工验证依据。外部 PostgreSQL、备份恢复与正式 publisher account 尚未完成，zot 保持不变。

## 变化 - 用实例 Swagger 固定的 JSON 与幂等 REST 调和器管理 oci-hosted、oci-proxy、oci-public - Terraform 启用 OciBearerToken Realm，并将匿名权限限制到 public/proxy - 使用 path-based routing，不新增端口，不修改 zot - 记录 OCI、Helm、Cosign/referrers 与 BuildKit cache 现场验收 ## 现场验证 - REST --check：三个 OCI repository 均 in sync - Terraform plan：No changes - oci-public 匿名 Alpine 拉取 4.75s → 0.80s，digest 一致 - oci-hosted 认证 push/pull 成功，匿名 pull 为 401 - amd64/arm64 OCI index push/inspect 成功 - Helm OCI push/pull digest 与 tarball SHA-256 一致 - Cosign 3.1.3 签名/验证成功，OCI 1.1 referrers 返回 1 个 Sigstore bundle - 两个独立 buildx builder 完成 mode=max registry cache 导出/导入，第二轮 RUN 均 CACHED ## 静态检查 - jq empty oci/*.json - bash -n reconcile-oci.sh - terraform fmt -check -recursive - terraform validate - git diff --check 当前 CI runner 正在重构，以上为人工验证依据。外部 PostgreSQL、备份恢复与正式 publisher account 尚未完成，zot 保持不变。
panxiao81 added 1 commit 2026-09-20 20:46:48 +00:00
纳管并验收 Nexus OCI 仓库
terraform / validate (pull_request) Successful in 1m21s
Details
7bdd152db9
panxiao81 merged commit c368373e74 into main 2026-09-20 20:47:04 +00:00
panxiao81 deleted branch feat/nexus-oci-poc 2026-09-20 20:47:04 +00:00
Sign in to join this conversation.
Reviewers
No Reviewers
Labels
No items
No labels
Milestone
No items
No Milestone
Projects
Clear projects
No projects
Assignees
Clear assignees
panxiao81 (Xiao Pan)
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: panxiao81/homelab-infra#109