apps/nexus/README.md

@@ -49,12 +49,13 @@ DNS 期望状态已加入 `infrastructure/dns/records.yml`，需从 Samba AD Ans
 
 初始管理员密码生成在 PVC 的 `/nexus-data/admin.password`。只在交互式终端中读取并立即
 完成首次密码轮换；不得把密码复制进 shell tracing、工单、Git 或命令参数。随后将
-Terraform 管理账号的凭据存入 OpenBao，由 CI 注入以下环境变量：
+Terraform 管理账号的凭据存入 OpenBao，由 CI 通过 Terraform input variable 注入以下
+环境变量：
 
 ```text
-NXRM_SERVER_URL=https://nexus.ad.ddupan.top
+TF_VAR_nexus_url=https://nexus.ad.ddupan.top
-NXRM_SERVER_USERNAME=<OpenBao 注入>
+TF_VAR_nexus_username=admin
-NXRM_SERVER_PASSWORD=<OpenBao 注入>
+TF_VAR_nexus_password=<OpenBao kv/infra/nexus 的 admin_password 字段>
 ```
 
 `terraform/` 使用 `sonatype-nexus-community/sonatyperepo` 1.17.0，当前声明：
@@ -72,6 +73,18 @@ terraform -chdir=apps/nexus/terraform init -backend=false
 terraform -chdir=apps/nexus/terraform validate
 ```
 
+Terraform 同时把内置 `anonymous` 用户从默认的全仓库 `nx-anonymous` 角色收窄到
+`ansible-public`、其返回制品 URL 使用的 `ansible-galaxy-proxy`，以及 `go-public` 的
+`browse/read` 权限。首次接管已有实例时先执行
+`terraform import sonatyperepo_user.anonymous anonymous,default`，再 apply；不要先启用默认的
+全仓库匿名读取。
+
+2026-09-20 的 POC 现场验收已确认：Flux 与 Pod Ready、PVC Bound、HTTPRoute 通过 HTTPS
+返回 Nexus 状态 200，Samba DNS 已幂等收敛。全新客户端目录通过匿名入口下载
+`community.general:11.2.0` 时冷缓存为 8.49 秒、热缓存为 1.89 秒，两次 tarball SHA-256
+一致；`golang.org/x/[email protected]` 为 2.92 秒与 1.51 秒。该结果只证明 Ansible/Go
+代理链路，不代表 OCI、BuildKit cache、备份恢复或正式数据库已经验收。
+
 ## 客户端验收
 
 先验证冷缓存，再原样重复命令验证热缓存；记录 Nexus 请求、上游流量和耗时，不只观察

apps/nexus/terraform/security.tf

@@ -0,0 +1,50 @@
+resource "sonatyperepo_privilege_repository_view" "anonymous_ansible" {
+  name        = "ci-anonymous-ansible-read"
+  description = "Anonymous read access to the Ansible Galaxy group"
+  actions     = ["BROWSE", "READ"]
+  format      = "ansiblegalaxy"
+  repository  = sonatyperepo_repository_ansiblegalaxy_group.public.name
+}
+
+resource "sonatyperepo_privilege_repository_view" "anonymous_ansible_proxy" {
+  name        = "ci-anonymous-ansible-proxy-read"
+  description = "Anonymous artifact read access to the Ansible Galaxy proxy"
+  actions     = ["BROWSE", "READ"]
+  format      = "ansiblegalaxy"
+  repository  = sonatyperepo_repository_ansiblegalaxy_proxy.galaxy.name
+}
+
+resource "sonatyperepo_privilege_repository_view" "anonymous_go" {
+  name        = "ci-anonymous-go-read"
+  description = "Anonymous read access to the Go module group"
+  actions     = ["BROWSE", "READ"]
+  format      = "go"
+  repository  = sonatyperepo_repository_go_group.public.name
+}
+
+resource "sonatyperepo_role" "anonymous_ci" {
+  id          = "ci-anonymous-read"
+  name        = "CI anonymous read"
+  description = "Read-only access to public CI dependency proxy groups"
+  privileges = [
+    sonatyperepo_privilege_repository_view.anonymous_ansible.name,
+    sonatyperepo_privilege_repository_view.anonymous_ansible_proxy.name,
+    sonatyperepo_privilege_repository_view.anonymous_go.name,
+  ]
+  roles = []
+}
+
+resource "sonatyperepo_user" "anonymous" {
+  user_id       = "anonymous"
+  first_name    = "Anonymous"
+  last_name     = "User"
+  email_address = "[email protected]"
+  status        = "active"
+  roles         = [sonatyperepo_role.anonymous_ci.id]
+}
+
+resource "sonatyperepo_system_anonymous_access" "ci" {
+  enabled    = true
+  user_id    = sonatyperepo_user.anonymous.user_id
+  realm_name = "NexusAuthorizingRealm"
+}

apps/nexus/terraform/versions.tf

@@ -10,7 +10,24 @@ terraform {
 }
 
 provider "sonatyperepo" {
-  # NXRM_SERVER_URL, NXRM_SERVER_USERNAME and NXRM_SERVER_PASSWORD are injected
+  url      = var.nexus_url
-  # from OpenBao by CI.
+  username = var.nexus_username
-  # Provider credentials must never be committed or placed in tfvars/state.
+  password = var.nexus_password
+}
+
+variable "nexus_url" {
+  description = "Nexus Repository base URL"
+  type        = string
+}
+
+variable "nexus_username" {
+  description = "Nexus Terraform management username"
+  type        = string
+  sensitive   = true
+}
+
+variable "nexus_password" {
+  description = "Nexus Terraform management password"
+  type        = string
+  sensitive   = true
 }

platform/spire/README.md

@@ -74,6 +74,12 @@ Agent 已启用 Unix workload attestor，并为本机用户 `panxiao81`（UID `1
 export SPIFFE_ENDPOINT_SOCKET=unix:///run/spire/agent-sockets/spire-agent.sock
 ```
 
+宿主机已安装与 Agent Pod 同版本的 `/usr/local/bin/spire-agent` 1.15.3，供本地进程从
+Workload API 获取 JWT-SVID。二进制来自 SPIRE 官方 `linux-amd64-musl` release，安装时
+核对 tarball SHA-256
+`ca1a4d1155317bdd2afc7f36663828a10410c7c840e54725b90b4064b0a301c7`。升级 chart 时应
+同步升级这个 CLI 并重新核对官方 checksum，不能长期混用版本。
+
 该身份仅按 Unix UID 匹配，不是 SPIRE admin，也不会匹配 `sudo` 后以 root 运行的
 进程。`ClusterStaticEntry.spec.parentID` 绑定当前 `laptop` Kubernetes node UID；若
 节点被删除后重建，需从 `spire-server agent list` 取得新 Agent ID 并同步更新该字段。