97 lines
3.7 KiB
Markdown
97 lines
3.7 KiB
Markdown
# Anubis Helm chart
|
|
|
|
This repository maintains a portable Helm chart for
|
|
[Anubis](https://anubis.techaro.lol), using its official container image. The chart owns the Deployment,
|
|
Service, policy wiring, health probes, metrics port, and optional Traefik and
|
|
Prometheus integrations. Cluster-specific values remain outside the chart.
|
|
|
|
## Install from the public Helm repository
|
|
|
|
```sh
|
|
helm repo add brunner.ninja https://brunner.ninja/charts
|
|
helm repo update brunner.ninja
|
|
helm upgrade --install anubis brunner.ninja/anubis \
|
|
--namespace anubis --create-namespace \
|
|
--values my-values.yaml --wait
|
|
```
|
|
|
|
The signing Secret named by `signingSecret.name` must already exist. The chart
|
|
references it but never stores or generates its private key. Start from
|
|
[`examples/forward-auth-values.yaml`](examples/forward-auth-values.yaml).
|
|
|
|
For the author's homelab, Argo CD consumes this chart from the public
|
|
[homelab-gitops Anubis application](https://code.brunner.ninja/feedc0de/homelab-gitops/src/branch/main/apps/anubis).
|
|
|
|
## LAN and CI bypass
|
|
|
|
The homelab values send clients in private address ranges directly to Gitea,
|
|
without Anubis middleware. The higher-priority trusted route includes Git HTTP,
|
|
action downloads, API requests, and comparisons. The Anubis endpoint is a
|
|
separate route. `ClientIP` matches the connection peer rather than a
|
|
client-supplied forwarded-IP header, so source-address preservation remains
|
|
part of that cluster's trust boundary.
|
|
|
|
## Protected internet routes
|
|
|
|
The homelab uses Anubis for third-party mirror owners, selected oversized
|
|
public forks, their API paths, and comparison pages. Its remaining Gitea route
|
|
stays unprotected. Proof-of-work difficulty is 6 and authorization cookies
|
|
expire after one hour. These are deployment choices in GitOps, not chart
|
|
defaults.
|
|
|
|
## Repository contents
|
|
|
|
- `chart/`: the portable application-owned Helm chart.
|
|
- `examples/forward-auth-values.yaml`: a reusable Traefik example.
|
|
- `install.sh`: a portable local-chart installer.
|
|
- `robots.txt`: the matching host-level Gitea crawler policy.
|
|
- `test.sh`: Helm lint and rendered relationship tests.
|
|
- `.gitea/workflows/deploy.yml`: chart validation, publication, and GitOps
|
|
promotion.
|
|
|
|
## Install the local chart
|
|
|
|
Create the signing Secret, edit a values file, then run:
|
|
|
|
```sh
|
|
VALUES_FILE=./my-values.yaml NAMESPACE=anubis ./install.sh
|
|
```
|
|
|
|
The installer also accepts `RELEASE_NAME`. It does not assume a particular
|
|
Kubernetes context; selecting and verifying the target cluster is the
|
|
operator's responsibility.
|
|
|
|
## Validate locally
|
|
|
|
```sh
|
|
./test.sh
|
|
```
|
|
|
|
This lints the chart and asserts important relationships in default and
|
|
Traefik-enabled rendered output. It requires Helm and Ruby.
|
|
|
|
## Releases and GitOps promotion
|
|
|
|
The chart tag follows the tested upstream Anubis release:
|
|
`v1.28.1` publishes chart `1.28.1`. Later chart commits publish immutable
|
|
versions such as `1.28.1-1-g41627abcdef`.
|
|
`Chart.yaml.appVersion` records the exact upstream image release.
|
|
|
|
Every push and pull request is validated. A successful current `main` build
|
|
publishes to the indexed `https://brunner.ninja/charts` repository, then updates
|
|
only Anubis's chart `targetRevision` in `homelab-gitops`. CI requires
|
|
`PACKAGE_USERNAME`, `PACKAGE_TOKEN`, and `GITOPS_TOKEN`; it deliberately has no
|
|
Kubernetes credentials. Argo CD alone reconciles the cluster.
|
|
|
|
## Gitea robots.txt
|
|
|
|
The included `robots.txt` is a host-level example for Gitea's custom public
|
|
directory. The chart and CI do not install it.
|
|
|
|
## Scope maintenance
|
|
|
|
The mirror-owner list was generated from Gitea's public repository API on
|
|
2026-08-31. Add newly created third-party mirror owners to both `robots.txt`
|
|
and the relevant cluster-specific route expressions. Keep selected large-fork
|
|
routes and `robots.txt` in sync. Comparison paths are matched generically.
|