spikerj/spikersoft-issues
1
0
Fork 0
Code Issues 196 Pull Requests Actions Packages Projects Releases Wiki Activity

[Infra][MinIO] Move Gitea package/container-registry storage to the gitea-packages bucket #498

New Issue
Closed
opened 2026-07-12 05:09:38 +00:00 by spikerj · 1 comment
spikerj commented 2026-07-12 05:09:38 +00:00
Owner
Copy Link
Copy Source

Requested by Joey: consolidate where artifacts land — Gitea's published packages (incl. the container-registry blobs behind https://git.spikersoft.com/-/admin/packages, i.e. every image the swarm pulls) move from laptop-server's local /data/packages to MinIO.

Done already

  • gitea-packages bucket created (private).
  • Scoped gitea-svc key + gitea-packages-rw policy (rw+delete on gitea-packages/* only) — enforcement verified (write/read/delete OK, other buckets denied).
  • Gitea stack env: [storage.packages] → minio via environment-to-ini (path-style, SSL, ${GITEA_S3_SECRET_KEY} from the deploy shell — plain var per the stack-deploy ${VAR:?} lesson). PR in spikersoft-infrastructure.
  • Bucket map row in docs/minio-storage-migration.md.

Remaining (ops, laptop-server — runbook in the stack header)

  1. Quiet window; gitea migrate-storage --type packages --storage minio … (one-time copy of existing packages; config flip alone strands them).
  2. Redeploy the gitea stack with GITEA_S3_SECRET_KEY exported.
  3. Verify: CI pushes an image → mc ls spiker/gitea-packages shows objects; docker pull git.spikersoft.com/spikerj/<any>:latest works; admin packages page lists everything.

Accepted tradeoff (Joey, 2026-07-12)

Registry blobs move onto SERVER-hosted MinIO: a SERVER/MinIO outage breaks image pulls fleet-wide (previously only a laptop-server outage did). Mitigation ideas later: MinIO replication or a pull-through cache.

Related: #413 (storage consolidation), #493 (seam pattern).

Requested by Joey: consolidate where artifacts land — Gitea's published packages (incl. the container-registry blobs behind https://git.spikersoft.com/-/admin/packages, i.e. every image the swarm pulls) move from laptop-server's local `/data/packages` to MinIO. ## Done already - `gitea-packages` bucket created (private). - Scoped `gitea-svc` key + `gitea-packages-rw` policy (rw+delete on `gitea-packages/*` only) — enforcement verified (write/read/delete OK, other buckets denied). - Gitea stack env: `[storage.packages]` → minio via environment-to-ini (path-style, SSL, `${GITEA_S3_SECRET_KEY}` from the deploy shell — plain var per the stack-deploy `${VAR:?}` lesson). PR in spikersoft-infrastructure. - Bucket map row in docs/minio-storage-migration.md. ## Remaining (ops, laptop-server — runbook in the stack header) 1. Quiet window; `gitea migrate-storage --type packages --storage minio …` (one-time copy of existing packages; config flip alone strands them). 2. Redeploy the gitea stack with `GITEA_S3_SECRET_KEY` exported. 3. Verify: CI pushes an image → `mc ls spiker/gitea-packages` shows objects; `docker pull git.spikersoft.com/spikerj/<any>:latest` works; admin packages page lists everything. ## Accepted tradeoff (Joey, 2026-07-12) Registry blobs move onto SERVER-hosted MinIO: a SERVER/MinIO outage breaks image pulls fleet-wide (previously only a laptop-server outage did). Mitigation ideas later: MinIO replication or a pull-through cache. Related: #413 (storage consolidation), #493 (seam pattern).
spikerj commented 2026-07-12 06:30:39 +00:00
Author
Owner
Copy Link
Copy Source

Verified end-to-end: go-forward cutover complete (Joey opted to skip migrating old artifacts — all 143 pre-existing package versions were wiped so Gitea's blob dedup can't reference ghost files, then all build workflows re-dispatched). Registry now fully MinIO-backed: 17 GiB / 292 objects in gitea-packages, 24+ container packages repopulated, and every deploy tonight pulled images through the new storage without error (0 errors in Seq). Root-credential rotation reminder stands (MinIO now backs 4 buckets). Closing.

Verified end-to-end: go-forward cutover complete (Joey opted to skip migrating old artifacts — all 143 pre-existing package versions were wiped so Gitea's blob dedup can't reference ghost files, then all build workflows re-dispatched). Registry now fully MinIO-backed: **17 GiB / 292 objects in `gitea-packages`**, 24+ container packages repopulated, and every deploy tonight pulled images through the new storage without error (0 errors in Seq). Root-credential rotation reminder stands (MinIO now backs 4 buckets). Closing.
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
agentic
Actionable surfaced by the agentic architecture & security review
 bug
Something is not working
 duplicate
This issue or pull request already exists
 enhancement
New feature
 help wanted
Need some help
 invalid
Something is wrong
 question
More information is needed
 sonarqube
Code quality issue surfaced by SonarQube (bug / code smell)
 wontfix
This won't be fixed
No labels
Milestone
No items
No Milestone
Projects
Clear projects
No projects
Assignees
Clear assignees
spikerj (Joseph Spiker)
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: spikerj/spikersoft-issues#498