#218: mirror procedure into an internal registry #286

fable-5 · 2026-07-31T14:33:16+02:00

fable-5 commented

2026-07-31 14:33:16 +02:00

Airgap mirror procedure (ADR 0024): generated image list (deploy/scripts/list-images.sh), configurable REGISTRY_PREFIX for third-party images (digest pins unchanged), IMAGE_PREFIX for own images - no per-site edits of image references. Step-by-step in deploy/stages.md 5b incl. digest verification and the pull/tag/push fallback. Executed once end-to-end as evidence (docs/vs-nfd/95-mirror-protokoll.md): 4 third-party images + dorfteich-api:v0.12.0 mirrored digest-identically. Operations manual airgap section updated. Refs #218

fable-5 added 1 commit 2026-07-31 14:33:16 +02:00

#218 : mirror procedure into an internal registry

CI / Lint, typecheck, test (pull_request) Successful in 6m11s

Details

CI / Build container images (pull_request) Successful in 1m24s

Details

CI / Import/export fidelity gate (pull_request) Successful in 57s

Details

CI / Import/export fidelity gate (push) Blocked by required conditions

Details

CI / Auth e2e pack (pull_request) Successful in 8m49s

Details

CD / Build and push images (push) Successful in 20s

Details

CD / Deploy to Test (push) Successful in 13s

Details

CD / Smoke tests against Test (push) Successful in 1m25s

Details

CD / Promote to Int (push) Successful in 12s

Details

CI / Lint, typecheck, test (push) Successful in 6m24s

Details

CI / Build container images (push) Has been skipped

Details

CI / Auth e2e pack (push) Has been cancelled

Details

2f7ba65eef

Airgapped sites pull from their own registry (ADR 0024). The image list
is GENERATED (deploy/scripts/list-images.sh resolves the compose file
incl. the caddy profile) so a mirror can never silently miss a service;
third-party images gain a configurable ${REGISTRY_PREFIX:-} in the
compose file (digest pins unchanged - Docker verifies the same sha256
regardless of which registry serves it), own images keep IMAGE_PREFIX;
no image reference is ever edited per site.

Step-by-step procedure in deploy/stages.md 5b: generate list, copy
digest-preservingly (docker buildx imagetools create; plain
pull/tag/push as the documented fallback - the digest comparison closes
the loop either way), verify the digest in the mirror against the pin,
point the deployment via REGISTRY_PREFIX/IMAGE_PREFIX.

Executed once end-to-end and recorded as assessor-facing evidence
(docs/vs-nfd/95-mirror-protokoll.md): all four third-party images
mirrored digest-identically into a local registry:2, plus
dorfteich-api:v0.12.0 (sha256:576f1646... identical on both sides; the
imagetools stall against the Gitea registry is recorded with its
workaround). Operations manual's airgap section now lists the mirror
part as available.

Refs #218.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01AUtYMxwTCMHG9mVHnwbFg8

fable-5 merged commit 2f7ba65eef into main

2026-07-31 14:49:41 +02:00

fable-5 referenced this pull request

2026-07-31 15:01:47 +02:00

[VS-NfD] Document the mirror procedure into an internal registry #218

Sign in to join this conversation.

No reviewers