cloud-hosting-platform/cloud-apache-container
6
0 Fork 0
Code Issues Pull Requests 1 Actions Packages Projects Releases Wiki Activity

pkg-cache: Debian/NodeSource/Go/EL9 modes; wire cac-litespeed + cac-lsphp; docs #36

Merged
jknapp merged 3 commits from ci/pkg-cache-more-upstreams into trunk 2026-10-22 14:35:52 +00:00
Conversation 0 Commits 3 Files Changed 9
+398 -30
jknapp commented 2026-10-22 14:35:50 +00:00
Owner
Copy link
Copy source

Extends the internal package cache wiring (docs/pkg-cache.md updated; this repo is canonical for the script, keys and resolve-base-image.sh).

scripts/pkg-cache-repos.sh (backward compatible)

  • apt: also Debian (deb.debian.org/debian, .../debian-security, security.debian.org; deb822 + classic). Listing no longer fails under pipefail without /etc/apt/sources.list (Debian 13).
  • rpm: also rpm.nodesource.com -> <cache>/nodesource (gpgcheck=1).
  • new nodesource MAJOR (replaces curl setup_N.x | bash, pinned key keys/pkg-cache/RPM-GPG-KEY-nodesource), new go-env (GOPROXY via cache, sumdb unchanged).
  • release-install EL9/EL10 by rpm -E %rhel; RPM-GPG-KEY-EPEL-9 added. PKG_CACHE regex-validated.

cac-litespeed / cac-lsphp now wired (commit 3a6cab1): FROM ${BASE_IMAGE} in every stage, digest resolved directly from Docker Hub in CI + mirror only when pinned, pkg-cache-repos.sh apt/restore around lsphp-apt-upgrade.sh (emergency lsphp-src stage stays upstream); madison gate accepts ${PKG_CACHE}/litespeed/ only when PKG_CACHE is set.

CT130 (already live): new prefixes /nodesource/, /debian/, /debian-security/, /goproxy/.

Tested

  • Script modes through the cache (throwaway runner-template CT on pve vmbr2): EL9+EPEL9, NodeSource 22 on EL10, Debian trixie apt, golang:1.25 apt + go-env: all OK, restore left no reference.
  • Local fallback (no PKG_CACHE, digest BASE_IMAGE): Dockerfile.fpm PHPVER=85 (epel+remi verified, PHP 8.5.12) and Dockerfile.shared-httpd: EXIT 0. Dockerfile.litespeed and Dockerfile.lsphp PHPVER=85/OLS 1.8.4: EXIT 0 (lsphp85 8.5.12-1+noble, .phpt 10/10).
  • Cache path: litespeed + lsphp builds on the CT with PKG_CACHE: all packages from 192.168.1.40 (/ubuntu, /ubuntu-security, /litespeed), madison gate via cache, restore clean.
  • shellcheck -S warning clean; lsphp-info-probe 36/0, lsphp-abi-gate 10/0.
  • Same script already shipped green in cloud-node-container (run 4681), cmc (4675), chc (4676), versitygw (4678), haproxy-manager-base (4679/4680).

🤖 Generated with Claude Code

Extends the internal package cache wiring (docs/pkg-cache.md updated; this repo is canonical for the script, keys and resolve-base-image.sh). **scripts/pkg-cache-repos.sh** (backward compatible) - `apt`: also Debian (`deb.debian.org/debian`, `.../debian-security`, `security.debian.org`; deb822 + classic). Listing no longer fails under pipefail without `/etc/apt/sources.list` (Debian 13). - `rpm`: also `rpm.nodesource.com` -> `<cache>/nodesource` (gpgcheck=1). - new `nodesource MAJOR` (replaces `curl setup_N.x | bash`, pinned key `keys/pkg-cache/RPM-GPG-KEY-nodesource`), new `go-env` (GOPROXY via cache, sumdb unchanged). - `release-install` EL9/EL10 by `rpm -E %rhel`; `RPM-GPG-KEY-EPEL-9` added. PKG_CACHE regex-validated. **cac-litespeed / cac-lsphp now wired** (commit 3a6cab1): `FROM ${BASE_IMAGE}` in every stage, digest resolved directly from Docker Hub in CI + mirror only when pinned, `pkg-cache-repos.sh apt`/`restore` around `lsphp-apt-upgrade.sh` (emergency `lsphp-src` stage stays upstream); madison gate accepts `${PKG_CACHE}/litespeed/` only when PKG_CACHE is set. **CT130** (already live): new prefixes `/nodesource/`, `/debian/`, `/debian-security/`, `/goproxy/`. **Tested** - Script modes through the cache (throwaway runner-template CT on pve vmbr2): EL9+EPEL9, NodeSource 22 on EL10, Debian trixie apt, golang:1.25 apt + go-env: all OK, restore left no reference. - Local fallback (no PKG_CACHE, digest BASE_IMAGE): Dockerfile.fpm PHPVER=85 (epel+remi verified, PHP 8.5.12) and Dockerfile.shared-httpd: EXIT 0. Dockerfile.litespeed and Dockerfile.lsphp PHPVER=85/OLS 1.8.4: EXIT 0 (lsphp85 8.5.12-1+noble, .phpt 10/10). - Cache path: litespeed + lsphp builds on the CT with PKG_CACHE: all packages from 192.168.1.40 (/ubuntu, /ubuntu-security, /litespeed), madison gate via cache, restore clean. - shellcheck -S warning clean; lsphp-info-probe 36/0, lsphp-abi-gate 10/0. - Same script already shipped green in cloud-node-container (run 4681), cmc (4675), chc (4676), versitygw (4678), haproxy-manager-base (4679/4680). 🤖 Generated with [Claude Code](https://claude.com/claude-code)
jknapp added 3 commits 2026-10-22 14:35:50 +00:00
feat(pkg-cache): Debian, NodeSource, Go proxy and EL9 support in pkg-cache-repos.sh 6a11fc9894 
Backward compatible; existing modes unchanged for existing callers.
- apt: also rewrites deb.debian.org/debian, deb.debian.org/debian-security and
  security.debian.org to <cache>/debian and <cache>/debian-security; the
  listing no longer fails under pipefail when /etc/apt/sources.list is absent
  (Debian 13 images).
- rpm: rewrites rpm.nodesource.com repos to <cache>/nodesource (gpgcheck=1;
  NodeSource does not sign repomd).
- new `nodesource MAJOR`: writes the nodesource-nodejs repo itself with the
  committed signing key (replaces curl setup_N.x | bash).
- new `go-env`: prints GOPROXY=<cache>/goproxy|https://proxy.golang.org|direct
  plus SSL_CERT_FILE for the RUN; go.sum + sum.golang.org still verify.
- release-install: EL9 or EL10 picked from rpm %rhel; adds RPM-GPG-KEY-EPEL-9.
- PKG_CACHE is regex-validated.
Tested through the cache on a throwaway runner CT (pve vmbr2): EL9+EPEL9,
NodeSource 22 on EL10, Debian trixie apt, golang:1.25 apt + go-env; restore
left no cache reference in each case.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
ci: wire cac-litespeed and cac-lsphp to the package cache and digest-pinned base 3a6cab19ee 
Dockerfile.litespeed / Dockerfile.lsphp: one global
ARG BASE_IMAGE=litespeedtech/openlitespeed:${OLS_VERSION}-lsphp${PHPVER}
used by every stage (incl. the emergency lsphp-src stage, which stays on
upstream repos). The stages that run lsphp-apt-upgrade.sh (litespeed final,
lsphp ext-build + final) take ARG PKG_CACHE=, ship pkg-cache-repos.sh +
keys/pkg-cache/, and wrap the upgrade in `pkg-cache-repos.sh apt` ...
`pkg-cache-repos.sh restore`. Without PKG_CACHE both are no-ops.

lsphp-apt-upgrade.sh: the madison gate also accepts ${PKG_CACHE}/litespeed/
as the lsphp source, but only when PKG_CACHE is set.

build-push.yaml: Build-LiteSpeed-Images and Build-LSPHP-Images resolve the
base digest directly from Docker Hub, probe the cache, set up buildx with
the registry mirror only for a pinned base, and pass BASE_IMAGE + PKG_CACHE.
OLS_VERSION (1.8.4) is now a job-level env read by both the digest lookup
and the build-arg.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
docs(pkg-cache): new upstreams, modes, wired repos, how to add an upstream 9baa7a6029 
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
jknapp merged commit 0fee1b54c4 into trunk 2026-10-22 14:35:52 +00:00
jknapp deleted branch ci/pkg-cache-more-upstreams 2026-10-22 14:35:52 +00:00
Sign in to join this conversation.
Reviewers
No Reviewers
Labels
No items
No labels
Milestone
No items
No Milestone
Projects
Clear projects
No projects
Assignees
Clear assignees
hub-agent Bot jknapp renovate-bot (Renovate Bot) whmcs-sam whp-cicd-user whp-deploy
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: cloud-hosting-platform/cloud-apache-container#36