Architecture¶

System Overview¶

Subscriber
    │
    ▼
Traefik (TLS termination, forwardAuth, routing)
    │
    ├── /rpm/   → nginx (RPM repodata + packages)
    ├── /deb/   → nginx → Aptly (signed DEB snapshots)
    ├── /oci/   → Zot (OCI registry, cosign signatures)
    ├── /gpg/   → nginx (public keys — unauthenticated)
    └── /api/   → auth service (admin API, internal :8088)
         │
         └── auth service (forwardAuth + key management)
                  │
                  └── SQLite (subscription key store)

Promotion pipeline (GitHub Actions):
    RustFS (staging) → sign → publish → rpm/deb/zot

Services¶

Service	Image	Role
`traefik`	`traefik:3.6.12`	TLS, routing, forwardAuth middleware
`auth`	built from `./auth`	Subscription key validation, admin API, Prometheus metrics
`rpm`	built from `./rpm`	nginx serving signed RPM repos
`deb`	`nginx:alpine`	nginx serving Aptly-published DEB repos
`zot`	`ghcr.io/project-zot/zot-linux-amd64:v2.1.2`	OCI registry with cosign signatures
`aptly`	`ghcr.io/no42-org/packyard-aptly:1.6.2`	DEB repo management and signing (multi-arch: amd64 + arm64)
`rustfs`	`rustfs/rustfs:latest`	S3-compatible staging storage for promotion pipeline
`static`	`nginx:alpine`	Public GPG/cosign key hosting
`backup`	`keinos/sqlite3:latest`	Daily SQLite backup of the key store

Repository Layout¶

auth/               Go service — subscription key auth + admin API
aptly/              Aptly configuration and DEB repo scripts
deb/                nginx configuration for DEB serving
rpm/                nginx + createrepo_c for RPM serving
zot/                Zot OCI registry configuration
traefik/            Traefik static and dynamic configuration
rustfs/             RustFS staging storage configuration
static/             Public static files (GPG/cosign keys)
scripts/            Operator scripts (backup, stage-artifact, health-check)
docs/ops/           Operational runbooks
tests/e2e/          End-to-end subscriber tests (RPM, DEB, OCI, observability)
tests/load/         k6 load tests for NFR validation
.github/workflows/  Promotion pipeline (RPM, DEB, OCI)