Skip to content

feat: add archive infrastructure for EOL distribution packages#47

Open
abtreece wants to merge 4 commits intofullstaq-ruby:mainfrom
abtreece:feat/eol-archive-repos
Open

feat: add archive infrastructure for EOL distribution packages#47
abtreece wants to merge 4 commits intofullstaq-ruby:mainfrom
abtreece:feat/eol-archive-repos

Conversation

@abtreece
Copy link
Copy Markdown

@abtreece abtreece commented Apr 25, 2026

Summary

  • Add GCS buckets for APT/YUM archive repositories (public-read, no CI write access)
  • Add Azure DNS zones, NS delegation, and A/AAAA records for apt-archive.fullstaqruby.org and yum-archive.fullstaqruby.org
  • Add Caddy server blocks to redirect archive subdomains to the versioned GCS bucket paths
  • Update query-latest-repo-versions.rb to query archive bucket versions, with graceful fallback (version 0) before first migration

Context

Addresses fullstaq-ruby/server-edition#190 — CI disk space exhaustion from the growing Aptly state archive.

Archive repos follow the PostgreSQL (apt-archive.postgresql.org) and HashiCorp (archive.releases.hashicorp.com) pattern: frozen repositories for EOL distributions, served as static redirects to GCS.

Companion PR: fullstaq-ruby/server-edition#191 (migration scripts, build config, runbook)
Implementation plan: context/plans/EOL-ARCHIVE-MIGRATION.md (Tasks 1-3)

Deployment sequence

  1. terraform apply in terraform/ to create buckets and DNS
  2. Wait for DNS propagation
  3. Restart Caddy (via Ansible or SSH) to pick up new Caddyfile and env vars
  4. Run migration scripts from the server-edition companion PR

Test plan

  • terraform init -backend=false && terraform validate && terraform fmt -check -diff -recursive passes
  • DNS resolves: dig apt-archive.fullstaqruby.org A and dig yum-archive.fullstaqruby.org A return backend server IP
  • Caddy starts without error even before first migration (archive version defaults to 0)
  • After migration: curl -I https://apt-archive.fullstaqruby.org/dists/ returns 302 to GCS

The previous code degraded any non-2xx response (auth errors, 5xx,
redirects) to LATEST_VERSION=0 whenever the suffix indicated an
archive bucket. That silently turns a transient outage or
misconfiguration into Caddy redirecting clients to /versions/0/...
404s — broken behavior masquerading as valid config.

Only treat HTTP 404 as the legitimate "archive not yet populated"
case; surface every other failure.
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant