From bbea068e12a83b70cea19e2730b27dd557deee33 Mon Sep 17 00:00:00 2001 From: Ian Keane Date: Sat, 22 Aug 2026 17:56:03 -0400 Subject: [PATCH] Migrate ECR to forgejo container registry --- Makefile | 14 +++++--- .../templates/mcp-auth-proxy-git.yaml | 4 ++- .../templates/registry-secret.yaml | 27 +++++++++++++++ images/mcp-auth-proxy/Dockerfile | 15 +++------ terraform/ecr.tf | 33 ------------------- terraform/iam.tf | 21 ------------ values.yaml | 3 ++ 7 files changed, 47 insertions(+), 70 deletions(-) create mode 100644 charts/mcp-auth-proxy/templates/registry-secret.yaml delete mode 100644 terraform/ecr.tf diff --git a/Makefile b/Makefile index 1fa456a..33058f2 100644 --- a/Makefile +++ b/Makefile @@ -1,6 +1,9 @@ .PHONY: init plan apply destroy clean kubeconfig talosconfig argocd-password bootstrap decrypt post-apply build-mcp-auth-proxy SECRET ?= dumpnet +FORGEJO_REGISTRY ?= forge.keane.sh +FORGEJO_USER ?= ian +MCP_AUTH_PROXY_IMAGE=$(FORGEJO_REGISTRY)/$(FORGEJO_USER)/mcp-auth-proxy TF_DIR=terraform SOPS_FILES=controlplane.yaml worker.yaml talosconfig @@ -41,11 +44,12 @@ bootstrap: # Images build-mcp-auth-proxy: - $(eval ECR=$(shell cd $(TF_DIR) && terraform output -raw ecr_registry)) - aws ecr get-login-password --region us-east-1 | docker login --username AWS --password-stdin $(ECR) - docker build -t $(ECR):latest images/mcp-auth-proxy/ - docker push $(ECR):latest - @echo "Pushed mcp-auth-proxy to $(ECR):latest" + @echo "==> Logging into Forgejo registry..." + $(eval REGISTRY_TOKEN=$(shell aws secretsmanager get-secret-value --secret-id $(SECRET) --query SecretString --output text | python3 -c "import sys,json; print(json.load(sys.stdin)['forgejo']['registry_token'])")) + echo "$(REGISTRY_TOKEN)" | docker login $(FORGEJO_REGISTRY) --username $(FORGEJO_USER) --password-stdin + docker build -t $(MCP_AUTH_PROXY_IMAGE):latest images/mcp-auth-proxy/ + docker push $(MCP_AUTH_PROXY_IMAGE):latest + @echo "Pushed mcp-auth-proxy to $(MCP_AUTH_PROXY_IMAGE):latest" # Credentials talosconfig: diff --git a/charts/mcp-auth-proxy/templates/mcp-auth-proxy-git.yaml b/charts/mcp-auth-proxy/templates/mcp-auth-proxy-git.yaml index 77df160..74f3e61 100644 --- a/charts/mcp-auth-proxy/templates/mcp-auth-proxy-git.yaml +++ b/charts/mcp-auth-proxy/templates/mcp-auth-proxy-git.yaml @@ -13,9 +13,11 @@ spec: labels: app: mcp-auth-proxy-git spec: + imagePullSecrets: + - name: forgejo-registry containers: - name: mcp-auth-proxy - image: 024762953732.dkr.ecr.us-east-1.amazonaws.com/dumpnet/mcp-auth-proxy:latest + image: {{ .Values.registry.host }}/{{ .Values.registry.user }}/mcp-auth-proxy:latest args: - --external-url=https://git-mcp-oauth.dumpnet.chat - --no-auto-tls=true diff --git a/charts/mcp-auth-proxy/templates/registry-secret.yaml b/charts/mcp-auth-proxy/templates/registry-secret.yaml new file mode 100644 index 0000000..9952150 --- /dev/null +++ b/charts/mcp-auth-proxy/templates/registry-secret.yaml @@ -0,0 +1,27 @@ +{{- $host := .Values.registry.host }} +{{- $user := .Values.registry.user }} +apiVersion: external-secrets.io/v1 +kind: ExternalSecret +metadata: + name: forgejo-registry + namespace: mcp + annotations: + argocd.argoproj.io/sync-wave: "-1" +spec: + refreshInterval: 1h + secretStoreRef: + name: aws-secrets-manager + kind: ClusterSecretStore + target: + name: forgejo-registry + type: kubernetes.io/dockerconfigjson + template: + engineVersion: v2 + data: + # When forking: update host/user to match your registry + .dockerconfigjson: '{"auths":{"{{ $host }}":{"username":"{{ $user }}","password":"{{ "{{" }} .registry_token {{ "}}" }}","auth":"{{ "{{" }} printf "{{ $user }}:%s" .registry_token | b64enc {{ "}}" }}"}}}' + data: + - secretKey: registry_token + remoteRef: + key: dumpnet + property: forgejo.registry_token diff --git a/images/mcp-auth-proxy/Dockerfile b/images/mcp-auth-proxy/Dockerfile index e62b2e8..d21701c 100644 --- a/images/mcp-auth-proxy/Dockerfile +++ b/images/mcp-auth-proxy/Dockerfile @@ -2,25 +2,20 @@ FROM golang:1.22-bookworm AS builder ENV GOTOOLCHAIN=auto -# Pin to a specific release tag ARG VERSION=v2.10.2 WORKDIR /app RUN git clone --depth 1 --branch ${VERSION} https://github.com/sigbit/mcp-auth-proxy . RUN go mod download -ARG TARGETARCH -ARG TARGETOS -RUN CGO_ENABLED=0 GOOS=$TARGETOS GOARCH=$TARGETARCH \ +RUN CGO_ENABLED=0 GOOS=linux GOARCH=amd64 \ go build -trimpath -ldflags "-w -s" -o /app/bin/mcp-auth-proxy . -FROM debian:bookworm-slim +FROM scratch -RUN apt-get update && apt-get install -y --no-install-recommends \ - ca-certificates curl \ - && rm -rf /var/lib/apt/lists/* +COPY --from=builder /etc/ssl/certs/ca-certificates.crt /etc/ssl/certs/ +COPY --from=builder /app/bin/mcp-auth-proxy /mcp-auth-proxy -COPY --from=builder /app/bin/mcp-auth-proxy /usr/local/bin/mcp-auth-proxy ENV DATA_PATH=/data -ENTRYPOINT ["/usr/local/bin/mcp-auth-proxy"] +ENTRYPOINT ["/mcp-auth-proxy"] diff --git a/terraform/ecr.tf b/terraform/ecr.tf deleted file mode 100644 index 92d3c77..0000000 --- a/terraform/ecr.tf +++ /dev/null @@ -1,33 +0,0 @@ -resource "aws_ecr_repository" "dumpnet" { - name = "dumpnet/mcp-auth-proxy" - image_tag_mutability = "MUTABLE" - - image_scanning_configuration { - scan_on_push = true - } - - encryption_configuration { - encryption_type = "AES256" - } -} - -resource "aws_ecr_lifecycle_policy" "dumpnet" { - repository = aws_ecr_repository.dumpnet.name - - policy = jsonencode({ - rules = [{ - rulePriority = 1 - description = "Keep last 5 images per tag prefix" - selection = { - tagStatus = "any" - countType = "imageCountMoreThan" - countNumber = 5 - } - action = { type = "expire" } - }] - }) -} - -output "ecr_registry" { - value = aws_ecr_repository.dumpnet.repository_url -} diff --git a/terraform/iam.tf b/terraform/iam.tf index e4a516c..aa4392e 100644 --- a/terraform/iam.tf +++ b/terraform/iam.tf @@ -58,24 +58,3 @@ resource "aws_iam_role_policy" "node_secrets_manager" { } -# ECR pull access for node (to pull custom images like mcp-auth-proxy) -resource "aws_iam_role_policy" "node_ecr" { - name = "ecr-pull" - role = aws_iam_role.node.id - - policy = jsonencode({ - Version = "2012-10-17" - Statement = [ - { - Effect = "Allow" - Action = [ - "ecr:GetDownloadUrlForLayer", - "ecr:BatchGetImage", - "ecr:BatchCheckLayerAvailability", - "ecr:GetAuthorizationToken" - ] - Resource = "*" - } - ] - }) -} diff --git a/values.yaml b/values.yaml index 4b36b53..f1f5f9b 100644 --- a/values.yaml +++ b/values.yaml @@ -8,3 +8,6 @@ domain: dumpnet.chat repoURL: https://forge.keane.sh/ian/dumpnet-argo.git certEmail: dumpnetcerts@keane.sh awsRegion: us-east-1 +registry: + host: forge.keane.sh + user: ian