Migrate ECR to forgejo container registry

Makefile

@@ -1,6 +1,9 @@
 .PHONY: init plan apply destroy clean kubeconfig talosconfig argocd-password bootstrap decrypt post-apply build-mcp-auth-proxy
 
 SECRET ?= dumpnet
+FORGEJO_REGISTRY ?= forge.keane.sh
+FORGEJO_USER ?= ian
+MCP_AUTH_PROXY_IMAGE=$(FORGEJO_REGISTRY)/$(FORGEJO_USER)/mcp-auth-proxy
 TF_DIR=terraform
 SOPS_FILES=controlplane.yaml worker.yaml talosconfig
 
@@ -41,11 +44,12 @@ bootstrap:
 
 # Images
 build-mcp-auth-proxy:
-	$(eval ECR=$(shell cd $(TF_DIR) && terraform output -raw ecr_registry))
+	@echo "==> Logging into Forgejo registry..."
-	aws ecr get-login-password --region us-east-1 | docker login --username AWS --password-stdin $(ECR)
+	$(eval REGISTRY_TOKEN=$(shell aws secretsmanager get-secret-value --secret-id $(SECRET) --query SecretString --output text | python3 -c "import sys,json; print(json.load(sys.stdin)['forgejo']['registry_token'])"))
-	docker build -t $(ECR):latest images/mcp-auth-proxy/
+	echo "$(REGISTRY_TOKEN)" | docker login $(FORGEJO_REGISTRY) --username $(FORGEJO_USER) --password-stdin
-	docker push $(ECR):latest
+	docker build -t $(MCP_AUTH_PROXY_IMAGE):latest images/mcp-auth-proxy/
-	@echo "Pushed mcp-auth-proxy to $(ECR):latest"
+	docker push $(MCP_AUTH_PROXY_IMAGE):latest
+	@echo "Pushed mcp-auth-proxy to $(MCP_AUTH_PROXY_IMAGE):latest"
 
 # Credentials
 talosconfig:

charts/mcp-auth-proxy/templates/mcp-auth-proxy-git.yaml

@@ -13,9 +13,11 @@ spec:
       labels:
         app: mcp-auth-proxy-git
     spec:
+      imagePullSecrets:
+        - name: forgejo-registry
       containers:
         - name: mcp-auth-proxy
-          image: 024762953732.dkr.ecr.us-east-1.amazonaws.com/dumpnet/mcp-auth-proxy:latest
+          image: {{ .Values.registry.host }}/{{ .Values.registry.user }}/mcp-auth-proxy:latest
           args:
             - --external-url=https://git-mcp-oauth.dumpnet.chat
             - --no-auto-tls=true

charts/mcp-auth-proxy/templates/registry-secret.yaml

@@ -0,0 +1,27 @@
+{{- $host := .Values.registry.host }}
+{{- $user := .Values.registry.user }}
+apiVersion: external-secrets.io/v1
+kind: ExternalSecret
+metadata:
+  name: forgejo-registry
+  namespace: mcp
+  annotations:
+    argocd.argoproj.io/sync-wave: "-1"
+spec:
+  refreshInterval: 1h
+  secretStoreRef:
+    name: aws-secrets-manager
+    kind: ClusterSecretStore
+  target:
+    name: forgejo-registry
+    type: kubernetes.io/dockerconfigjson
+    template:
+      engineVersion: v2
+      data:
+        # When forking: update host/user to match your registry
+        .dockerconfigjson: '{"auths":{"{{ $host }}":{"username":"{{ $user }}","password":"{{ "{{" }} .registry_token {{ "}}" }}","auth":"{{ "{{" }} printf "{{ $user }}:%s" .registry_token | b64enc {{ "}}" }}"}}}'
+  data:
+    - secretKey: registry_token
+      remoteRef:
+        key: dumpnet
+        property: forgejo.registry_token

images/mcp-auth-proxy/Dockerfile

@@ -2,25 +2,20 @@ FROM golang:1.22-bookworm AS builder
 
 ENV GOTOOLCHAIN=auto
 
-# Pin to a specific release tag
 ARG VERSION=v2.10.2
 
 WORKDIR /app
 RUN git clone --depth 1 --branch ${VERSION} https://github.com/sigbit/mcp-auth-proxy .
 RUN go mod download
 
-ARG TARGETARCH
+RUN CGO_ENABLED=0 GOOS=linux GOARCH=amd64 \
-ARG TARGETOS
-RUN CGO_ENABLED=0 GOOS=$TARGETOS GOARCH=$TARGETARCH \
     go build -trimpath -ldflags "-w -s" -o /app/bin/mcp-auth-proxy .
 
-FROM debian:bookworm-slim
+FROM scratch
 
-RUN apt-get update && apt-get install -y --no-install-recommends \
+COPY --from=builder /etc/ssl/certs/ca-certificates.crt /etc/ssl/certs/
-    ca-certificates curl \
+COPY --from=builder /app/bin/mcp-auth-proxy /mcp-auth-proxy
-    && rm -rf /var/lib/apt/lists/*
 
-COPY --from=builder /app/bin/mcp-auth-proxy /usr/local/bin/mcp-auth-proxy
 ENV DATA_PATH=/data
 
-ENTRYPOINT ["/usr/local/bin/mcp-auth-proxy"]
+ENTRYPOINT ["/mcp-auth-proxy"]

terraform/ecr.tf

@@ -1,33 +0,0 @@
-resource "aws_ecr_repository" "dumpnet" {
-  name                 = "dumpnet/mcp-auth-proxy"
-  image_tag_mutability = "MUTABLE"
-
-  image_scanning_configuration {
-    scan_on_push = true
-  }
-
-  encryption_configuration {
-    encryption_type = "AES256"
-  }
-}
-
-resource "aws_ecr_lifecycle_policy" "dumpnet" {
-  repository = aws_ecr_repository.dumpnet.name
-
-  policy = jsonencode({
-    rules = [{
-      rulePriority = 1
-      description  = "Keep last 5 images per tag prefix"
-      selection = {
-        tagStatus     = "any"
-        countType     = "imageCountMoreThan"
-        countNumber   = 5
-      }
-      action = { type = "expire" }
-    }]
-  })
-}
-
-output "ecr_registry" {
-  value = aws_ecr_repository.dumpnet.repository_url
-}

terraform/iam.tf

@@ -58,24 +58,3 @@ resource "aws_iam_role_policy" "node_secrets_manager" {
 }
 
 
-# ECR pull access for node (to pull custom images like mcp-auth-proxy)
-resource "aws_iam_role_policy" "node_ecr" {
-  name = "ecr-pull"
-  role = aws_iam_role.node.id
-
-  policy = jsonencode({
-    Version = "2012-10-17"
-    Statement = [
-      {
-        Effect   = "Allow"
-        Action   = [
-          "ecr:GetDownloadUrlForLayer",
-          "ecr:BatchGetImage",
-          "ecr:BatchCheckLayerAvailability",
-          "ecr:GetAuthorizationToken"
-        ]
-        Resource = "*"
-      }
-    ]
-  })
-}

values.yaml

@@ -8,3 +8,6 @@ domain: dumpnet.chat
 repoURL: https://forge.keane.sh/ian/dumpnet-argo.git
 certEmail: dumpnetcerts@keane.sh
 awsRegion: us-east-1
+registry:
+  host: forge.keane.sh
+  user: ian