99e1245ed3
- CI: replace GitLab pipeline with Gitea Actions (.gitea/workflows/release.yaml); publish .deb/image/hosted/chart to Gitea registries; gate image+hosted on .deb (needs + registry pre-check) - drop connectone/Nexus; apt now from the Gitea Debian registry - single version source (/VERSION=3.2.8); CI enforces .env/Chart consistency - restructure: build/->packaging/deb, root Dockerfile->packaging/image, hosted/->packaging/hosted, .kube/->charts/freeradius - Helm chart: documented values, DB password via Secret/$ENV, configurable scheduling/persistence; remove plaintext creds and hostPath PV - gitignore *.env_cnf; docs for hosted (RU)/helm/root + agent KB sync Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
FreeRADIUS
Packaging and delivery of a custom FreeRADIUS 3.2.x build for
hotspot / captive-portal scenarios. There is no application code here — the repo
builds upstream FreeRADIUS with the extra rlm_raw module and ships it to two
runtimes (bare-metal and Kubernetes) via a Gitea-hosted registry.
Single source of version truth
VERSION holds the FreeRADIUS release (3.2.8). CI derives everything
from it: the build tag release_3_2_8, the package pin 3.2.8+git, the chart
appVersion. CI fails if packaging/hosted/.env or charts/freeradius/Chart.yaml
drift from VERSION.
Layout
VERSION single source of the FreeRADIUS version
.gitea/workflows/release.yaml manual release pipeline (Gitea Actions)
packaging/
deb/ build the .deb from FreeRADIUS source + rlm_raw, upload to registry
image/ runtime container image (installs the .deb, bakes configs)
hosted/ bare-metal / VM install (install.sh, update.sh, config, cron)
charts/
freeradius/ productized Helm chart
Artifacts (Gitea, owner pub)
| Artifact | Registry |
|---|---|
.deb packages |
https://git.ahax86.ru/api/packages/pub/debian (noble main) |
| Container image | git.ahax86.ru/pub/freeradius:<version> |
| Hosted bundle | .../api/packages/pub/generic/hosted/<version>/hosted.tar.gz |
| Helm chart | https://git.ahax86.ru/api/packages/pub/helm |
Release flow (.gitea/workflows/release.yaml, manual)
prepare ──► build-deb ──► build-image ──► package-helm
└──► package-hosted
The .deb is the prerequisite: build-image and package-hosted both needs: build-deb and verify the pinned version exists in the Debian registry
before running. Trigger from Gitea → Actions → release → Run workflow.
CI setup (Gitea)
- Runner. Enable Actions for the repo and register an
ubuntu-latestrunner (act_runner) with Docker available. If your runner uses a different label, changeruns-onin the workflow. - Access token. Gitea → avatar → Settings → Applications →
Manage Access Tokens → Generate New Token. Scopes:
write:packageandread:package. Copy the token (shown once). - Repo secrets. Repo → Settings → Actions → Secrets → Add Secret:
PACKAGES_USER— your Gitea username (the token owner).PACKAGES_TOKEN— the token from step 2.
These secrets are used to push to the container / Debian / generic / Helm
registries and to read the Debian Packages index in the gate check.
Local builds (no upload)
# .deb builder image
docker build packaging/deb -f packaging/deb/Dockerfile \
--build-arg RADIUS_TAG=release_3_2_8 --build-arg RLM_RAW_BRANCH=v3.2.4 \
-t freerad-builder:3.2.8
# runtime image (context = repo root; pulls .deb from the Debian registry)
docker build -f packaging/image/Dockerfile --build-arg PKG_VERSION=3.2.8+git -t freeradius:3.2.8 .
# chart
helm lint charts/freeradius --set db.password=test
helm template freeradius charts/freeradius --set db.password=test
Deployment docs
- Bare-metal / VM: packaging/hosted/README.md
- Kubernetes (Helm): charts/freeradius/README.md
Internals
See agent/INDEX.md for invariants, hosts/ports, backends and known constraints.