FreeRADIUS

Packaging and delivery of a custom FreeRADIUS 3.2.x build for hotspot / captive-portal scenarios. There is no application code here — the repo builds upstream FreeRADIUS with the extra rlm_raw module and ships it to two runtimes (bare-metal and Kubernetes) via a Gitea-hosted registry.

Single source of version truth

VERSION holds the FreeRADIUS release (3.2.8). CI derives everything from it: the build tag release_3_2_8, the package pin 3.2.8+git, the chart appVersion. CI fails if packaging/hosted/.env or charts/freeradius/Chart.yaml drift from VERSION.

Layout

VERSION                       single source of the FreeRADIUS version
.gitea/workflows/release.yaml  manual release pipeline (Gitea Actions)
packaging/
  deb/      build the .deb from FreeRADIUS source + rlm_raw, upload to registry
  image/    runtime container image (installs the .deb, bakes configs)
  hosted/   bare-metal / VM install (install.sh, update.sh, config, cron)
charts/
  freeradius/  productized Helm chart

Artifacts (Gitea, owner pub)

Artifact	Registry
.deb packages	https://git.ahax86.ru/api/packages/pub/debian (noble main)
Container image	git.ahax86.ru/pub/freeradius:<version>
Hosted bundle	.../api/packages/pub/generic/freeradius-hosted/<version>/freeradius-hosted.tar.gz
Helm chart	https://git.ahax86.ru/api/packages/pub/helm

Release flow (.gitea/workflows/release.yaml, manual)

prepare ──► build-deb ──► build-image ──► package-helm
                     └──► package-hosted

The .deb is the prerequisite: build-image and package-hosted both needs: build-deb and verify the pinned version exists in the Debian registry before running. Trigger from Gitea → Actions → release → Run workflow.

CI setup (Gitea)

1. Runner. Enable Actions for the repo and register an ubuntu-latest runner (act_runner) with Docker available. If your runner uses a different label, change runs-on in the workflow.
2. Access token. Gitea → avatar → Settings → Applications → Manage Access Tokens → Generate New Token. Scopes: write:package and read:package. Copy the token (shown once).
3. Repo secrets. Repo → Settings → Actions → Secrets → Add Secret:
   • PACKAGES_USER — your Gitea username (the token owner).
   • PACKAGES_TOKEN — the token from step 2.

These secrets are used to push to the container / Debian / generic / Helm registries and to read the Debian Packages index in the gate check.

Local builds (no upload)

# .deb builder image
docker build packaging/deb -f packaging/deb/Dockerfile \
  --build-arg RADIUS_TAG=release_3_2_8 --build-arg RLM_RAW_BRANCH=v3.2.4 \
  -t freerad-builder:3.2.8

# runtime image (context = repo root; pulls .deb from the Debian registry)
docker build -f packaging/image/Dockerfile --build-arg PKG_VERSION=3.2.8+git -t freeradius:3.2.8 .

# chart
helm lint charts/freeradius --set db.password=test
helm template freeradius charts/freeradius --set db.password=test

Deployment docs

• Bare-metal / VM: packaging/hosted/README.md
• Kubernetes (Helm): charts/freeradius/README.md

Internals

See agent/INDEX.md for invariants, hosts/ports, backends and known constraints.