From 24d67d07db98c961f9744b9fc6b2acdf5a1f95e0 Mon Sep 17 00:00:00 2001 From: Audiobuzz Date: Sun, 5 Jul 2026 01:34:10 +0000 Subject: [PATCH] serving: mirror the remaining base/service images through Harbor Route the pre-existing non-CI image pulls through harbor.bitasylum.org per the standing rule (harbor.bitasylum.org///): - enrol-broker/Dockerfile: golang:1.23-alpine -> dockerhub/library/..., smallstep/step-cli:latest -> dockerhub/smallstep/... - dot1x-bench/docker-compose.yml: smallstep/step-ca + freeradius/freeradius-server -> dockerhub//... CI-built git.bitasylum.org/audiobuzz/* images and ${OCI_IMAGE}/${IPXE_IMAGE} type:image volume mounts are unchanged. --- serving/dot1x-bench/docker-compose.yml | 4 ++-- serving/enrol-broker/Dockerfile | 4 ++-- 2 files changed, 4 insertions(+), 4 deletions(-) diff --git a/serving/dot1x-bench/docker-compose.yml b/serving/dot1x-bench/docker-compose.yml index 75a8a59..35710ed 100644 --- a/serving/dot1x-bench/docker-compose.yml +++ b/serving/dot1x-bench/docker-compose.yml @@ -15,7 +15,7 @@ services: # --- Fleet CA (signs TPM-generated CSRs; trust anchor for the image) -------- step-ca: - image: smallstep/step-ca:latest + image: harbor.bitasylum.org/dockerhub/smallstep/step-ca:latest network_mode: host restart: unless-stopped environment: @@ -38,7 +38,7 @@ services: # --- RADIUS (EAP-TLS; validates client cert vs step-ca root, returns MSK) --- freeradius: - image: freeradius/freeradius-server:latest + image: harbor.bitasylum.org/dockerhub/freeradius/freeradius-server:latest network_mode: host # RADIUS 1812/1813 from the authenticator restart: unless-stopped depends_on: diff --git a/serving/enrol-broker/Dockerfile b/serving/enrol-broker/Dockerfile index 3fa19dd..10fc591 100644 --- a/serving/enrol-broker/Dockerfile +++ b/serving/enrol-broker/Dockerfile @@ -7,14 +7,14 @@ # # Pin + mirror these base tags through your registry (like the rest of the stack) # if the build/serving host has no egress. -FROM golang:1.23-alpine AS build +FROM harbor.bitasylum.org/dockerhub/library/golang:1.23-alpine AS build WORKDIR /src COPY go.mod . COPY *.go wordlist.txt ./ ENV CGO_ENABLED=0 GOPROXY=off GOTOOLCHAIN=local RUN go build -trimpath -buildvcs=false -ldflags '-s -w -buildid=' -o /enrol-broker . -FROM smallstep/step-cli:latest +FROM harbor.bitasylum.org/dockerhub/smallstep/step-cli:latest COPY --from=build /enrol-broker /usr/local/bin/enrol-broker # Non-root by default (the step-cli image runs as uid 1000 "step"); the broker # binds loopback ports >1024 and only READS the mounted CA root + provisioner