admin
761dc3856e
New operator CLI (curl+jq, dry-run default) to list, prune (keep-N or older-than), and reclaim old container images in the self-hosted Gitea registry. Reclaim implements the three-step mechanism proven live on Gitea 1.26.2: delete tag (frees only the index pointer) -> delete the orphaned sha256 manifest versions (default cleanup_packages does NOT remove untagged manifests) -> cleanup_packages cron GCs the now unreferenced blobs. Orders by upload date, protects ^latest$, fail-closed orphan detection, audit log, never logs the token. Live-verified: single-version spike freed 5.1 MiB; cleaning felhom-hub's 16 orphan manifests freed 86 MiB; surviving tags still docker-pull. felhom-controller and other packages left untouched for the operator. Adds README section (usage, minimal token scopes, reclaim caveat, native cleanup-rule recommendation), CHANGELOG, REPORT, and .gitattributes (LF). Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
1.9 KiB
1.9 KiB
Changelog — misc-scripts
All notable changes to the operator helper scripts. Newest on top.
2026-06-17
Added — gitea-image-prune.sh
- New operator CLI to inspect and prune old container images in the self-hosted
Gitea registry (
gitea.dooplex.hu, owneradmin) and reclaim disk on the Longhorn-backed packages PVC. Purecurl+jq; interactive menu + scriptable flags. Safe dry-run default. - Modes:
list(per-tag upload date + apparent image size, newest-first, shared-layer caveat),prune(--keep Nor--older-than DAYS; always protects^latest$+--protectregexes),reclaim(delete orphaned manifest versions + trigger/await thecleanup_packagesGC cron).--measuredoes best-effort before/afterduviakubectl. - Implements the three-step reclaim mechanism proven live on Gitea 1.26.2:
deleting a tag frees only the index pointer; the orphaned
sha256:manifest versions must also be deleted (defaultcleanup_packagesdoes not remove untagged manifests); the cron then GCs the unreferenced blobs. Orphan detection is fail-closed. - Safety: orders by upload date (never parses mixed
v/bare tags), checks every HTTP status, never echoes/logs the token, audit log per run, typed confirmation on--apply(stricter for--all). - Token via
GITEA_TOKEN/--token-file. Minimal scopes documented in README:read:package(list),write:package(delete),read:admin(cron list),write:admin(cron trigger). - README section added documenting usage, scopes, the reclaim caveat, the live verification result, and the native cleanup-rule recommendation.
Changed — Gitea instance (operational, not a script change)
- Added
[cron.cleanup_packages] RUN_AT_START = trueto Gitea'sapp.ini(on the data PVC) so the package GC also runs on every Gitea restart. Enables reclaim without awrite:admintoken. Backup atapp.ini.bak.prune-spike.