Erich Blume 6b84a5688e Add docs/ directory with blumeops zk cards

Move 21 blumeops-tagged zettelkasten cards from ~/code/personal/zk/
to docs/ in this repository. These files are symlinked back into the
zk at ~/code/personal/zk/blumeops for seamless obsidian.nvim integration.

This enables:
- Git-managed documentation in the blumeops repo
- Preserved wiki links between blumeops docs
- obsidian-sync isolation (docs don't sync to other devices)
- Direct editing via obsidian.nvim with the blumeops workspace

Also updates zk-docs mise task to read from local docs/ directory.

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>

2026-02-02 19:17:10 -08:00

3.4 KiB

Raw Blame History

aliases

Zot Registry Management Log

Zot is an OCI-native container registry running on Indri, providing:

Pull-through cache for Docker Hub, GHCR, Quay (avoids rate limits)
Private image storage for custom-built containers

Service Details

URL: https://registry.ops.eblu.me
Local port: 5050
Data directory: ~/zot
Config: ~/.config/zot/config.json
Managed via: mcquack LaunchAgent

Namespace Convention

Path	Source
`registry.../docker.io/*`	Cached from Docker Hub
`registry.../ghcr.io/*`	Cached from GHCR
`registry.../quay.io/*`	Cached from Quay
`registry.../blumeops/*`	Private images (yours)

How It Works

Pull-Through Cache (Automatic)

When minikube pulls an image like docker.io/library/nginx:latest:

Containerd checks zot first (via host.minikube.internal:5050)
If zot has it cached, returns immediately
If not, zot fetches from upstream, caches it, returns to k8s

Cached images appear under their original registry path (e.g., docker.io/library/nginx).

Private Images (Manual Push)

Build and push from gilbert using podman:

# Build
podman build -t registry.ops.eblu.me/blumeops/myapp:v1 .

# Push to zot
podman push registry.ops.eblu.me/blumeops/myapp:v1

# Use in k8s manifest
image: registry.ops.eblu.me/blumeops/myapp:v1

Private images go under blumeops/* namespace. Example: the devpi container is at registry.ops.eblu.me/blumeops/devpi:latest.

Security Model

Network access only - no authentication configured. Anyone who can reach zot via Tailscale ACL can push/pull any image. Defense is the tailnet boundary.

Zot supports htpasswd/LDAP/OIDC auth if needed in the future.

Minikube Integration

The minikube cluster uses zot as a registry mirror via containerd configuration. Managed by the ansible minikube role.

From inside minikube, zot is at host.minikube.internal:5050. Containerd tries the mirror first, falls back to upstream if not cached.

Mirrors configured for: registry.ops.eblu.me, docker.io, ghcr.io, quay.io

Useful Commands

# List all cached/pushed images
curl -s http://indri:5050/v2/_catalog | jq

# List tags for an image
curl -s http://indri:5050/v2/blumeops/devpi/tags/list | jq

# Check service status
ssh indri 'launchctl list | grep zot'

# View logs
ssh indri 'tail -f ~/Library/Logs/mcquack.zot.err.log'

Log

2026-01-25

Migrated from Tailscale serve to Caddy - now accessible at registry.ops.eblu.me
Retired tailscale_serve ansible role (no longer needed)
Updated minikube containerd config to use new URL
Updated CI workflows and mise tasks
Old URL (registry.tail8d86e.ts.net) deprecated

2026-01-21

Verified full workflow: podman build on gilbert → push to zot → k8s pull
Documented security model (network-only auth via Tailscale ACL)
Updated minikube integration: now uses containerd (docker driver) instead of CRI-O (podman driver)
Mirror endpoint changed from host.containers.internal:5050 to host.minikube.internal:5050

2026-01-19

Integrated with minikube as CRI-O registry mirror
All k8s image pulls now go through zot cache automatically

2026-01-18

Initial setup for k8s migration Phase 0
Configured pull-through cache for Docker Hub, GHCR, Quay
Exposed via Tailscale service at registry.tail8d86e.ts.net

3.4 KiB Raw Blame History