From e9d6fd4a173161a81daabf093dbdad3c0ba56369 Mon Sep 17 00:00:00 2001
From: nick-gorse <nick@olb42.com>
Date: Tue, 16 Jun 2026 16:33:58 +0100
Subject: [PATCH] update helm-auth

---
 .../production/repo-server-patch.yaml         | 43 +++++++++++++++++++
 1 file changed, 43 insertions(+)

diff --git a/manifest/overlays/production/repo-server-patch.yaml b/manifest/overlays/production/repo-server-patch.yaml
index 1f90eed..29d0db7 100644
--- a/manifest/overlays/production/repo-server-patch.yaml
+++ b/manifest/overlays/production/repo-server-patch.yaml
@@ -31,6 +31,44 @@ spec:
           volumeMounts:
             - mountPath: /var/run/argocd
               name: var-files
+        - name: ghcr-auth
+          image: quay.io/argoproj/argocd:v3.4.3
+          command:
+            - sh
+            - -c
+          args:
+            - /bin/cp --update=none /usr/local/bin/argocd /var/run/argocd/argocd && /bin/ln -s /var/run/argocd/argocd /var/run/argocd/argocd-cmp-server
+          securityContext:
+            allowPrivilegeEscalation: false
+            capabilities:
+              drop:
+                - ALL
+            readOnlyRootFilesystem: true
+            runAsNonRoot: true
+            seccompProfile:
+              type: RuntimeDefault
+          env:
+            - name: HELM_CONFIG_HOME
+              value: /helm-auth
+            - name: HELM_REGISTRY_CONFIG
+              value: /helm-auth/config.json
+            - name: GITEA_USERNAME
+              valueFrom:
+                secretKeyRef:
+                  name: gitea-basic-authregcred
+                  key: username
+            - name: GITEA_PASSWORD
+              valueFrom:
+                secretKeyRef:
+                  name: gitea-basic-authregcred
+                  key: password
+          volumeMounts:
+            - name: registry-auth-dir
+              mountPath: /helm-auth
+          command:
+            - /bin/bash
+            - -exc
+            - 'echo -n $GITEA_PASSWORD | helm registry login git.olb42.com --username $GITEA_USERNAME --password-stdin -'
       containers:
         - name: argocd-lovely-plugin
           image: ghcr.io/crumbhole/lovely:1.2.4
@@ -55,3 +93,8 @@ spec:
       volumes:
         - name: lovely-tmp
           emptyDir: {}
+        - name: registry-auth-dir
+          emptyDir: {}
+      volumeMounts:
+        - name: registry-auth-dir
+          mountPath: /helm-auth