infra(apt): set up self-hosted APT repo at packages.satware.com/apt/ (reprepro + GPG)

[satwareAG-ironMike]

Context

The self-hosted APT repository at packages.satware.com/apt/ serves .deb files with GPG-signed metadata. This is the production hosting infrastructure for Phase 1 packages.

Architecture:

packages.satware.com (VPS)
├── Caddy (:443, TLS)
│   └── /apt/* → file_server (static, no auth)
│       └── /var/www/apt/
│           ├── dists/bookworm/main/binary-amd64/Packages.gz
│           ├── dists/noble/main/binary-amd64/Packages.gz
│           └── pool/main/p/php8.4-firebird/php8.4-firebird_13.0.0-1_amd64.deb
└── GPG key for signing Release/InRelease files

Note: This issue is tracked in the satis repo (GitLab) as part of spec 007. This GitHub issue tracks the php-firebird side (CI integration, package naming, deploy key setup).

Acceptance Criteria

• VPS provisioned at packages.satware.com (shared with satis spec 005 deployment)
• Caddy vhost serves /apt/* as static files (no auth, public)
• reprepro installed and configured on VPS
• GPG keypair generated for APT repo signing (key ID satware-php-firebird)
• Public key published at packages.satware.com/keys/apt-gpg.key
• reprepro configured for distributions: bookworm, trixie, jammy, noble
• Architectures: amd64, arm64 (armhf added in Phase 3)
• SSH deploy key configured for CI rsync (secret APT_DEPLOY_SSH_KEY in GitHub)
• First test: apt install php8.4-firebird works on a clean Debian 12 container

Dependencies

• Satis spec 007 (Linux Package Repository) — defines the VPS + Caddy config
• Satis spec 005 (Production Deployment) — may share VPS provisioning
• Release 6.2.0 Validation - All 85 Tests Passing #7 (packages-linux.yml CI) — needs the deploy target

Suggested Test Plan

1. On clean Debian 12: add apt source deb https://packages.satware.com/apt bookworm main
2. curl -fsSL https://packages.satware.com/keys/apt-gpg.key | apt-key add -
3. apt update && apt install php8.4-firebird
4. php -m | grep firebird — loaded
5. apt-cache policy php8.4-firebird — shows version 13.0.0-1 from satware repo

[satwareAG-ironMike]

Created comprehensive cross-project requirements issue in satis GitLab:

https://gitlab.satware.com/satware/satis/-/work_items/15

Consolidates exact requirements for:

• VPS SSH access (port 22 currently closed - primary blocker)
• GPG signing key generation
• 3 GitHub secrets to configure (APT_DEPLOY_SSH_KEY, APT_DEPLOY_KNOWN_HOSTS, APT_GPG_PRIVATE_KEY)
• APT metadata regeneration on VPS
• Caddy vhost configuration
• End-user install flow

Supersedes stale references in satis #10-#13 (which referenced closed issues #483, #487). All php-firebird CI code is done and working - only the VPS infrastructure remains.

[satwareAG-ironMike]

Satis-side contract update (2026-09-03, post spec 008 staging go-live)

The architecture in this issue is superseded by satis spec 008 - verified live on staging (packages.auc.de, install-test 4/4 on 2026-08-31). Tracked from the satis side in satis#15 / #12 / #10. Stale ACs flagged at the bottom.

What packages.satware.com/apt/ will serve (verified design, mirrors live staging)

Aspect	Contract
Layout	dists/<suite>/main/binary-amd64/{Packages.gz,Release,Release.gpg} + pool/main/p/php8.x-firebird/*.deb
Suites	bookworm + noble (noble aliases the same pool - debs are distro-agnostic)
Metadata tool	apt-ftparchive (not reprepro)
Signing	Release + detached Release.gpg only, NO InRelease - GPG 2.4.9 clearsign output is rejected by apt's parser; a stale InRelease would shadow the signed pair, so sign-release removes it
Key URL	https://packages.satware.com/keys/prod-gpg.pub.asc (spec 007 Phase C naming; staging serves keys/staging-gpg.pub.asc)
Consumer line	deb [signed-by=/usr/share/keyrings/satware-archive-keyring.gpg] https://packages.satware.com/apt bookworm main
Access	Public, no token gate (spec 007 decision)

Asset contract the publish pipeline consumes from GitHub Releases

• Exactly php8.{2,3,4,5}-firebird_<ver>-1_amd64.deb per tag, <ver> = tag without the v prefix (current: php8.4-firebird_13.2.7-1_amd64.deb) - keep these names stable, the Gitea-runner download step regex-matches them
• CHECKSUMS-SHA256.txt is fetched for integrity
• Keep .deb extension-only: php8.4-firebird must NOT depend on php8.x-cli (no php binary without it - discovered during the live install test, satis-deploy 894deb7)

Superseded / stale items in this issue's ACs

AC as written	Current reality
reprepro on VPS	apt-ftparchive in debian:12 container (Gitea runner, spec 008)
SSH deploy key APT_DEPLOY_SSH_KEY + CI rsync	No SSH: Gitea runner on the storage host downloads release assets and deploys via volume mount
apt-key add test flow	apt-key cannot see signed-by keyrings - use signed-by + gpgv verification (implemented in the staging install test)
Key at keys/apt-gpg.key	keys/prod-gpg.pub.asc
dists bookworm, trixie, jammy, noble	bookworm + noble (added on demand)
arch amd64 + arm64	amd64 first (arm64 = Phase 3, unchanged)

New upstream facts (v13.2.7, 2026-08-12)

The release now also ships php-firebird-13.2.7-1.fc41.x86_64.rpm and php84-firebird-13.2.7-r0.apk. The YUM/APK channels (#499, satis spec 007 phases) therefore have artifacts available before the channels are served. Flag for #499: satis spec 007's YUM acceptance targets AlmaLinux 8 containers, the current .rpm is built for fc41 - either add an el8 build or re-scope the spec 007 YUM acceptance to a Fedora target.

Replacement test plan (production)

1. Clean debian:12: install sury php base, fetch keys/prod-gpg.pub.asc -> /usr/share/keyrings/satware-archive-keyring.gpg
2. Add the signed-by source line above, apt-get update
3. apt-get install php8.4-firebird; php -m | grep -E 'firebird|pdo_fbird'
4. Explicit gpgv --keyring ... Release.gpg Release verification
   (Identical to the staging install test that passed 4/4 on 2026-08-31.)