chore: artifactory and nexus

caching.md

@@ -43,6 +43,13 @@
   - e.g. backup and restore `node_modules` directory
   - Setup within pipelines
 
+- Important: proper cache key selection
+
+- Performance depends on the cache's storage location
+
+  - on node: fast but localized to node
+  - network storage: still has to download cache archive
+
 - Pro: Artifacts are downloaded directly from upstream, no further config needed
   - Con: Does not address rate limiting concerns for initial cache warm up
 - Pro: No extra config needed in tooling apart of pipeline cache config
@@ -66,7 +73,7 @@
 
 - Pro: Can be re-used in pipelines, dev machines, cloud/prod environments
 - Pro: Little state management necessary if any
-- Con: Requires extra config in tooling, build tools, containerd, etc
+- Con: Requires extra config in tooling, build tools, `containerd`, etc
 
 - Using only the pull-through cache should be fast enough for builds in CI
   - Reproducible builds ftw
@@ -75,17 +82,34 @@
 
 #### Forgejo Runner Cache
 
+- common actions like `setup-java` do a good job as they create dependencies on all build config files (e.g all `pom.xml`)
+  - invalidation if there is any change to dependencies etc.
+
 #### Nexus
 
-Open source / free version
+[Nexus OSS GH](https://github.com/sonatype/nexus-public)
 
-License evaluation needed
+- Open source / free version
+
+  - EPL License allows commercial distribution
+
+- OSS version only has an extremely limited feature set of supported repository types.
+
+  - basically only maven support
+  - does not suffice for our use case
+
+- Community Edition has more features but is limited in sizing. Upgrade to Pro edition necessary in those limits are exceeded.
 
 #### Artifactory
 
-Open source / free version
+- Open source / free version
+  - Limited feature set
+  - Separate distributions per repo type java / container / etc
+
+- Inconvenient and insufficient for our use case
 
 License evaluation needed
+[EULA](https://jfrog.com/artifactory/eula/)
 
 #### Artipie
 
@@ -115,9 +139,16 @@ License evaluation needed
 
 #### 'Simple' Squid proxy (or similar)
 
+- Caching of arbitrary resouces via HTTP
+
 #### Harbor
 
 ### Recommendation
 
-- Avoid using fs cache, i.e. forgejo runner cache, long term or at all
-  - Promote immutable infra and reproducible builds without side effects
+- File system cache
+  - Easy solution as it is offered within most pipelines
+  - Reduces build times significantly if dependencies have to be downloaded from outside networks
+  - Avoid using fs cache, i.e. forgejo runner cache, long term or at all
+    - Unless you can handle proper cache invalidation
+    - Promote immutable infra and reproducible builds without side effects
+  - Use as additional layer if there is no local cache repo