alex_chevski/docker-registry
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

init

Browse Source
This commit is contained in:
alex-chevski
2023-12-08 21:53:09 +03:00
commit 543fb175b5
22 changed files with 361 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

27
Makefile Normal file
View File

@@ -0,0 +1,27 @@
init: docker-down-clear docker-pull docker-build docker-up
up: docker-up
down: docker-down
docker-up:
docker compose up -d
docker-down:
docker compose down --remove-orphans
docker-down-clear:
docker compose down -v --remove-orphans
docker-pull:
docker compose pull
docker-build:
docker compose build
deploy:
ssh ${HOST} -p ${PORT} 'rm -rf registry && mkdir registry'
scp -P ${PORT} docker-compose-production.yml ${HOST}:registry/docker-compose.yml
scp -P ${PORT} -r docker ${HOST}:registry/docker
scp -P ${PORT} ${HTPASSWD_FILE} ${HOST}:registry/htpasswd
ssh ${HOST} -p ${PORT} 'cd registry && echo "COMPOSE_PROJECT_NAME=registry" >> .env'
ssh ${HOST} -p ${PORT} 'cd registry && docker-compose pull'
ssh ${HOST} -p ${PORT} 'cd registry && docker-compose up --build --remove-orphans -d'

1
README.md Normal file
View File

@@ -0,0 +1 @@
<h1>Docker registry before docker site</h1>

23
docker-compose-production.yml Normal file
View File

@@ -0,0 +1,23 @@
version: '3.7'
services:
nginx:
image: nginx:alpine
restart: always
ports:
- "5443:443"
volumes:
- /etc/letsencrypt:/etc/letsencrypt:ro
- /var/www/html:/var/www/html:ro
- ./docker/production/nginx/conf.d:/etc/nginx/conf.d:ro
- ./htpasswd:/etc/nginx/auth/htpasswd:ro
depends_on:
- registry
registry:
image: registry:2
restart: always
volumes:
- registry:/var/lib/registry
volumes:
registry:

19
docker-compose.yml Normal file
View File

@@ -0,0 +1,19 @@
version: '3.7'
services:
nginx:
image: nginx:alpine
ports:
- "5000:5000"
volumes:
- ./docker/development/nginx/conf.d:/etc/nginx/conf.d
- ./docker/development/nginx/auth/htpasswd:/etc/nginx/auth/htpasswd
depends_on:
- registry
registry:
image: registry:2
volumes:
- registry:/var/lib/registry
volumes:
registry:

24
docker/development/nginx/conf.d/registry.conf Normal file
View File

@@ -0,0 +1,24 @@
server {
listen 5000;
server_tokens off;
client_max_body_size 0;
chunked_transfer_encoding on;
location /v2/ {
if ($http_user_agent ~ "^(docker\/1\.(3|4|5(?!\.[0-9]-dev))|Go ).*$" ) {
return 404;
}
# To add basic authentication to v2 use auth_basic setting.
auth_basic "Registry realm";
auth_basic_user_file /etc/nginx/auth/htpasswd;
proxy_pass http://registry:5000;
proxy_set_header Host $http_host; # required for docker client's sake
proxy_set_header X-Real-IP $remote_addr; # pass on real client's IP
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Proto $scheme;
proxy_read_timeout 900;
}
}

66
docker/production/nginx/conf.d/registry.conf Normal file
View File

@@ -0,0 +1,66 @@
server {
listen 80;
server_name registry.demo-auction.pro-maker.ru;
server_tokens off;
location ~ /\.well\-known {
root /var/www/html;
}
rewrite ^(.*) https://registry.demo-auction.pro-maker.ru$1 permanent;
}
server {
listen 443 ssl;
server_name registry.demo-auction.pro-maker.ru;
server_tokens off;
# SSL
ssl_certificate /etc/letsencrypt/live/registry.demo-auction.pro-maker.ru/fullchain.pem;
ssl_certificate_key /etc/letsencrypt/live/registry.demo-auction.pro-maker.ru/privkey.pem;
ssl_trusted_certificate /etc/letsencrypt/live/registry.demo-auction.pro-maker.ru/chain.pem;
# Recommendations from https://raymii.org/s/tutorials/Strong_SSL_Security_On_nginx.html
ssl_protocols TLSv1.1 TLSv1.2;
ssl_ciphers 'EECDH+AESGCM:EDH+AESGCM:AES256+EECDH:AES256+EDH';
ssl_prefer_server_ciphers on;
ssl_session_cache shared:SSL:10m;
ssl_stapling on;
ssl_stapling_verify on;
resolver 127.0.0.11 ipv6=off valid=300s;
add_header Strict-Transport-Security "max-age=31536000";
add_header Content-Security-Policy "block-all-mixed-content";
# disable any limits to avoid HTTP 413 for large image uploads
client_max_body_size 0;
# required to avoid HTTP 411: see Issue #1486 (https://github.com/moby/moby/issues/1486)
chunked_transfer_encoding on;
location ~ /\.well\-known {
root /var/www/html;
}
location /v2/ {
# Do not allow connections from docker 1.5 and earlier
# docker pre-1.6.0 did not properly set the user agent on ping, catch "Go *" user agents
if ($http_user_agent ~ "^(docker\/1\.(3|4|5(?!\.[0-9]-dev))|Go ).*$" ) {
return 404;
}
# To add basic authentication to v2 use auth_basic setting.
auth_basic "Registry realm";
auth_basic_user_file /etc/nginx/auth/htpasswd;
proxy_pass http://registry:5000;
proxy_set_header Host $http_host; # required for docker client's sake
proxy_set_header X-Real-IP $remote_addr; # pass on real client's IP
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Proto $scheme;
proxy_read_timeout 900;
}
}

2
provisioning/.gitignore vendored Normal file
View File

@@ -0,0 +1,2 @@
/hosts.yml
/htpasswd

8
provisioning/Makefile Normal file
View File

@@ -0,0 +1,8 @@
server:
ansible-playbook server.yml -i hosts.yml
authorize:
ansible-playbook authorize.yml -i hosts.yml
upgrade:
ansible-playbook upgrade.yml -i hosts.yml

9
provisioning/authorize.yml Normal file
View File

@@ -0,0 +1,9 @@
---
- name: Add authorized key
hosts: all
remote_user: root
tasks:
- name: Add user authorized key
authorized_key:
user: deploy
key: "{{ lookup('file', '~/.ssh/id_rsa.pub') }}"

9
provisioning/hosts.yml.dist Normal file
View File

@@ -0,0 +1,9 @@
all:
children:
site:
hosts:
server:
ansible_connection: ssh
ansible_user: root
ansible_host: 0.0.0.0
ansible_port: 22

3
provisioning/roles/certbot/files/cli.ini Normal file
View File

@@ -0,0 +1,3 @@
authenticator = webroot
webroot-path = /var/www/html
text = True

30
provisioning/roles/certbot/tasks/main.yml Normal file
View File

@@ -0,0 +1,30 @@
---
- name: Add Certbot repository
apt_repository:
repo: 'deb http://ftp.debian.org/debian buster-backports main'
state: present
filename: buster-backports
update_cache: yes
- name: Install Certbot
apt:
name: certbot
state: present
default_release: buster-backports
update_cache: yes
- name: Copy Certbot configuration
copy:
src: files/cli.ini
dest: /etc/letsencrypt/cli.ini
owner: root
group: root
mode: 0644
- name: Remove useless packages
apt:
autoclean: yes
- name: Remove useless dependencies
apt:
autoremove: yes

6
provisioning/roles/docker/handlers/main.yml Normal file
View File

@@ -0,0 +1,6 @@
---
- name: Start docker on boot
systemd:
name: docker
state: started
enabled: yes

56
provisioning/roles/docker/tasks/main.yml Normal file
View File

@@ -0,0 +1,56 @@
---
- name: Install dependencies
apt:
name:
- apt-transport-https
- ca-certificates
- curl
- software-properties-common
state: present
update_cache: yes
- name: Add GPG key
apt_key:
url: https://download.docker.com/linux/debian/gpg
state: present
- name: Verify fingerprint
apt_key:
id: 0EBFCD88
state: present
- name: Set up the repository
apt_repository:
repo: deb [arch=amd64] https://download.docker.com/linux/debian stretch stable
state: present
filename: docker
update_cache: yes
- name: Install Docker
apt:
name: docker-ce
state: present
update_cache: yes
notify: Start docker on boot
- name: Install Docker Compose
get_url:
url: https://github.com/docker/compose/releases/download/1.25.0/docker-compose-{{ ansible_system }}-{{ ansible_userspace_architecture }}
dest: /usr/local/bin/docker-compose
group: docker
mode: 'u+x,g+x'
- name: Set periodic Docker prune
cron:
name: docker-prune
job: 'docker system prune -af --filter "until=$((30*24))h"'
minute: '0'
hour: '1'
- name: Remove useless packages
apt:
autoclean: yes
- name: Remove useless dependencies
apt:
autoremove: yes

3
provisioning/roles/registry/defaults/main.yml Normal file
View File

@@ -0,0 +1,3 @@
certbot_email: mail@pro-maker.ru
certbot_hosts:
- registry.pod-domen.domen.ru

5
provisioning/roles/registry/tasks/add_certbot_hook.yml Normal file
View File

@@ -0,0 +1,5 @@
---
- name: Add Certbot hook
lineinfile:
path: /etc/letsencrypt/cli.ini
line: "post-hook = /bin/sh -c 'cd /home/deploy/registry && docker-compose restart nginx'"

8
provisioning/roles/registry/tasks/create_user.yml Normal file
View File

@@ -0,0 +1,8 @@
---
- name: Create deploy user
user:
name: deploy
password: '!'
groups:
- docker
state: present

26
provisioning/roles/registry/tasks/generate_certificates.yml Normal file
View File

@@ -0,0 +1,26 @@
---
- name: Check if certificate already exists
stat:
path: /etc/letsencrypt/live/{{ item }}/cert.pem
register: letsencrypt_certs
with_items: "{{ certbot_hosts }}"
- name: Check if server is running
wait_for:
port: 80
timeout: 1
register: port_check
ignore_errors: yes
- name: Up certbot standalone Apache
shell: "docker run -d --name apache -v /var/www/html:/usr/local/apache2/htdocs/ -p 80:80 httpd:2.4"
when: port_check.failed == true
- name: Generate new certificate
shell: "certbot certonly --noninteractive --agree-tos --email {{ certbot_email }} -d {{ item.item }}"
with_items: "{{ letsencrypt_certs.results }}"
when: not item.stat.exists
- name: Down certbot Apache
shell: "docker rm -f apache"
when: port_check.failed == true

2
provisioning/roles/registry/tasks/main.yml Normal file
View File

@@ -0,0 +1,2 @@
- import_tasks: generate_certificates.yml
- import_tasks: create_user.yml

8
provisioning/server.yml Normal file
View File

@@ -0,0 +1,8 @@
---
- name: Provision Site
hosts: all
remote_user: root
roles:
- docker
- certbot
- registry

20
provisioning/upgrade.yml Normal file
View File

@@ -0,0 +1,20 @@
---
- name: Upgrade
hosts: all
remote_user: root
tasks:
- name: Update APT package cache
apt:
update_cache: yes
- name: Upgrade APT to the last packages
apt:
upgrade: dist
- name: Remove useless packages
apt:
autoclean: yes
- name: Remove useless dependencies
apt:
autoremove: yes

6
tags Normal file
View File

@@ -0,0 +1,6 @@
!_TAG_FILE_FORMAT 2 /extended format; --format=1 will not append ;" to lines/
!_TAG_FILE_SORTED 1 /0=unsorted, 1=sorted, 2=foldcase/
!_TAG_PROGRAM_AUTHOR Darren Hiebert /dhiebert@users.sourceforge.net/
!_TAG_PROGRAM_NAME Exuberant Ctags //
!_TAG_PROGRAM_URL http://ctags.sourceforge.net /official site/
!_TAG_PROGRAM_VERSION 5.9~svn20110310 //