From 543fb175b5bb374a3620820e8ee87b071e1b5b11 Mon Sep 17 00:00:00 2001 From: alex-chevski Date: Fri, 8 Dec 2023 21:53:09 +0300 Subject: [PATCH] init --- Makefile | 27 ++++++++ README.md | 1 + docker-compose-production.yml | 23 +++++++ docker-compose.yml | 19 ++++++ docker/development/nginx/conf.d/registry.conf | 24 +++++++ docker/production/nginx/conf.d/registry.conf | 66 +++++++++++++++++++ provisioning/.gitignore | 2 + provisioning/Makefile | 8 +++ provisioning/authorize.yml | 9 +++ provisioning/hosts.yml.dist | 9 +++ provisioning/roles/certbot/files/cli.ini | 3 + provisioning/roles/certbot/tasks/main.yml | 30 +++++++++ provisioning/roles/docker/handlers/main.yml | 6 ++ provisioning/roles/docker/tasks/main.yml | 56 ++++++++++++++++ provisioning/roles/registry/defaults/main.yml | 3 + .../roles/registry/tasks/add_certbot_hook.yml | 5 ++ .../roles/registry/tasks/create_user.yml | 8 +++ .../registry/tasks/generate_certificates.yml | 26 ++++++++ provisioning/roles/registry/tasks/main.yml | 2 + provisioning/server.yml | 8 +++ provisioning/upgrade.yml | 20 ++++++ tags | 6 ++ 22 files changed, 361 insertions(+) create mode 100644 Makefile create mode 100644 README.md create mode 100644 docker-compose-production.yml create mode 100644 docker-compose.yml create mode 100644 docker/development/nginx/conf.d/registry.conf create mode 100644 docker/production/nginx/conf.d/registry.conf create mode 100644 provisioning/.gitignore create mode 100644 provisioning/Makefile create mode 100644 provisioning/authorize.yml create mode 100644 provisioning/hosts.yml.dist create mode 100644 provisioning/roles/certbot/files/cli.ini create mode 100644 provisioning/roles/certbot/tasks/main.yml create mode 100644 provisioning/roles/docker/handlers/main.yml create mode 100644 provisioning/roles/docker/tasks/main.yml create mode 100644 provisioning/roles/registry/defaults/main.yml create mode 100644 provisioning/roles/registry/tasks/add_certbot_hook.yml create mode 100644 provisioning/roles/registry/tasks/create_user.yml create mode 100644 provisioning/roles/registry/tasks/generate_certificates.yml create mode 100644 provisioning/roles/registry/tasks/main.yml create mode 100644 provisioning/server.yml create mode 100644 provisioning/upgrade.yml create mode 100644 tags diff --git a/Makefile b/Makefile new file mode 100644 index 0000000..5c5249e --- /dev/null +++ b/Makefile @@ -0,0 +1,27 @@ +init: docker-down-clear docker-pull docker-build docker-up +up: docker-up +down: docker-down + +docker-up: + docker compose up -d + +docker-down: + docker compose down --remove-orphans + +docker-down-clear: + docker compose down -v --remove-orphans + +docker-pull: + docker compose pull + +docker-build: + docker compose build + +deploy: + ssh ${HOST} -p ${PORT} 'rm -rf registry && mkdir registry' + scp -P ${PORT} docker-compose-production.yml ${HOST}:registry/docker-compose.yml + scp -P ${PORT} -r docker ${HOST}:registry/docker + scp -P ${PORT} ${HTPASSWD_FILE} ${HOST}:registry/htpasswd + ssh ${HOST} -p ${PORT} 'cd registry && echo "COMPOSE_PROJECT_NAME=registry" >> .env' + ssh ${HOST} -p ${PORT} 'cd registry && docker-compose pull' + ssh ${HOST} -p ${PORT} 'cd registry && docker-compose up --build --remove-orphans -d' diff --git a/README.md b/README.md new file mode 100644 index 0000000..6a63ebd --- /dev/null +++ b/README.md @@ -0,0 +1 @@ +

Docker registry before docker site

diff --git a/docker-compose-production.yml b/docker-compose-production.yml new file mode 100644 index 0000000..f0fd91b --- /dev/null +++ b/docker-compose-production.yml @@ -0,0 +1,23 @@ +version: '3.7' +services: + nginx: + image: nginx:alpine + restart: always + ports: + - "5443:443" + volumes: + - /etc/letsencrypt:/etc/letsencrypt:ro + - /var/www/html:/var/www/html:ro + - ./docker/production/nginx/conf.d:/etc/nginx/conf.d:ro + - ./htpasswd:/etc/nginx/auth/htpasswd:ro + depends_on: + - registry + + registry: + image: registry:2 + restart: always + volumes: + - registry:/var/lib/registry + +volumes: + registry: diff --git a/docker-compose.yml b/docker-compose.yml new file mode 100644 index 0000000..10a9e73 --- /dev/null +++ b/docker-compose.yml @@ -0,0 +1,19 @@ +version: '3.7' +services: + nginx: + image: nginx:alpine + ports: + - "5000:5000" + volumes: + - ./docker/development/nginx/conf.d:/etc/nginx/conf.d + - ./docker/development/nginx/auth/htpasswd:/etc/nginx/auth/htpasswd + depends_on: + - registry + + registry: + image: registry:2 + volumes: + - registry:/var/lib/registry + +volumes: + registry: diff --git a/docker/development/nginx/conf.d/registry.conf b/docker/development/nginx/conf.d/registry.conf new file mode 100644 index 0000000..a7da5cd --- /dev/null +++ b/docker/development/nginx/conf.d/registry.conf @@ -0,0 +1,24 @@ +server { + listen 5000; + server_tokens off; + + client_max_body_size 0; + chunked_transfer_encoding on; + + location /v2/ { + if ($http_user_agent ~ "^(docker\/1\.(3|4|5(?!\.[0-9]-dev))|Go ).*$" ) { + return 404; + } + + # To add basic authentication to v2 use auth_basic setting. + auth_basic "Registry realm"; + auth_basic_user_file /etc/nginx/auth/htpasswd; + + proxy_pass http://registry:5000; + proxy_set_header Host $http_host; # required for docker client's sake + proxy_set_header X-Real-IP $remote_addr; # pass on real client's IP + proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; + proxy_set_header X-Forwarded-Proto $scheme; + proxy_read_timeout 900; + } +} diff --git a/docker/production/nginx/conf.d/registry.conf b/docker/production/nginx/conf.d/registry.conf new file mode 100644 index 0000000..dc34c77 --- /dev/null +++ b/docker/production/nginx/conf.d/registry.conf @@ -0,0 +1,66 @@ +server { + listen 80; + server_name registry.demo-auction.pro-maker.ru; + server_tokens off; + + location ~ /\.well\-known { + root /var/www/html; + } + + rewrite ^(.*) https://registry.demo-auction.pro-maker.ru$1 permanent; +} + +server { + listen 443 ssl; + server_name registry.demo-auction.pro-maker.ru; + server_tokens off; + + # SSL + ssl_certificate /etc/letsencrypt/live/registry.demo-auction.pro-maker.ru/fullchain.pem; + ssl_certificate_key /etc/letsencrypt/live/registry.demo-auction.pro-maker.ru/privkey.pem; + ssl_trusted_certificate /etc/letsencrypt/live/registry.demo-auction.pro-maker.ru/chain.pem; + + # Recommendations from https://raymii.org/s/tutorials/Strong_SSL_Security_On_nginx.html + ssl_protocols TLSv1.1 TLSv1.2; + ssl_ciphers 'EECDH+AESGCM:EDH+AESGCM:AES256+EECDH:AES256+EDH'; + ssl_prefer_server_ciphers on; + ssl_session_cache shared:SSL:10m; + + ssl_stapling on; + ssl_stapling_verify on; + resolver 127.0.0.11 ipv6=off valid=300s; + + add_header Strict-Transport-Security "max-age=31536000"; + add_header Content-Security-Policy "block-all-mixed-content"; + + # disable any limits to avoid HTTP 413 for large image uploads + client_max_body_size 0; + + # required to avoid HTTP 411: see Issue #1486 (https://github.com/moby/moby/issues/1486) + chunked_transfer_encoding on; + + location ~ /\.well\-known { + root /var/www/html; + } + + location /v2/ { + # Do not allow connections from docker 1.5 and earlier + # docker pre-1.6.0 did not properly set the user agent on ping, catch "Go *" user agents + if ($http_user_agent ~ "^(docker\/1\.(3|4|5(?!\.[0-9]-dev))|Go ).*$" ) { + return 404; + } + + # To add basic authentication to v2 use auth_basic setting. + auth_basic "Registry realm"; + auth_basic_user_file /etc/nginx/auth/htpasswd; + + + proxy_pass http://registry:5000; + proxy_set_header Host $http_host; # required for docker client's sake + proxy_set_header X-Real-IP $remote_addr; # pass on real client's IP + proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; + proxy_set_header X-Forwarded-Proto $scheme; + proxy_read_timeout 900; + + } +} diff --git a/provisioning/.gitignore b/provisioning/.gitignore new file mode 100644 index 0000000..721be02 --- /dev/null +++ b/provisioning/.gitignore @@ -0,0 +1,2 @@ +/hosts.yml +/htpasswd diff --git a/provisioning/Makefile b/provisioning/Makefile new file mode 100644 index 0000000..4162212 --- /dev/null +++ b/provisioning/Makefile @@ -0,0 +1,8 @@ +server: + ansible-playbook server.yml -i hosts.yml + +authorize: + ansible-playbook authorize.yml -i hosts.yml + +upgrade: + ansible-playbook upgrade.yml -i hosts.yml diff --git a/provisioning/authorize.yml b/provisioning/authorize.yml new file mode 100644 index 0000000..89382e3 --- /dev/null +++ b/provisioning/authorize.yml @@ -0,0 +1,9 @@ +--- +- name: Add authorized key + hosts: all + remote_user: root + tasks: + - name: Add user authorized key + authorized_key: + user: deploy + key: "{{ lookup('file', '~/.ssh/id_rsa.pub') }}" diff --git a/provisioning/hosts.yml.dist b/provisioning/hosts.yml.dist new file mode 100644 index 0000000..bffbdc7 --- /dev/null +++ b/provisioning/hosts.yml.dist @@ -0,0 +1,9 @@ +all: + children: + site: + hosts: + server: + ansible_connection: ssh + ansible_user: root + ansible_host: 0.0.0.0 + ansible_port: 22 diff --git a/provisioning/roles/certbot/files/cli.ini b/provisioning/roles/certbot/files/cli.ini new file mode 100644 index 0000000..5715d86 --- /dev/null +++ b/provisioning/roles/certbot/files/cli.ini @@ -0,0 +1,3 @@ +authenticator = webroot +webroot-path = /var/www/html +text = True diff --git a/provisioning/roles/certbot/tasks/main.yml b/provisioning/roles/certbot/tasks/main.yml new file mode 100644 index 0000000..b682b08 --- /dev/null +++ b/provisioning/roles/certbot/tasks/main.yml @@ -0,0 +1,30 @@ +--- +- name: Add Certbot repository + apt_repository: + repo: 'deb http://ftp.debian.org/debian buster-backports main' + state: present + filename: buster-backports + update_cache: yes + +- name: Install Certbot + apt: + name: certbot + state: present + default_release: buster-backports + update_cache: yes + +- name: Copy Certbot configuration + copy: + src: files/cli.ini + dest: /etc/letsencrypt/cli.ini + owner: root + group: root + mode: 0644 + +- name: Remove useless packages + apt: + autoclean: yes + +- name: Remove useless dependencies + apt: + autoremove: yes diff --git a/provisioning/roles/docker/handlers/main.yml b/provisioning/roles/docker/handlers/main.yml new file mode 100644 index 0000000..3053cfd --- /dev/null +++ b/provisioning/roles/docker/handlers/main.yml @@ -0,0 +1,6 @@ +--- +- name: Start docker on boot + systemd: + name: docker + state: started + enabled: yes diff --git a/provisioning/roles/docker/tasks/main.yml b/provisioning/roles/docker/tasks/main.yml new file mode 100644 index 0000000..e423d93 --- /dev/null +++ b/provisioning/roles/docker/tasks/main.yml @@ -0,0 +1,56 @@ +--- +- name: Install dependencies + apt: + name: + - apt-transport-https + - ca-certificates + - curl + - software-properties-common + state: present + update_cache: yes + +- name: Add GPG key + apt_key: + url: https://download.docker.com/linux/debian/gpg + state: present + +- name: Verify fingerprint + apt_key: + id: 0EBFCD88 + state: present + +- name: Set up the repository + apt_repository: + repo: deb [arch=amd64] https://download.docker.com/linux/debian stretch stable + state: present + filename: docker + update_cache: yes + +- name: Install Docker + apt: + name: docker-ce + state: present + update_cache: yes + notify: Start docker on boot + +- name: Install Docker Compose + get_url: + url: https://github.com/docker/compose/releases/download/1.25.0/docker-compose-{{ ansible_system }}-{{ ansible_userspace_architecture }} + dest: /usr/local/bin/docker-compose + group: docker + mode: 'u+x,g+x' + +- name: Set periodic Docker prune + cron: + name: docker-prune + job: 'docker system prune -af --filter "until=$((30*24))h"' + minute: '0' + hour: '1' + +- name: Remove useless packages + apt: + autoclean: yes + +- name: Remove useless dependencies + apt: + autoremove: yes diff --git a/provisioning/roles/registry/defaults/main.yml b/provisioning/roles/registry/defaults/main.yml new file mode 100644 index 0000000..97f1a12 --- /dev/null +++ b/provisioning/roles/registry/defaults/main.yml @@ -0,0 +1,3 @@ +certbot_email: mail@pro-maker.ru +certbot_hosts: + - registry.pod-domen.domen.ru diff --git a/provisioning/roles/registry/tasks/add_certbot_hook.yml b/provisioning/roles/registry/tasks/add_certbot_hook.yml new file mode 100644 index 0000000..eb4786d --- /dev/null +++ b/provisioning/roles/registry/tasks/add_certbot_hook.yml @@ -0,0 +1,5 @@ +--- +- name: Add Certbot hook + lineinfile: + path: /etc/letsencrypt/cli.ini + line: "post-hook = /bin/sh -c 'cd /home/deploy/registry && docker-compose restart nginx'" diff --git a/provisioning/roles/registry/tasks/create_user.yml b/provisioning/roles/registry/tasks/create_user.yml new file mode 100644 index 0000000..68484f1 --- /dev/null +++ b/provisioning/roles/registry/tasks/create_user.yml @@ -0,0 +1,8 @@ +--- +- name: Create deploy user + user: + name: deploy + password: '!' + groups: + - docker + state: present diff --git a/provisioning/roles/registry/tasks/generate_certificates.yml b/provisioning/roles/registry/tasks/generate_certificates.yml new file mode 100644 index 0000000..2e2c33e --- /dev/null +++ b/provisioning/roles/registry/tasks/generate_certificates.yml @@ -0,0 +1,26 @@ +--- +- name: Check if certificate already exists + stat: + path: /etc/letsencrypt/live/{{ item }}/cert.pem + register: letsencrypt_certs + with_items: "{{ certbot_hosts }}" + +- name: Check if server is running + wait_for: + port: 80 + timeout: 1 + register: port_check + ignore_errors: yes + +- name: Up certbot standalone Apache + shell: "docker run -d --name apache -v /var/www/html:/usr/local/apache2/htdocs/ -p 80:80 httpd:2.4" + when: port_check.failed == true + +- name: Generate new certificate + shell: "certbot certonly --noninteractive --agree-tos --email {{ certbot_email }} -d {{ item.item }}" + with_items: "{{ letsencrypt_certs.results }}" + when: not item.stat.exists + +- name: Down certbot Apache + shell: "docker rm -f apache" + when: port_check.failed == true diff --git a/provisioning/roles/registry/tasks/main.yml b/provisioning/roles/registry/tasks/main.yml new file mode 100644 index 0000000..c7474cc --- /dev/null +++ b/provisioning/roles/registry/tasks/main.yml @@ -0,0 +1,2 @@ +- import_tasks: generate_certificates.yml +- import_tasks: create_user.yml diff --git a/provisioning/server.yml b/provisioning/server.yml new file mode 100644 index 0000000..9abc1dc --- /dev/null +++ b/provisioning/server.yml @@ -0,0 +1,8 @@ +--- +- name: Provision Site + hosts: all + remote_user: root + roles: + - docker + - certbot + - registry diff --git a/provisioning/upgrade.yml b/provisioning/upgrade.yml new file mode 100644 index 0000000..1b86aea --- /dev/null +++ b/provisioning/upgrade.yml @@ -0,0 +1,20 @@ +--- +- name: Upgrade + hosts: all + remote_user: root + tasks: + - name: Update APT package cache + apt: + update_cache: yes + + - name: Upgrade APT to the last packages + apt: + upgrade: dist + + - name: Remove useless packages + apt: + autoclean: yes + + - name: Remove useless dependencies + apt: + autoremove: yes diff --git a/tags b/tags new file mode 100644 index 0000000..33ed9e8 --- /dev/null +++ b/tags @@ -0,0 +1,6 @@ +!_TAG_FILE_FORMAT 2 /extended format; --format=1 will not append ;" to lines/ +!_TAG_FILE_SORTED 1 /0=unsorted, 1=sorted, 2=foldcase/ +!_TAG_PROGRAM_AUTHOR Darren Hiebert /dhiebert@users.sourceforge.net/ +!_TAG_PROGRAM_NAME Exuberant Ctags // +!_TAG_PROGRAM_URL http://ctags.sourceforge.net /official site/ +!_TAG_PROGRAM_VERSION 5.9~svn20110310 //