kfg/docker-registry
3
0
Fork 0
Code Issues Pull requests Projects Releases Wiki Activity

Added web frontend, added nginx proxy.

Browse source
This commit is contained in:
László Valkó 2018-07-18 04:10:02 +02:00
parent 8e6cfa183b
commit 878b445abb
2 changed files with 116 additions and 8 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

39
docker-compose.yml
View file

@ -1,19 +1,42 @@
---
version: '3.2'
version: '3.5'
services:
registry:
image: registry:2
container_name: registry
environment:
REGISTRY_HTTP_ADDR: 0.0.0.0:${WEB_HTTPS_PORT}
REGISTRY_HTTP_TLS_CERTIFICATE: /certs/fullchain.pem
REGISTRY_HTTP_TLS_KEY: /certs/privkey.pem
# REGISTRY_AUTH: htpasswd
# REGISTRY_AUTH_HTPASSWD_PATH: /auth/htpasswd
# REGISTRY_AUTH_HTPASSWD_REALM: Registry Realm
REGISTRY_HTTP_ADDR: 0.0.0.0:${REGISTRY_PORT}
volumes:
- /var/lib/registry:/var/lib/registry
- /admin/src/docker-registry/ssl:/certs
networks:
- ldap.proxy
restart: unless-stopped
frontend:
image: konradkleine/docker-registry-frontend:v2
container_name: registry.frontend
environment:
ENV_DOCKER_REGISTRY_HOST: docker-registry
ENV_DOCKER_REGISTRY_PORT: ${REGISTRY_PORT}
ENV_REGISTRY_PROXY_FQDN: registry.karinthy.hu
ENV_REGISTRY_PROXY_PORT: ${FRONTEND_PORT}
links:
- registry:docker-registry
networks:
- ldap.proxy
restart: unless-stopped
nginx:
image: confirm/nginx-ldap
container_name: registry.nginx
volumes:
- /admin/src/docker-registry/nginx:/etc/nginx:ro
ports:
- "${EXTERNAL_IP}:${EXTERNAL_PORT}:${WEB_HTTPS_PORT}"
links:
- registry:docker-registry
- frontend:docker-frontend
networks:
- ldap.proxy
restart: unless-stopped
networks:
ldap.proxy:
name: ldap.proxy.net

85
nginx/nginx.conf Normal file
View file

@ -0,0 +1,85 @@
error_log /dev/stdout info;
events {
worker_connections 1024;
}
http {
sendfile on;
tcp_nopush on;
tcp_nodelay on;
keepalive_timeout 65;
types_hash_max_size 2048;
server_tokens off;
default_type application/octet-stream;
upstream docker-registry {
server docker-registry:5000;
}
upstream docker-frontend {
server docker-frontend:80;
}
map $upstream_http_docker_distribution_api_version $docker_distribution_api_version {
'' 'registry/2.0';
}
ldap_server ldap {
url ldap://ldap.proxy/dc=karinthy,dc=hu?uid?sub?(objectClass=posixAccount);
group_attribute memberUid;
group_attribute_is_dn off;
require group "cn=ciuser,ou=Groups,dc=karinthy,dc=hu"
require valid_user;
}
auth_ldap_cache_enabled on;
auth_ldap_cache_expiration_time 10;
auth_ldap_cache_size 512;
server {
listen 443 ssl;
server_name registry.karinthy.hu;
ssl_certificate /etc/nginx/ssl/fullchain.pem;
ssl_certificate_key /etc/nginx/ssl/privkey.pem;
ssl_protocols TLSv1.1 TLSv1.2;
ssl_ciphers 'ECDHE-RSA-AES128-GCM-SHA256:ECDHE-RSA-AES256-GCM-SHA384:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384:ECDHE-RSA-AES128-SHA256:ECDHE-RSA-AES256-SHA384:DHE-RSA-AES128-SHA256:DHE-RSA-AES256-SHA256:ECDHE-RSA-AES128-SHA:ECDHE-RSA-AES256-SHA:DHE-RSA-AES128-SHA:DHE-RSA-AES256-SHA:!aNULL:!eNULL:!PSK:!EXPORT:!RC4:!MD5:!DES:!ADK:!CAMELLIA';
ssl_prefer_server_ciphers on;
ssl_session_cache shared:SSL:10m;
client_max_body_size 0;
chunked_transfer_encoding on;
location / {
auth_ldap "Karinthy Docker Registry";
auth_ldap_servers ldap;
proxy_pass http://docker-frontend;
proxy_set_header Host $http_host;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Proto $scheme;
proxy_read_timeout 900;
}
location /v2 {
if ($http_user_agent ~ "^(docker\/1\.(3|4|5(?!\.[0-9]-dev))|Go ).*$" ) {
return 404;
}
add_header 'Docker-Distribution-Api-Version' $docker_distribution_api_version always;
auth_ldap "Karinthy Docker Registry";
auth_ldap_servers ldap;
proxy_pass http://docker-registry;
proxy_set_header Host $http_host;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Proto $scheme;
proxy_read_timeout 900;
}
}
}