From dc2e11ca69ec0b5701d25197e202731f8c3c5fe4 Mon Sep 17 00:00:00 2001 From: Amritanshu Date: Wed, 30 Jul 2025 04:17:32 +0000 Subject: [PATCH] Registry updated to v3 and from nginx to caddy --- registry/files/config.yml | 18 +++++++++++++++++ registry/files/nginx.conf.j2 | 27 ------------------------- registry/playbook.yml | 5 +++-- registry/roles/caddy/handlers/main.yaml | 7 +++++++ registry/roles/caddy/tasks/main.yaml | 22 ++++++++++++++++++++ registry/roles/network/tasks/main.yaml | 8 ++++++++ registry/roles/nginx/handlers/main.yaml | 6 ------ registry/roles/nginx/tasks/main.yaml | 24 ---------------------- registry/roles/registry/tasks/main.yaml | 22 ++++++++++++-------- registry/vars/default.yml | 16 ++++++++++----- 10 files changed, 83 insertions(+), 72 deletions(-) create mode 100644 registry/files/config.yml delete mode 100644 registry/files/nginx.conf.j2 create mode 100644 registry/roles/caddy/handlers/main.yaml create mode 100644 registry/roles/caddy/tasks/main.yaml create mode 100644 registry/roles/network/tasks/main.yaml delete mode 100644 registry/roles/nginx/handlers/main.yaml delete mode 100644 registry/roles/nginx/tasks/main.yaml diff --git a/registry/files/config.yml b/registry/files/config.yml new file mode 100644 index 0000000..ff9b1bf --- /dev/null +++ b/registry/files/config.yml @@ -0,0 +1,18 @@ +version: 0.1 +log: + level: info + fields: + service: registry +storage: + filesystem: + rootdirectory: /data +auth: + htpasswd: + realm: Registry + path: /auth/registry.passwd +http: + addr: :5000 + secret: my-registry-secret + debug: + prometheus: + enabled: true diff --git a/registry/files/nginx.conf.j2 b/registry/files/nginx.conf.j2 deleted file mode 100644 index ef394af..0000000 --- a/registry/files/nginx.conf.j2 +++ /dev/null @@ -1,27 +0,0 @@ -server { - - listen 80; - server_name {{ http_host }}; - - # set max upload size - client_max_body_size 10G; - - location / { - # Do not allow connections from docker 1.5 and earlier - # docker pre-1.6.0 did not properly set the user agent on ping, catch "Go *" user agents - if ($http_user_agent ~ "^(docker\/1\.(3|4|5(?!\.[0-9]-dev))|Go ).*$" ) { - return 404; - } - - proxy_set_header Host $host; - proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; - proxy_set_header X-Forwarded-Proto $scheme; - proxy_set_header X-Forwarded-For $remote_addr; - proxy_set_header X-Real-IP $remote_addr; # pass on real client's IP - add_header X-Robots-Tag "noindex, nofollow, nosnippet, noarchive" always; - add_header Strict-Transport-Security "max-age=15552000; includeSubDomains" always; - proxy_read_timeout 900; - proxy_pass http://localhost:{{ host_port }}; - } - -} diff --git a/registry/playbook.yml b/registry/playbook.yml index 0f53b33..9077fd9 100755 --- a/registry/playbook.yml +++ b/registry/playbook.yml @@ -2,11 +2,12 @@ # Setup Registry ################################################# --- -- hosts: rohan +- hosts: clair become: true vars_files: - vars/default.yml roles: + - network - registry - - nginx + - caddy diff --git a/registry/roles/caddy/handlers/main.yaml b/registry/roles/caddy/handlers/main.yaml new file mode 100644 index 0000000..c3a3720 --- /dev/null +++ b/registry/roles/caddy/handlers/main.yaml @@ -0,0 +1,7 @@ +--- +# Handlers for Nginx role +- name: Restart caddy container + docker_container: + name: "{{ caddy_container }}" + state: started + restart: true \ No newline at end of file diff --git a/registry/roles/caddy/tasks/main.yaml b/registry/roles/caddy/tasks/main.yaml new file mode 100644 index 0000000..c3ccc90 --- /dev/null +++ b/registry/roles/caddy/tasks/main.yaml @@ -0,0 +1,22 @@ +--- +- name: Read current Caddyfile + ansible.builtin.slurp: + path: "{{ caddyfile_path }}" + register: caddyfile_raw + +- name: Decode Caddyfile content + set_fact: + caddyfile_content: "{{ caddyfile_raw['content'] | b64decode }}" + +- name: Check if snippet already exists + set_fact: + snippet_present: "{{ snippet_block in caddyfile_content }}" + +- name: Add snippet if missing + ansible.builtin.blockinfile: + path: "{{ caddyfile_path }}" + marker: "# {mark} Ansible managed Caddy snippet for {{ host }}" + block: "{{ snippet_block }}" + create: yes + when: not snippet_present + notify: Restart caddy container \ No newline at end of file diff --git a/registry/roles/network/tasks/main.yaml b/registry/roles/network/tasks/main.yaml new file mode 100644 index 0000000..ebda867 --- /dev/null +++ b/registry/roles/network/tasks/main.yaml @@ -0,0 +1,8 @@ +--- +- name: "Ensure {{ docker_container }} Docker network exists" + docker_network: + name: "{{ docker_network }}" + state: present + connected: + - "{{ caddy_container }}" + appends: yes diff --git a/registry/roles/nginx/handlers/main.yaml b/registry/roles/nginx/handlers/main.yaml deleted file mode 100644 index 622fd36..0000000 --- a/registry/roles/nginx/handlers/main.yaml +++ /dev/null @@ -1,6 +0,0 @@ ---- -# Handlers for Nginx role -- name: Reload Nginx - service: - name: nginx - state: reloaded diff --git a/registry/roles/nginx/tasks/main.yaml b/registry/roles/nginx/tasks/main.yaml deleted file mode 100644 index 4441fe7..0000000 --- a/registry/roles/nginx/tasks/main.yaml +++ /dev/null @@ -1,24 +0,0 @@ ---- -# Tasks for Nginx role -- name: Check if Nginx conf file exists - stat: - path: "/etc/nginx/sites-available/{{ http_conf }}" - register: status - -- name: No need to reload Nginx - debug: - msg: "No need to reload Nginx as sites-available entries have already been created" - -- name: Set Nginx conf file - when: status.stat.exists == false - template: - src: "files/nginx.conf.j2" - dest: "/etc/nginx/sites-available/{{ http_conf }}" - -- name: Enable new site - when: status.stat.exists == false - file: - src: "/etc/nginx/sites-available/{{ http_conf }}" - dest: "/etc/nginx/sites-enabled/{{ http_conf }}" - state: link - notify: Reload Nginx diff --git a/registry/roles/registry/tasks/main.yaml b/registry/roles/registry/tasks/main.yaml index 105744d..269729f 100644 --- a/registry/roles/registry/tasks/main.yaml +++ b/registry/roles/registry/tasks/main.yaml @@ -18,12 +18,23 @@ state: directory mode: 0755 +- name: Upload config.yml for Registry + template: + src: "files/config.yml" + dest: "/var/lib/{{ host_directory }}/config.yml" + - name: Make sure that apache2-utils is installed for htpasswd ansible.builtin.package: name: apache2-utils state: present +- name: Check if htpasswd file exists + stat: + path: "/var/lib/{{ host_directory }}/auth/registry.passwd" + register: htpasswdstatus + - name: Create htpasswd file with user and password + when: htpasswdstatus.stat.exists == false expect: command: "htpasswd -Bc /var/lib/{{ host_directory }}/auth/registry.passwd {{ username }}" responses: @@ -31,20 +42,15 @@ (?i)Re-type new password: "{{ password }}" # no_log: true - - name: Create registry container docker_container: name: "{{ docker_container }}" image: "{{ docker_image }}" state: started restart_policy: "unless-stopped" - env: - REGISTRY_AUTH: htpasswd - REGISTRY_AUTH_HTPASSWD_REALM: Registry - REGISTRY_AUTH_HTPASSWD_PATH: /auth/registry.passwd - REGISTRY_STORAGE_FILESYSTEM_ROOTDIRECTORY: /data - published_ports: - - "127.0.0.1:{{ host_port }}:5000" volumes: - "/var/lib/{{ host_directory }}/data:/data" - "/var/lib/{{ host_directory }}/auth:/auth" + - "/var/lib/{{ host_directory }}/config.yml:/etc/docker/registry/config.yml" + networks: + - name: "{{ docker_network }}" diff --git a/registry/vars/default.yml b/registry/vars/default.yml index 87e0fa7..82e1156 100644 --- a/registry/vars/default.yml +++ b/registry/vars/default.yml @@ -1,12 +1,18 @@ --- -http_host: "registry.tanshu.com" -http_conf: "registry.tanshu.com.conf" - -docker_image: registry:2 +host: registry.tanshu.com +docker_image: registry:3 docker_container: registry +docker_network: "{{ docker_container }}_net" username: ta-registry password: ff28a01f00c0f39315d94cd9dcb1e554968dba25676a8ea5f2be34e96a9a099f +tracing_enabled: "false" host_directory: registry -host_port: 5000 + +caddy_container: caddy +caddyfile_path: /var/lib/caddy/conf/Caddyfile +snippet_block: | + {{ host }} { + reverse_proxy {{ docker_container }}:5000 + }