Registry updated to v3 and from nginx to caddy

registry/files/config.yml

@@ -0,0 +1,18 @@
+version: 0.1
+log:
+  level: info
+  fields:
+    service: registry
+storage:
+  filesystem:
+    rootdirectory: /data
+auth:
+  htpasswd:
+    realm: Registry
+    path: /auth/registry.passwd
+http:
+  addr: :5000
+  secret: my-registry-secret
+  debug:
+    prometheus:
+      enabled: true

registry/files/nginx.conf.j2

@@ -1,27 +0,0 @@
-server {
-
-  listen 80;
-  server_name {{ http_host }};
-
-  # set max upload size
-  client_max_body_size 10G;
-
-  location / {
-    # Do not allow connections from docker 1.5 and earlier
-    # docker pre-1.6.0 did not properly set the user agent on ping, catch "Go *" user agents
-    if ($http_user_agent ~ "^(docker\/1\.(3|4|5(?!\.[0-9]-dev))|Go ).*$" ) {
-      return 404;
-    }
-
-    proxy_set_header Host                $host;
-    proxy_set_header X-Forwarded-For     $proxy_add_x_forwarded_for;
-    proxy_set_header X-Forwarded-Proto   $scheme;
-    proxy_set_header X-Forwarded-For     $remote_addr;
-    proxy_set_header X-Real-IP           $remote_addr; # pass on real client's IP
-    add_header X-Robots-Tag              "noindex, nofollow, nosnippet, noarchive" always;
-    add_header Strict-Transport-Security "max-age=15552000; includeSubDomains" always;
-    proxy_read_timeout                  900;
-    proxy_pass       http://localhost:{{ host_port }};
-  }
-
-}

registry/playbook.yml

@@ -2,11 +2,12 @@
 # Setup Registry
 #################################################
 ---
-- hosts: rohan
+- hosts: clair
   become: true
   vars_files:
     - vars/default.yml
 
   roles:
+    - network
     - registry
-    - nginx
+    - caddy

registry/roles/caddy/handlers/main.yaml

@@ -0,0 +1,7 @@
+---
+# Handlers for Nginx role
+- name: Restart caddy container
+  docker_container:
+    name: "{{ caddy_container }}"
+    state: started
+    restart: true

registry/roles/caddy/tasks/main.yaml

@@ -0,0 +1,22 @@
+---
+- name: Read current Caddyfile
+  ansible.builtin.slurp:
+    path: "{{ caddyfile_path }}"
+  register: caddyfile_raw
+
+- name: Decode Caddyfile content
+  set_fact:
+    caddyfile_content: "{{ caddyfile_raw['content'] | b64decode }}"
+
+- name: Check if snippet already exists
+  set_fact:
+    snippet_present: "{{ snippet_block in caddyfile_content }}"
+
+- name: Add snippet if missing
+  ansible.builtin.blockinfile:
+    path: "{{ caddyfile_path }}"
+    marker: "# {mark} Ansible managed Caddy snippet for {{ host }}"
+    block: "{{ snippet_block }}"
+    create: yes
+  when: not snippet_present
+  notify: Restart caddy container

registry/roles/network/tasks/main.yaml

@@ -0,0 +1,8 @@
+---
+- name: "Ensure {{ docker_container }} Docker network exists"
+  docker_network:
+    name: "{{ docker_network }}"
+    state: present
+    connected:
+      - "{{ caddy_container }}"
+    appends: yes

registry/roles/nginx/handlers/main.yaml

@@ -1,6 +0,0 @@
----
-# Handlers for Nginx role
-- name: Reload Nginx
-  service:
-    name: nginx
-    state: reloaded

registry/roles/nginx/tasks/main.yaml

@@ -1,24 +0,0 @@
----
-# Tasks for Nginx role
-- name: Check if Nginx conf file exists
-  stat:
-    path: "/etc/nginx/sites-available/{{ http_conf }}"
-  register: status
-
-- name: No need to reload Nginx
-  debug:
-    msg: "No need to reload Nginx as sites-available entries have already been created"
-
-- name: Set Nginx conf file
-  when: status.stat.exists == false
-  template:
-    src: "files/nginx.conf.j2"
-    dest: "/etc/nginx/sites-available/{{ http_conf }}"
-
-- name: Enable new site
-  when: status.stat.exists == false
-  file:
-    src: "/etc/nginx/sites-available/{{ http_conf }}"
-    dest: "/etc/nginx/sites-enabled/{{ http_conf }}"
-    state: link
-  notify: Reload Nginx

registry/roles/registry/tasks/main.yaml

@@ -18,12 +18,23 @@
       state: directory
       mode: 0755
 
+- name: Upload config.yml for Registry
+  template:
+    src: "files/config.yml"
+    dest: "/var/lib/{{ host_directory }}/config.yml"
+
 - name: Make sure that apache2-utils is installed for htpasswd
   ansible.builtin.package:
     name: apache2-utils
     state: present
 
+- name: Check if htpasswd file exists
+  stat:
+    path: "/var/lib/{{ host_directory }}/auth/registry.passwd"
+  register: htpasswdstatus
+
 - name: Create htpasswd file with user and password
+  when: htpasswdstatus.stat.exists == false
   expect:
     command: "htpasswd -Bc /var/lib/{{ host_directory }}/auth/registry.passwd {{ username }}"
     responses:
@@ -31,20 +42,15 @@
       (?i)Re-type new password: "{{ password }}"
   # no_log: true
 
-
 - name: Create registry container
   docker_container:
     name: "{{ docker_container }}"
     image: "{{ docker_image }}"
     state: started
     restart_policy: "unless-stopped"
-    env:
-      REGISTRY_AUTH: htpasswd
-      REGISTRY_AUTH_HTPASSWD_REALM: Registry
-      REGISTRY_AUTH_HTPASSWD_PATH: /auth/registry.passwd
-      REGISTRY_STORAGE_FILESYSTEM_ROOTDIRECTORY: /data
-    published_ports:
-      - "127.0.0.1:{{ host_port }}:5000"
     volumes:
       - "/var/lib/{{ host_directory }}/data:/data"
       - "/var/lib/{{ host_directory }}/auth:/auth"
+      - "/var/lib/{{ host_directory }}/config.yml:/etc/docker/registry/config.yml"
+    networks:
+      - name: "{{ docker_network }}"

registry/vars/default.yml

@@ -1,12 +1,18 @@
 ---
-http_host: "registry.tanshu.com"
+host: registry.tanshu.com
-http_conf: "registry.tanshu.com.conf"
+docker_image: registry:3
-
-docker_image: registry:2
 docker_container: registry
+docker_network: "{{ docker_container }}_net"
 
 username: ta-registry
 password: ff28a01f00c0f39315d94cd9dcb1e554968dba25676a8ea5f2be34e96a9a099f
+tracing_enabled: "false"
 
 host_directory: registry
-host_port: 5000
+
+caddy_container: caddy
+caddyfile_path: /var/lib/caddy/conf/Caddyfile
+snippet_block: |
+  {{ host }} {
+      reverse_proxy {{ docker_container }}:5000
+  }