From f04a29b5c7050fa4404e9fc94e3489211c9dff50 Mon Sep 17 00:00:00 2001 From: Amritanshu Date: Tue, 17 Dec 2024 17:53:30 +0530 Subject: [PATCH] Docker registry --- registry/files/nginx.conf.j2 | 27 +++++++++++++ registry/playbook.yml | 12 ++++++ registry/readme.md | 0 registry/roles/nginx/handlers/main.yaml | 6 +++ registry/roles/nginx/tasks/main.yaml | 24 ++++++++++++ registry/roles/registry/tasks/main.yaml | 50 +++++++++++++++++++++++++ registry/vars/default.yml | 12 ++++++ 7 files changed, 131 insertions(+) create mode 100644 registry/files/nginx.conf.j2 create mode 100755 registry/playbook.yml create mode 100644 registry/readme.md create mode 100644 registry/roles/nginx/handlers/main.yaml create mode 100644 registry/roles/nginx/tasks/main.yaml create mode 100644 registry/roles/registry/tasks/main.yaml create mode 100644 registry/vars/default.yml diff --git a/registry/files/nginx.conf.j2 b/registry/files/nginx.conf.j2 new file mode 100644 index 0000000..ef394af --- /dev/null +++ b/registry/files/nginx.conf.j2 @@ -0,0 +1,27 @@ +server { + + listen 80; + server_name {{ http_host }}; + + # set max upload size + client_max_body_size 10G; + + location / { + # Do not allow connections from docker 1.5 and earlier + # docker pre-1.6.0 did not properly set the user agent on ping, catch "Go *" user agents + if ($http_user_agent ~ "^(docker\/1\.(3|4|5(?!\.[0-9]-dev))|Go ).*$" ) { + return 404; + } + + proxy_set_header Host $host; + proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; + proxy_set_header X-Forwarded-Proto $scheme; + proxy_set_header X-Forwarded-For $remote_addr; + proxy_set_header X-Real-IP $remote_addr; # pass on real client's IP + add_header X-Robots-Tag "noindex, nofollow, nosnippet, noarchive" always; + add_header Strict-Transport-Security "max-age=15552000; includeSubDomains" always; + proxy_read_timeout 900; + proxy_pass http://localhost:{{ host_port }}; + } + +} diff --git a/registry/playbook.yml b/registry/playbook.yml new file mode 100755 index 0000000..0f53b33 --- /dev/null +++ b/registry/playbook.yml @@ -0,0 +1,12 @@ +################################################# +# Setup Registry +################################################# +--- +- hosts: rohan + become: true + vars_files: + - vars/default.yml + + roles: + - registry + - nginx diff --git a/registry/readme.md b/registry/readme.md new file mode 100644 index 0000000..e69de29 diff --git a/registry/roles/nginx/handlers/main.yaml b/registry/roles/nginx/handlers/main.yaml new file mode 100644 index 0000000..622fd36 --- /dev/null +++ b/registry/roles/nginx/handlers/main.yaml @@ -0,0 +1,6 @@ +--- +# Handlers for Nginx role +- name: Reload Nginx + service: + name: nginx + state: reloaded diff --git a/registry/roles/nginx/tasks/main.yaml b/registry/roles/nginx/tasks/main.yaml new file mode 100644 index 0000000..4441fe7 --- /dev/null +++ b/registry/roles/nginx/tasks/main.yaml @@ -0,0 +1,24 @@ +--- +# Tasks for Nginx role +- name: Check if Nginx conf file exists + stat: + path: "/etc/nginx/sites-available/{{ http_conf }}" + register: status + +- name: No need to reload Nginx + debug: + msg: "No need to reload Nginx as sites-available entries have already been created" + +- name: Set Nginx conf file + when: status.stat.exists == false + template: + src: "files/nginx.conf.j2" + dest: "/etc/nginx/sites-available/{{ http_conf }}" + +- name: Enable new site + when: status.stat.exists == false + file: + src: "/etc/nginx/sites-available/{{ http_conf }}" + dest: "/etc/nginx/sites-enabled/{{ http_conf }}" + state: link + notify: Reload Nginx diff --git a/registry/roles/registry/tasks/main.yaml b/registry/roles/registry/tasks/main.yaml new file mode 100644 index 0000000..105744d --- /dev/null +++ b/registry/roles/registry/tasks/main.yaml @@ -0,0 +1,50 @@ +--- +# Tasks for a Private Docker registry role +- name: Pull Registry image + docker_image: + name: "{{ docker_image }}" + source: pull + force_source: yes + +- name: Ensure Registry Directory exists + file: + path: "/var/lib/{{ host_directory }}" + state: directory + mode: 0755 + +- name: Ensure Registry Auth Directory exists + file: + path: "/var/lib/{{ host_directory }}/auth" + state: directory + mode: 0755 + +- name: Make sure that apache2-utils is installed for htpasswd + ansible.builtin.package: + name: apache2-utils + state: present + +- name: Create htpasswd file with user and password + expect: + command: "htpasswd -Bc /var/lib/{{ host_directory }}/auth/registry.passwd {{ username }}" + responses: + (?i)New password: "{{ password }}" + (?i)Re-type new password: "{{ password }}" + # no_log: true + + +- name: Create registry container + docker_container: + name: "{{ docker_container }}" + image: "{{ docker_image }}" + state: started + restart_policy: "unless-stopped" + env: + REGISTRY_AUTH: htpasswd + REGISTRY_AUTH_HTPASSWD_REALM: Registry + REGISTRY_AUTH_HTPASSWD_PATH: /auth/registry.passwd + REGISTRY_STORAGE_FILESYSTEM_ROOTDIRECTORY: /data + published_ports: + - "127.0.0.1:{{ host_port }}:5000" + volumes: + - "/var/lib/{{ host_directory }}/data:/data" + - "/var/lib/{{ host_directory }}/auth:/auth" diff --git a/registry/vars/default.yml b/registry/vars/default.yml new file mode 100644 index 0000000..87e0fa7 --- /dev/null +++ b/registry/vars/default.yml @@ -0,0 +1,12 @@ +--- +http_host: "registry.tanshu.com" +http_conf: "registry.tanshu.com.conf" + +docker_image: registry:2 +docker_container: registry + +username: ta-registry +password: ff28a01f00c0f39315d94cd9dcb1e554968dba25676a8ea5f2be34e96a9a099f + +host_directory: registry +host_port: 5000