Docker registry

registry/files/nginx.conf.j2

@@ -0,0 +1,27 @@
+server {
+
+  listen 80;
+  server_name {{ http_host }};
+
+  # set max upload size
+  client_max_body_size 10G;
+
+  location / {
+    # Do not allow connections from docker 1.5 and earlier
+    # docker pre-1.6.0 did not properly set the user agent on ping, catch "Go *" user agents
+    if ($http_user_agent ~ "^(docker\/1\.(3|4|5(?!\.[0-9]-dev))|Go ).*$" ) {
+      return 404;
+    }
+
+    proxy_set_header Host                $host;
+    proxy_set_header X-Forwarded-For     $proxy_add_x_forwarded_for;
+    proxy_set_header X-Forwarded-Proto   $scheme;
+    proxy_set_header X-Forwarded-For     $remote_addr;
+    proxy_set_header X-Real-IP           $remote_addr; # pass on real client's IP
+    add_header X-Robots-Tag              "noindex, nofollow, nosnippet, noarchive" always;
+    add_header Strict-Transport-Security "max-age=15552000; includeSubDomains" always;
+    proxy_read_timeout                  900;
+    proxy_pass       http://localhost:{{ host_port }};
+  }
+
+}

registry/playbook.yml

@@ -0,0 +1,12 @@
+#################################################
+# Setup Registry
+#################################################
+---
+- hosts: rohan
+  become: true
+  vars_files:
+    - vars/default.yml
+
+  roles:
+    - registry
+    - nginx

registry/roles/nginx/handlers/main.yaml

@@ -0,0 +1,6 @@
+---
+# Handlers for Nginx role
+- name: Reload Nginx
+  service:
+    name: nginx
+    state: reloaded

registry/roles/nginx/tasks/main.yaml

@@ -0,0 +1,24 @@
+---
+# Tasks for Nginx role
+- name: Check if Nginx conf file exists
+  stat:
+    path: "/etc/nginx/sites-available/{{ http_conf }}"
+  register: status
+
+- name: No need to reload Nginx
+  debug:
+    msg: "No need to reload Nginx as sites-available entries have already been created"
+
+- name: Set Nginx conf file
+  when: status.stat.exists == false
+  template:
+    src: "files/nginx.conf.j2"
+    dest: "/etc/nginx/sites-available/{{ http_conf }}"
+
+- name: Enable new site
+  when: status.stat.exists == false
+  file:
+    src: "/etc/nginx/sites-available/{{ http_conf }}"
+    dest: "/etc/nginx/sites-enabled/{{ http_conf }}"
+    state: link
+  notify: Reload Nginx

registry/roles/registry/tasks/main.yaml

@@ -0,0 +1,50 @@
+---
+# Tasks for a Private Docker registry role
+- name: Pull Registry image
+  docker_image:
+    name: "{{ docker_image }}"
+    source: pull
+    force_source: yes
+
+- name: Ensure Registry Directory exists
+  file:
+      path: "/var/lib/{{ host_directory }}"
+      state: directory
+      mode: 0755
+
+- name: Ensure Registry Auth Directory exists
+  file:
+      path: "/var/lib/{{ host_directory }}/auth"
+      state: directory
+      mode: 0755
+
+- name: Make sure that apache2-utils is installed for htpasswd
+  ansible.builtin.package:
+    name: apache2-utils
+    state: present
+
+- name: Create htpasswd file with user and password
+  expect:
+    command: "htpasswd -Bc /var/lib/{{ host_directory }}/auth/registry.passwd {{ username }}"
+    responses:
+      (?i)New password: "{{ password }}"
+      (?i)Re-type new password: "{{ password }}"
+  # no_log: true
+
+
+- name: Create registry container
+  docker_container:
+    name: "{{ docker_container }}"
+    image: "{{ docker_image }}"
+    state: started
+    restart_policy: "unless-stopped"
+    env:
+      REGISTRY_AUTH: htpasswd
+      REGISTRY_AUTH_HTPASSWD_REALM: Registry
+      REGISTRY_AUTH_HTPASSWD_PATH: /auth/registry.passwd
+      REGISTRY_STORAGE_FILESYSTEM_ROOTDIRECTORY: /data
+    published_ports:
+      - "127.0.0.1:{{ host_port }}:5000"
+    volumes:
+      - "/var/lib/{{ host_directory }}/data:/data"
+      - "/var/lib/{{ host_directory }}/auth:/auth"

registry/vars/default.yml

@@ -0,0 +1,12 @@
+---
+http_host: "registry.tanshu.com"
+http_conf: "registry.tanshu.com.conf"
+
+docker_image: registry:2
+docker_container: registry
+
+username: ta-registry
+password: ff28a01f00c0f39315d94cd9dcb1e554968dba25676a8ea5f2be34e96a9a099f
+
+host_directory: registry
+host_port: 5000