version: '3.3' services: oci-registry: restart: always container_name: oci-registry image: "registry:2.8.3" volumes: - oci:/var/lib/registry - ./htpasswd:/auth/htpasswd networks: - traefik - intern depends_on: - oci-registry-redis healthcheck: test: ["CMD", "wget", "--quiet", "--tries=1", "--spider", "http://localhost:5000/v2/"] interval: 30s timeout: 10s retries: 3 environment: TZ: Europe/Berlin REGISTRY_AUTH: none REGISTRY_REDIS_ADDR: oci-registry-redis:6379 REGISTRY_REDIS_PASSWORD: "{{ lookup('viczem.keepass.keepass', 'oci-registry-redis-pw', 'password') }}" REGISTRY_STORAGE_DELETE_ENABLED: true REGISTRY_CATALOG_MAXENTRIES: 100000 # https://github.com/Joxit/docker-registry-ui/issues/306 # https://joxit.dev/docker-registry-ui/#using-cors REGISTRY_HTTP_HEADERS_Access-Control-Allow-Origin: '[https://registry.mgrote.net/ui/]' REGISTRY_HTTP_HEADERS_Access-Control-Allow-Methods: '[HEAD,GET,OPTIONS,DELETE]' REGISTRY_HTTP_HEADERS_Access-Control-Allow-Credentials: '[true]' REGISTRY_HTTP_HEADERS_Access-Control-Allow-Headers: '[Authorization,Accept,Cache-Control]' REGISTRY_HTTP_HEADERS_Access-Control-Expose-Headers: '[Docker-Content-Digest]' labels: traefik.http.routers.registry.rule: Host(`registry.mgrote.net`) traefik.enable: true traefik.http.routers.registry.tls: true traefik.http.routers.registry.tls.certresolver: resolver_letsencrypt traefik.http.routers.registry.entrypoints: entry_https traefik.http.services.registry.loadbalancer.server.port: 5000 traefik.http.routers.registry.middlewares: registry-ipallowlist traefik.http.middlewares.registry-ipallowlist.ipallowlist.sourcerange: 192.168.2.0/24,10.25.25.0/24,192.168.48.0/24,172.18.0.0/16 # .48. ist Docker traefik.http.middlewares.registry-ipallowlist.ipallowlist.ipstrategy.depth: 0 # https://doc.traefik.io/traefik/middlewares/http/ipallowlist/#ipstrategydepth # registry aufräumen: docker exec -it oci-registry /bin/registry garbage-collect /etc/docker/registry/config.yml # testen mit: # docker pull ubuntu # docker image tag ubuntu registry.mgrote.net/myfirstimage # docker push registry.mgrote.net/myfirstimage # docker pull registry.mgrote.net/myfirstimage oci-registry-redis: image: "redis:7.4.0" container_name: oci-registry-redis networks: - intern restart: always environment: REDIS_PASSWORD: "{{ lookup('viczem.keepass.keepass', 'oci-registry-redis-pw', 'password') }}" MAXMEMORY POLICY: allkeys-lru healthcheck: test: ["CMD", "redis-cli", "ping"] interval: 30s timeout: 10s retries: 3 oci-registry-ui: restart: always # url: registry.mgrote.net/ui/index.html image: "joxit/docker-registry-ui:2.5.7" container_name: oci-registry-ui environment: DELETE_IMAGES: true SINGLE_REGISTRY: true NGINX_PROXY_PASS_URL: http://oci-registry:5000 SHOW_CONTENT_DIGEST: true # https://github.com/Joxit/docker-registry-ui/issues/297 SHOW_CATALOG_NB_TAGS: true PULL_URL: registry.mgrote.net depends_on: - oci-registry networks: - traefik - intern healthcheck: test: ["CMD", "wget", "--quiet", "--tries=1", "--spider", "http://127.0.0.1"] interval: 30s timeout: 10s retries: 3 labels: traefik.http.routers.registry-ui.rule: Host(`registry.mgrote.net`)&&PathPrefix(`/ui`) # mache unter /ui erreichbar, damit wird demPfad dieser Prefix hinzugefügt, die Anwendung "hört" dort abrer nicht traefik.http.routers.registry-ui.middlewares: registry-ui-strip-prefix,registry-ui-ipallowlist # also entferne den Prefix danach wieder traefik.http.middlewares.registry-ui-strip-prefix.stripprefix.prefixes: /ui # hier ist die Middleware definiert traefik.enable: true traefik.http.routers.registry-ui.tls: true traefik.http.routers.registry-ui.tls.certresolver: resolver_letsencrypt traefik.http.routers.registry-ui.entrypoints: entry_https traefik.http.services.registry-ui.loadbalancer.server.port: 80 traefik.http.middlewares.registry-ui-ipallowlist.ipallowlist.sourcerange: 192.168.2.0/24,10.25.25.0/24 # .48. ist Docker traefik.http.middlewares.registry-ui-ipallowlist.ipallowlist.ipstrategy.depth: 0 # https://doc.traefik.io/traefik/middlewares/http/ipallowlist/#ipstrategydepth ######## Networks ######## networks: traefik: external: true intern: ######## Volumes ######## volumes: oci: