Michael Grote
28f22968da
Reviewed-on: #127
Co-authored-by: Michael Grote <michael.grote@posteo.de>
Co-committed-by: Michael Grote <michael.grote@posteo.de>
ci: testing deployment (#128)
Reviewed-on: #128
Co-authored-by: Michael Grote <michael.grote@posteo.de>
Co-committed-by: Michael Grote <michael.grote@posteo.de>
ci: test
ci: enable deployment
ci: set ssh-key for deployment
ci: debug
ci: deactivate ansible-lint temporarily
ci: deactivate ansible-galaxy temporarily
ci: debug ssh-key shell redirect
ci: base64
ci: debug
ci: debug
ci: fix output
Revert "ci: deactivate ansible-lint temporarily"
This reverts commit 6729342f26.
ci: fix vault-pass secret
pbs_integration: enable no_log
ci: debug ansible-vault
ci: debug
ci: ansible-vault + move to viczem.keepass (#130)
Reviewed-on: #130
Co-authored-by: Michael Grote <michael.grote@posteo.de>
Co-committed-by: Michael Grote <michael.grote@posteo.de>
ff
plugin umbennennugn
ff
113 lines
4.6 KiB
Django/Jinja
113 lines
4.6 KiB
Django/Jinja
version: '3.3'
|
|
services:
|
|
oci-registry:
|
|
restart: always
|
|
container_name: oci-registry
|
|
image: "registry:2.8.3"
|
|
volumes:
|
|
- oci:/var/lib/registry
|
|
- ./htpasswd:/auth/htpasswd
|
|
networks:
|
|
- traefik
|
|
- intern
|
|
depends_on:
|
|
- oci-registry-redis
|
|
healthcheck:
|
|
test: ["CMD", "wget", "--quiet", "--tries=1", "--spider", "http://localhost:5000/v2/"]
|
|
interval: 30s
|
|
timeout: 10s
|
|
retries: 3
|
|
environment:
|
|
TZ: Europe/Berlin
|
|
REGISTRY_AUTH: none
|
|
REGISTRY_REDIS_ADDR: oci-registry-redis:6379
|
|
REGISTRY_REDIS_PASSWORD: "{{ lookup('viczem.keepass.keepass', 'oci-registry-redis-pw', 'password') }}"
|
|
REGISTRY_STORAGE_DELETE_ENABLED: true
|
|
REGISTRY_CATALOG_MAXENTRIES: 100000 # https://github.com/Joxit/docker-registry-ui/issues/306
|
|
# https://joxit.dev/docker-registry-ui/#using-cors
|
|
REGISTRY_HTTP_HEADERS_Access-Control-Allow-Origin: '[https://registry.mgrote.net/ui/]'
|
|
REGISTRY_HTTP_HEADERS_Access-Control-Allow-Methods: '[HEAD,GET,OPTIONS,DELETE]'
|
|
REGISTRY_HTTP_HEADERS_Access-Control-Allow-Credentials: '[true]'
|
|
REGISTRY_HTTP_HEADERS_Access-Control-Allow-Headers: '[Authorization,Accept,Cache-Control]'
|
|
REGISTRY_HTTP_HEADERS_Access-Control-Expose-Headers: '[Docker-Content-Digest]'
|
|
labels:
|
|
traefik.http.routers.registry.rule: Host(`registry.mgrote.net`)
|
|
traefik.enable: true
|
|
traefik.http.routers.registry.tls: true
|
|
traefik.http.routers.registry.tls.certresolver: resolver_letsencrypt
|
|
traefik.http.routers.registry.entrypoints: entry_https
|
|
traefik.http.services.registry.loadbalancer.server.port: 5000
|
|
|
|
traefik.http.routers.registry.middlewares: registry-ipallowlist
|
|
|
|
traefik.http.middlewares.registry-ipallowlist.ipallowlist.sourcerange: 192.168.2.0/24,10.25.25.0/24,192.168.48.0/24,172.18.0.0/16 # .48. ist Docker
|
|
traefik.http.middlewares.registry-ipallowlist.ipallowlist.ipstrategy.depth: 0 # https://doc.traefik.io/traefik/middlewares/http/ipallowlist/#ipstrategydepth
|
|
|
|
# registry aufräumen: docker exec -it oci-registry /bin/registry garbage-collect --delete-untagged=true /etc/docker/registry/config.yml
|
|
|
|
# testen mit:
|
|
# docker pull ubuntu
|
|
# docker image tag ubuntu registry.mgrote.net/myfirstimage
|
|
# docker push registry.mgrote.net/myfirstimage
|
|
# docker pull registry.mgrote.net/myfirstimage
|
|
|
|
oci-registry-redis:
|
|
image: "redis:7.2.5"
|
|
container_name: oci-registry-redis
|
|
networks:
|
|
- intern
|
|
restart: always
|
|
environment:
|
|
REDIS_PASSWORD: "{{ lookup('viczem.keepass.keepass', 'oci-registry-redis-pw', 'password') }}"
|
|
MAXMEMORY POLICY: allkeys-lru
|
|
healthcheck:
|
|
test: ["CMD", "redis-cli", "ping"]
|
|
interval: 30s
|
|
timeout: 10s
|
|
retries: 3
|
|
|
|
oci-registry-ui:
|
|
restart: always
|
|
# url: registry.mgrote.net/ui/index.html
|
|
image: "joxit/docker-registry-ui:2.5.7"
|
|
container_name: oci-registry-ui
|
|
environment:
|
|
DELETE_IMAGES: true
|
|
SINGLE_REGISTRY: true
|
|
NGINX_PROXY_PASS_URL: http://oci-registry:5000
|
|
SHOW_CONTENT_DIGEST: true # https://github.com/Joxit/docker-registry-ui/issues/297
|
|
SHOW_CATALOG_NB_TAGS: true
|
|
PULL_URL: registry.mgrote.net
|
|
depends_on:
|
|
- oci-registry
|
|
networks:
|
|
- traefik
|
|
- intern
|
|
healthcheck:
|
|
test: ["CMD", "wget", "--quiet", "--tries=1", "--spider", "http://127.0.0.1"]
|
|
interval: 30s
|
|
timeout: 10s
|
|
retries: 3
|
|
labels:
|
|
traefik.http.routers.registry-ui.rule: Host(`registry.mgrote.net`)&&PathPrefix(`/ui`) # mache unter /ui erreichbar, damit wird demPfad dieser Prefix hinzugefügt, die Anwendung "hört" dort abrer nicht
|
|
traefik.http.routers.registry-ui.middlewares: registry-ui-strip-prefix,registry-ui-ipallowlist # also entferne den Prefix danach wieder
|
|
traefik.http.middlewares.registry-ui-strip-prefix.stripprefix.prefixes: /ui # hier ist die Middleware definiert
|
|
traefik.enable: true
|
|
traefik.http.routers.registry-ui.tls: true
|
|
traefik.http.routers.registry-ui.tls.certresolver: resolver_letsencrypt
|
|
traefik.http.routers.registry-ui.entrypoints: entry_https
|
|
traefik.http.services.registry-ui.loadbalancer.server.port: 80
|
|
|
|
traefik.http.middlewares.registry-ui-ipallowlist.ipallowlist.sourcerange: 192.168.2.0/24,10.25.25.0/24 # .48. ist Docker
|
|
traefik.http.middlewares.registry-ui-ipallowlist.ipallowlist.ipstrategy.depth: 0 # https://doc.traefik.io/traefik/middlewares/http/ipallowlist/#ipstrategydepth
|
|
|
|
######## Networks ########
|
|
networks:
|
|
traefik:
|
|
external: true
|
|
intern:
|
|
|
|
|
|
######## Volumes ########
|
|
volumes:
|
|
oci:
|