From 649f0dd9c5ca586d8b637400dd19c0c4059447d6 Mon Sep 17 00:00:00 2001 From: Carlos Konstanski Date: Wed, 30 Aug 2017 13:09:56 -0600 Subject: initial commit --- salt/openbook/ansible/files/registry.conf | 39 +++++++++++++++++++++++++++++++ 1 file changed, 39 insertions(+) create mode 100644 salt/openbook/ansible/files/registry.conf (limited to 'salt/openbook/ansible/files/registry.conf') diff --git a/salt/openbook/ansible/files/registry.conf b/salt/openbook/ansible/files/registry.conf new file mode 100644 index 0000000..e97729a --- /dev/null +++ b/salt/openbook/ansible/files/registry.conf @@ -0,0 +1,39 @@ +upstream docker-registry { + server registry:5000; +} + +server { + listen 443; + server_name {% raw %}{{ cn }}{% endraw %}; + + # SSL + ssl on; + ssl_certificate /etc/nginx/conf.d/{% raw %}{{ cn }}{% endraw %}.crt; + ssl_certificate_key /etc/nginx/conf.d/{% raw %}{{ cn }}{% endraw %}.key; + + # disable any limits to avoid HTTP 413 for large image uploads + client_max_body_size 0; + + # required to avoid HTTP 411: see Issue #1486 (https://github.com/docker/docker/issues/1486) + chunked_transfer_encoding on; + + location /v2/ { + # Do not allow connections from docker 1.5 and earlier + # docker pre-1.6.0 did not properly set the user agent on ping, catch "Go *" user agents + if ($http_user_agent ~ "^(docker\/1\.(3|4|5(?!\.[0-9]-dev))|Go ).*$" ) { + return 404; + } + + # To add basic authentication to v2 use auth_basic setting plus add_header + auth_basic "registry.localhost"; + auth_basic_user_file /etc/nginx/conf.d/registry.password; + add_header 'Docker-Distribution-Api-Version' 'registry/2.0' always; + + proxy_pass http://docker-registry; + proxy_set_header Host $http_host; # required for docker client's sake + proxy_set_header X-Real-IP $remote_addr; # pass on real client's IP + proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; + proxy_set_header X-Forwarded-Proto $scheme; + proxy_read_timeout 900; + } +} -- cgit v1.3