Merge pull request #3 from DreamLab/add_ssl_and_base_auth_conf

Add ssl and base auth conf

Author: pkruk

Dockerfile

@@ -13,6 +13,7 @@ COPY files/ecr.ini /etc/supervisor.d/ecr.ini
 COPY files/root /etc/crontabs/root
 
 COPY files/nginx.conf /usr/local/openresty/nginx/conf/nginx.conf
+COPY files/ssl.conf /usr/local/openresty/nginx/conf/ssl.conf
 
 ENV PORT 5000
 

files/nginx.conf

@@ -18,11 +18,20 @@ http {
   # this is necessary for us to be able to disable request buffering in all cases
   proxy_http_version 1.1;
 
+  #SSLCONFIG
+
   # will run before forking out nginx worker processes
   init_by_lua_block { require "cjson" }
 
+  #https://docs.docker.com/registry/recipes/nginx/#setting-things-up
+  map $upstream_http_docker_distribution_api_version $docker_distribution_api_version {
+  '' 'registry/2.0';
+  }
+
   server {
-    listen PORT default_server;
+    listen LISTEN default_server;
+
+    #AUTHCONFIG
 
     # Cache
     add_header X-Cache-Status   $upstream_cache_status;
@@ -50,6 +59,7 @@ http {
                            http_500 http_502 http_503 http_504;
     proxy_cache_lock       on;
 
+    add_header 'Docker-Distribution-Api-Version' $docker_distribution_api_version always;
     add_header "Access-Control-Allow-Origin" "*";
 
     location / {

files/ssl.conf

@@ -0,0 +1,9 @@
+ssl_certificate_key REGISTRY_HTTP_TLS_KEY;
+ssl_certificate     REGISTRY_HTTP_TLS_CERTIFICATE;
+
+ssl_protocols TLSv1.2;
+ssl_ciphers 'ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA256';
+ssl_prefer_server_ciphers on;
+
+add_header Strict-Transport-Security max-age=31536000;
+

files/startup.sh

@@ -36,11 +36,29 @@ echo Using cache max size $CACHE_MAX_SIZE
 
 CONFIG=/usr/local/openresty/nginx/conf/nginx.conf
 
+ENABLESSL=''
+SSLINCLUDE=''
+SSLCONFIG=/usr/local/openresty/nginx/conf/ssl.conf
+if [ ! -z "$REGISTRY_HTTP_TLS_CERTIFICATE" ] && [ ! -z "$REGISTRY_HTTP_TLS_KEY" ]; then
+  sed -i -e s!REGISTRY_HTTP_TLS_CERTIFICATE!"$REGISTRY_HTTP_TLS_CERTIFICATE"!g $SSLCONFIG
+  sed -i -e s!REGISTRY_HTTP_TLS_KEY!"$REGISTRY_HTTP_TLS_KEY"!g $SSLCONFIG
+  ENABLESSL='ssl'
+  SSLINCLUDE="include $SSLCONFIG;"
+fi
+
+AUTHCONFIG=''
+if [ ! -z "$REGISTRY_AUTH_HTPASSWD_PATH" ] && [ ! -z "$REGISTRY_AUTH_HTPASSWD_REALM" ]; then
+  AUTHCONFIG="auth_basic  ${REGISTRY_AUTH_HTPASSWD_REALM};\n    auth_basic_user_file ${REGISTRY_AUTH_HTPASSWD_PATH};"
+fi
+
 # Update nginx config
 sed -i -e s!UPSTREAM!"$UPSTREAM"!g $CONFIG
+sed -i -e s!LISTEN!"$PORT $ENABLESSL"!g $CONFIG
 sed -i -e s!PORT!"$PORT"!g $CONFIG
 sed -i -e s!RESOLVER!"$RESOLVER"!g $CONFIG
 sed -i -e s!CACHE_MAX_SIZE!"$CACHE_MAX_SIZE"!g $CONFIG
+sed -i -e s!#SSLCONFIG!"$SSLINCLUDE"!g $CONFIG
+sed -i -e s!#AUTHCONFIG!"$AUTHCONFIG"!g $CONFIG
 
 # setup ~/.aws directory
 AWS_FOLDER='/root/.aws'