Skip to content

Instantly share code, notes, and snippets.

@AndyA

AndyA/docker-registry.conf

Created May 16, 2019 16:54
Show Gist options
  • Save AndyA/b5b1732c7b07dfb83196476e6a800aa6 to your computer and use it in GitHub Desktop.
Save AndyA/b5b1732c7b07dfb83196476e6a800aa6 to your computer and use it in GitHub Desktop.
Download ZIP
Apache config to reverse proxy a docker registry with letsencrypt certs
Raw
docker-registry.conf
<IfModule mod_ssl.c>
<VirtualHost *:443>
ServerName "registry.example.com"
DocumentRoot /opt/registry.example.com/www
CustomLog "|/usr/bin/rotatelogs -L /opt/registry.example.com/logs/apache.access_log.current /opt/registry.example.com/logs/apache.access_log 86400" combined
ErrorLog "|/usr/bin/rotatelogs -L /opt/registry.example.com/logs/apache.error_log.current /opt/registry.example.com/logs/apache.error_log 86400"
ProxyRequests off
ProxyPreserveHost on
ProxyPass /v2 http://localhost:5000/v2
ProxyPassReverse /v2 http://localhost:5000/v2
<Directory /opt/registry.example.com/www>
AllowOverride All
Options +ExecCGI -MultiViews +FollowSymLinks
Require all granted
</Directory>
<Location /v2>
RequestHeader set X-Forwarded-Proto https
AuthName "Example Docker Registry"
AuthType Basic
AuthUserFile "/etc/apache2/passwd/docker"
AuthGroupFile "/etc/apache2/passwd/docker.group"
# Read access to authentified users
<Limit GET HEAD>
<RequireAny >
Require forward-dns home.dyn.example.com
Require local
Require valid-user
</RequireAny>
</Limit>
# Write access to docker-deployer only
<Limit POST PUT DELETE PATCH>
<RequireAny >
Require forward-dns home.dyn.example.com
Require local
Require group pusher
</RequireAny>
</Limit>
</Location>
# Pass-through for certbot. Not currently necessary: we only proxy /v2
<Location /.well-known/acme-challenge>
ProxyPass !
Require all granted
</Location>
SSLCertificateFile /etc/letsencrypt/live/registry.example.com/fullchain.pem
SSLCertificateKeyFile /etc/letsencrypt/live/registry.example.com/privkey.pem
Include /etc/letsencrypt/options-ssl-apache.conf
</VirtualHost>
</IfModule>
Raw
registry.sh
# Run the docker registry
docker run -d -p 5000:5000 --restart unless-stopped --name registry -v /data/docker/registry:/var/lib/registry registry:2
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment