nixos/docker-registry: cleanup module definition & enhance testcase
The following changes have been applied: - the property `http.headers.X-Content-Type-Options` must a list of strings rather than a serialized list - instead of `/etc/docker/registry/config.yml` the configuration will be written with `pkgs.writeText` and the store path will be used to run the registry. This reduces the risk of possible impurities by relying on the Nix store only. - cleaned up the property paths to easy readability and reduce the verbosity. - enhanced the testcase to ensure that digests can be deleted as well - the `services.docker-registry.extraConfig` object will be merged with `registryConfig` /cc @ironpinguin
This commit is contained in:
parent
f5c0b3f887
commit
593dc45141
|
@ -77,6 +77,13 @@ following incompatible changes:</para>
|
|||
accepted by the nc command.
|
||||
</para>
|
||||
</listitem>
|
||||
<listitem>
|
||||
<para>
|
||||
The <varname>services.docker-registry.extraConfig</varname> object doesn't contain
|
||||
environment variables anymore. Instead it needs to provide an object structure
|
||||
that can be mapped onto the YAML configuration defined in <link xlink:href="https://github.com/docker/distribution/blob/v2.6.2/docs/configuration.md">the <varname>docker/distribution</varname> docs</link>.
|
||||
</para>
|
||||
</listitem>
|
||||
</itemizedlist>
|
||||
|
||||
</section>
|
||||
|
|
|
@ -5,40 +5,26 @@ with lib;
|
|||
let
|
||||
cfg = config.services.dockerRegistry;
|
||||
|
||||
blogCache = if cfg.enableRedisCache
|
||||
then "redis"
|
||||
else "inmemory";
|
||||
blobCache = if cfg.enableRedisCache
|
||||
then "redis"
|
||||
else "inmemory";
|
||||
|
||||
registryConfig = {
|
||||
version = "0.1";
|
||||
log = {
|
||||
fields = {
|
||||
service = "registry";
|
||||
};
|
||||
};
|
||||
log.fields.service = "registry";
|
||||
storage = {
|
||||
cache = {
|
||||
blobdescriptor = "${blogCache}";
|
||||
};
|
||||
filesystem = {
|
||||
rootdirectory = "/var/lib/registry";
|
||||
};
|
||||
delete = {
|
||||
enabled = cfg.enableDelete;
|
||||
};
|
||||
cache.blobdescriptor = blobCache;
|
||||
filesystem.rootdirectory = cfg.storagePath;
|
||||
delete.enabled = cfg.enableDelete;
|
||||
};
|
||||
http = {
|
||||
addr = ":5000";
|
||||
headers = {
|
||||
X-Content-Type-Options = "[nosniff]";
|
||||
};
|
||||
addr = ":${builtins.toString cfg.port}";
|
||||
headers.X-Content-Type-Options = ["nosniff"];
|
||||
};
|
||||
health = {
|
||||
storagedriver = {
|
||||
enabled = true;
|
||||
interval = "10s";
|
||||
threshold = 3;
|
||||
};
|
||||
health.storagedriver = {
|
||||
enabled = true;
|
||||
interval = "10s";
|
||||
threshold = 3;
|
||||
};
|
||||
};
|
||||
|
||||
|
@ -98,7 +84,7 @@ in {
|
|||
|
||||
redisPassword = mkOption {
|
||||
type = types.str;
|
||||
default = "asecret";
|
||||
default = "";
|
||||
description = "Set redis password.";
|
||||
};
|
||||
|
||||
|
@ -112,21 +98,14 @@ in {
|
|||
};
|
||||
|
||||
config = mkIf cfg.enable {
|
||||
environment.etc."docker/registry/config.yml".text = builtins.toJSON registryConfig;
|
||||
|
||||
systemd.services.docker-registry = {
|
||||
description = "Docker Container Registry";
|
||||
wantedBy = [ "multi-user.target" ];
|
||||
after = [ "network.target" ];
|
||||
|
||||
environment = {
|
||||
REGISTRY_HTTP_ADDR = "${cfg.listenAddress}:${toString cfg.port}";
|
||||
REGISTRY_STORAGE_FILESYSTEM_ROOTDIRECTORY = cfg.storagePath;
|
||||
} // cfg.extraConfig;
|
||||
|
||||
script = ''
|
||||
${pkgs.docker-distribution}/bin/registry serve \
|
||||
/etc/docker/registry/config.yml
|
||||
script = let
|
||||
configFile = pkgs.writeText "docker-registry-config.yml" (builtins.toJSON (registryConfig // cfg.extraConfig));
|
||||
in ''
|
||||
${pkgs.docker-distribution}/bin/registry serve ${configFile}
|
||||
'';
|
||||
|
||||
serviceConfig = {
|
||||
|
|
|
@ -3,12 +3,13 @@
|
|||
import ./make-test.nix ({ pkgs, ...} : {
|
||||
name = "docker-registry";
|
||||
meta = with pkgs.stdenv.lib.maintainers; {
|
||||
maintainers = [ globin ];
|
||||
maintainers = [ globin ma27 ];
|
||||
};
|
||||
|
||||
nodes = {
|
||||
registry = { config, pkgs, ... }: {
|
||||
services.dockerRegistry.enable = true;
|
||||
services.dockerRegistry.enableDelete = true;
|
||||
services.dockerRegistry.port = 8080;
|
||||
services.dockerRegistry.listenAddress = "0.0.0.0";
|
||||
networking.firewall.allowedTCPPorts = [ 8080 ];
|
||||
|
@ -22,6 +23,7 @@ import ./make-test.nix ({ pkgs, ...} : {
|
|||
client2 = { config, pkgs, ...}: {
|
||||
virtualisation.docker.enable = true;
|
||||
virtualisation.docker.extraOptions = "--insecure-registry registry:8080";
|
||||
environment.systemPackages = [ pkgs.jq ];
|
||||
};
|
||||
};
|
||||
|
||||
|
@ -39,5 +41,9 @@ import ./make-test.nix ({ pkgs, ...} : {
|
|||
$client2->waitForUnit("docker.service");
|
||||
$client2->succeed("docker pull registry:8080/scratch");
|
||||
$client2->succeed("docker images | grep scratch");
|
||||
|
||||
$client2->succeed(
|
||||
'curl -fsS -X DELETE registry:8080/v2/scratch/manifests/$(curl registry:8080/v2/scratch/manifests/latest | jq ".fsLayers[0].blobSum" | sed -e \'s/"//g\')'
|
||||
);
|
||||
'';
|
||||
})
|
||||
|
|
Loading…
Reference in a new issue