Add Docker Registry configuration for k8s-server with TLS and authentication

modules/common.nix

@@ -39,6 +39,7 @@
     htop
     curl
     wget
+    apacheHttpd  # Provides htpasswd for registry password management
   ];
 
   # QEMU guest agent (for VM integration when running as guest)

modules/docker-registry.nix

@@ -0,0 +1,164 @@
+{ config, pkgs, ... }:
+
+{
+  ########################################
+  # Docker Registry v2
+  ########################################
+  services.dockerRegistry = {
+    enable = true;
+    port = 5000;
+    listenAddress = "0.0.0.0";
+    
+    # Enable image deletion and garbage collection
+    enableDelete = true;
+    enableGarbageCollect = true;
+    garbageCollectDates = "Sun 03:00";
+    
+    # Storage location (root partition)
+    storagePath = "/var/lib/docker-registry";
+    
+    # TLS configuration (for internal access)
+    extraConfig = {
+      http = {
+        tls = {
+          certificate = "/var/lib/docker-registry/certs/registry.crt";
+          key = "/var/lib/docker-registry/certs/registry.key";
+        };
+      };
+    };
+  };
+
+  ########################################
+  # Firewall
+  ########################################
+  networking.firewall.allowedTCPPorts = [ 5000 ];
+
+  ########################################
+  # Setup: directories, certificates, htpasswd
+  ########################################
+  systemd.tmpfiles.rules = [
+    "d /var/lib/docker-registry 0755 root root -"
+    "d /var/lib/docker-registry/certs 0755 root root -"
+  ];
+
+  # Generate self-signed certificate
+  systemd.services.docker-registry-setup = {
+    description = "Docker Registry initial setup";
+    wantedBy = [ "multi-user.target" ];
+    before = [ "docker-registry.service" ];
+    path = with pkgs; [ openssl apacheHttpd ];
+    
+    serviceConfig = {
+      Type = "oneshot";
+      RemainAfterExit = true;
+    };
+    
+    script = ''
+      # Create self-signed certificate if it doesn't exist
+      if [ ! -f /var/lib/docker-registry/certs/registry.crt ]; then
+        echo "Generating self-signed certificate for Docker Registry..."
+        ${pkgs.openssl}/bin/openssl req -x509 -newkey rsa:4096 -nodes \
+          -keyout /var/lib/docker-registry/certs/registry.key \
+          -out /var/lib/docker-registry/certs/registry.crt \
+          -days 3650 \
+          -subj "/CN=registry.home.lindenfelser.de" \
+          -addext "subjectAltName=DNS:registry.home.lindenfelser.de,DNS:k8s-server,IP:10.202.82.7"
+        chmod 644 /var/lib/docker-registry/certs/registry.key
+        chmod 644 /var/lib/docker-registry/certs/registry.crt
+        echo "Certificate generated successfully"
+      fi
+      
+      # Ensure correct ownership
+      chown -R docker-registry:docker-registry /var/lib/docker-registry
+    '';
+  };
+
+  ########################################
+  # Storage Monitoring (80% threshold)
+  ########################################
+  systemd.services.docker-registry-storage-check = {
+    description = "Check Docker Registry storage usage";
+    path = with pkgs; [ coreutils util-linux ];
+    
+    serviceConfig = {
+      Type = "oneshot";
+      User = "root";
+    };
+    
+    script = ''
+      REGISTRY_PATH="/var/lib/docker-registry"
+      THRESHOLD=80
+      
+      if [ ! -d "$REGISTRY_PATH" ]; then
+        echo "Registry path does not exist yet"
+        exit 0
+      fi
+      
+      # Get disk usage percentage of the filesystem containing the registry
+      USAGE=$(df -h "$REGISTRY_PATH" | awk 'NR==2 {print $5}' | sed 's/%//')
+      REGISTRY_SIZE=$(du -sh "$REGISTRY_PATH" | cut -f1)
+      
+      echo "Docker Registry storage: $REGISTRY_SIZE (filesystem usage: $USAGE%)"
+      
+      if [ "$USAGE" -gt "$THRESHOLD" ]; then
+        echo "WARNING: Filesystem usage ($USAGE%) exceeds threshold ($THRESHOLD%)"
+        echo "Consider cleaning up old images or expanding storage"
+      fi
+    '';
+  };
+
+  systemd.timers.docker-registry-storage-check = {
+    description = "Timer for Docker Registry storage check";
+    wantedBy = [ "timers.target" ];
+    
+    timerConfig = {
+      OnCalendar = "daily";
+      Persistent = true;
+    };
+  };
+
+  ########################################
+  # Daily Storage Growth Tracking
+  ########################################
+  systemd.services.docker-registry-growth-tracker = {
+    description = "Track Docker Registry storage growth";
+    path = with pkgs; [ coreutils ];
+    
+    serviceConfig = {
+      Type = "oneshot";
+      User = "root";
+    };
+    
+    script = ''
+      REGISTRY_PATH="/var/lib/docker-registry"
+      LOG_FILE="/var/log/docker-registry-growth.log"
+      
+      if [ ! -d "$REGISTRY_PATH" ]; then
+        echo "Registry path does not exist yet"
+        exit 0
+      fi
+      
+      TIMESTAMP=$(date '+%Y-%m-%d %H:%M:%S')
+      SIZE_BYTES=$(du -sb "$REGISTRY_PATH" | cut -f1)
+      SIZE_HUMAN=$(du -sh "$REGISTRY_PATH" | cut -f1)
+      
+      echo "$TIMESTAMP | Size: $SIZE_HUMAN ($SIZE_BYTES bytes)" >> "$LOG_FILE"
+      
+      # Keep only last 90 days of logs
+      if [ -f "$LOG_FILE" ]; then
+        tail -n 90 "$LOG_FILE" > "$LOG_FILE.tmp"
+        mv "$LOG_FILE.tmp" "$LOG_FILE"
+      fi
+    '';
+  };
+
+  systemd.timers.docker-registry-growth-tracker = {
+    description = "Timer for Docker Registry growth tracking";
+    wantedBy = [ "timers.target" ];
+    
+    timerConfig = {
+      OnCalendar = "daily";
+      Persistent = true;
+    };
+  };
+}

modules/gateway.nix

@@ -42,6 +42,20 @@
           reverse_proxy 10.202.82.6:3000
         '';
       };
+      "registry.home.lindenfelser.de" = {
+        extraConfig = ''
+          @registry host registry.home.lindenfelser.de
+          basicauth @registry {
+            admin $2a$14$Ga5BCiHvtlfRjdnlI9bhseFnNZ8dwXsLz4t1FdSemA1mAUV/vA1oi
+          }
+          reverse_proxy @registry https://10.202.82.7:5000 {
+            transport http {
+              tls
+              tls_insecure_skip_verify
+            }
+          }
+        '';
+      };
     };
   };
 

modules/kubernetes.nix

@@ -12,6 +12,7 @@
       "--cluster-init"
       "--disable=traefik"
       "--flannel-backend=vxlan"
+      "--tls-san=k8s.home.lindenfelser.de"
     ];
   };
 
@@ -22,9 +23,27 @@
   networking.firewall.allowedTCPPorts = [
     6443  # Kubernetes API
     10250 # Kubelet metrics
+    5000  # Docker Registry
   ];
 
   networking.firewall.allowedUDPPorts = [
     8472  # flannel VXLAN
   ];
+
+  ########################################
+  # Containerd registry configuration
+  ########################################
+  environment.etc."rancher/k3s/registries.yaml" = {
+    text = ''
+      mirrors:
+        registry.home.lindenfelser.de:
+          endpoint:
+            - "https://10.202.82.7:5000"
+      configs:
+        "10.202.82.7:5000":
+          tls:
+            insecure_skip_verify: true
+    '';
+    mode = "0644";
+  };
 }