Add Docker Registry configuration for k8s-server with TLS and authentication

2025-12-16 10:47:15 +01:00
parent a83976c615
commit dd943ffd16
6 changed files with 310 additions and 0 deletions
@@ -0,0 +1,164 @@
+{ config, pkgs, ... }:
+
+{
+  ########################################
+  # Docker Registry v2
+  ########################################
+  services.dockerRegistry = {
+    enable = true;
+    port = 5000;
+    listenAddress = "0.0.0.0";
+    
+    # Enable image deletion and garbage collection
+    enableDelete = true;
+    enableGarbageCollect = true;
+    garbageCollectDates = "Sun 03:00";
+    
+    # Storage location (root partition)
+    storagePath = "/var/lib/docker-registry";
+    
+    # TLS configuration (for internal access)
+    extraConfig = {
+      http = {
+        tls = {
+          certificate = "/var/lib/docker-registry/certs/registry.crt";
+          key = "/var/lib/docker-registry/certs/registry.key";
+        };
+      };
+    };
+  };
+
+  ########################################
+  # Firewall
+  ########################################
+  networking.firewall.allowedTCPPorts = [ 5000 ];
+
+  ########################################
+  # Setup: directories, certificates, htpasswd
+  ########################################
+  systemd.tmpfiles.rules = [
+    "d /var/lib/docker-registry 0755 root root -"
+    "d /var/lib/docker-registry/certs 0755 root root -"
+  ];
+
+  # Generate self-signed certificate
+  systemd.services.docker-registry-setup = {
+    description = "Docker Registry initial setup";
+    wantedBy = [ "multi-user.target" ];
+    before = [ "docker-registry.service" ];
+    path = with pkgs; [ openssl apacheHttpd ];
+    
+    serviceConfig = {
+      Type = "oneshot";
+      RemainAfterExit = true;
+    };
+    
+    script = ''
+      # Create self-signed certificate if it doesn't exist
+      if [ ! -f /var/lib/docker-registry/certs/registry.crt ]; then
+        echo "Generating self-signed certificate for Docker Registry..."
+        ${pkgs.openssl}/bin/openssl req -x509 -newkey rsa:4096 -nodes \
+          -keyout /var/lib/docker-registry/certs/registry.key \
+          -out /var/lib/docker-registry/certs/registry.crt \
+          -days 3650 \
+          -subj "/CN=registry.home.lindenfelser.de" \
+          -addext "subjectAltName=DNS:registry.home.lindenfelser.de,DNS:k8s-server,IP:10.202.82.7"
+        chmod 644 /var/lib/docker-registry/certs/registry.key
+        chmod 644 /var/lib/docker-registry/certs/registry.crt
+        echo "Certificate generated successfully"
+      fi
+      
+      # Ensure correct ownership
+      chown -R docker-registry:docker-registry /var/lib/docker-registry
+    '';
+  };
+
+  ########################################
+  # Storage Monitoring (80% threshold)
+  ########################################
+  systemd.services.docker-registry-storage-check = {
+    description = "Check Docker Registry storage usage";
+    path = with pkgs; [ coreutils util-linux ];
+    
+    serviceConfig = {
+      Type = "oneshot";
+      User = "root";
+    };
+    
+    script = ''
+      REGISTRY_PATH="/var/lib/docker-registry"
+      THRESHOLD=80
+      
+      if [ ! -d "$REGISTRY_PATH" ]; then
+        echo "Registry path does not exist yet"
+        exit 0
+      fi
+      
+      # Get disk usage percentage of the filesystem containing the registry
+      USAGE=$(df -h "$REGISTRY_PATH" | awk 'NR==2 {print $5}' | sed 's/%//')
+      REGISTRY_SIZE=$(du -sh "$REGISTRY_PATH" | cut -f1)
+      
+      echo "Docker Registry storage: $REGISTRY_SIZE (filesystem usage: $USAGE%)"
+      
+      if [ "$USAGE" -gt "$THRESHOLD" ]; then
+        echo "WARNING: Filesystem usage ($USAGE%) exceeds threshold ($THRESHOLD%)"
+        echo "Consider cleaning up old images or expanding storage"
+      fi
+    '';
+  };
+
+  systemd.timers.docker-registry-storage-check = {
+    description = "Timer for Docker Registry storage check";
+    wantedBy = [ "timers.target" ];
+    
+    timerConfig = {
+      OnCalendar = "daily";
+      Persistent = true;
+    };
+  };
+
+  ########################################
+  # Daily Storage Growth Tracking
+  ########################################
+  systemd.services.docker-registry-growth-tracker = {
+    description = "Track Docker Registry storage growth";
+    path = with pkgs; [ coreutils ];
+    
+    serviceConfig = {
+      Type = "oneshot";
+      User = "root";
+    };
+    
+    script = ''
+      REGISTRY_PATH="/var/lib/docker-registry"
+      LOG_FILE="/var/log/docker-registry-growth.log"
+      
+      if [ ! -d "$REGISTRY_PATH" ]; then
+        echo "Registry path does not exist yet"
+        exit 0
+      fi
+      
+      TIMESTAMP=$(date '+%Y-%m-%d %H:%M:%S')
+      SIZE_BYTES=$(du -sb "$REGISTRY_PATH" | cut -f1)
+      SIZE_HUMAN=$(du -sh "$REGISTRY_PATH" | cut -f1)
+      
+      echo "$TIMESTAMP | Size: $SIZE_HUMAN ($SIZE_BYTES bytes)" >> "$LOG_FILE"
+      
+      # Keep only last 90 days of logs
+      if [ -f "$LOG_FILE" ]; then
+        tail -n 90 "$LOG_FILE" > "$LOG_FILE.tmp"
+        mv "$LOG_FILE.tmp" "$LOG_FILE"
+      fi
+    '';
+  };
+
+  systemd.timers.docker-registry-growth-tracker = {
+    description = "Timer for Docker Registry growth tracking";
+    wantedBy = [ "timers.target" ];
+    
+    timerConfig = {
+      OnCalendar = "daily";
+      Persistent = true;
+    };
+  };
+}