infra-nix/modules/docker-registry.nix

{ config, pkgs, ... }:

{
  ########################################
  # Docker Registry v2
  ########################################
  services.dockerRegistry = {
    enable = true;
    port = 5000;
    listenAddress = "0.0.0.0";
    
    # Enable image deletion and garbage collection
    enableDelete = true;
    enableGarbageCollect = true;
    garbageCollectDates = "Sun 03:00";
    
    # Storage location (root partition)
    storagePath = "/var/lib/docker-registry";
    
    # TLS configuration (for internal access)
    extraConfig = {
      http = {
        tls = {
          certificate = "/var/lib/docker-registry/certs/registry.crt";
          key = "/var/lib/docker-registry/certs/registry.key";
        };
      };
    };
  };

  ########################################
  # Firewall
  ########################################
  networking.firewall.allowedTCPPorts = [ 5000 ];

  ########################################
  # Setup: directories, certificates, htpasswd
  ########################################
  systemd.tmpfiles.rules = [
    "d /var/lib/docker-registry 0755 root root -"
    "d /var/lib/docker-registry/certs 0755 root root -"
  ];

  # Generate self-signed certificate
  systemd.services.docker-registry-setup = {
    description = "Docker Registry initial setup";
    wantedBy = [ "multi-user.target" ];
    before = [ "docker-registry.service" ];
    path = with pkgs; [ openssl apacheHttpd ];
    
    serviceConfig = {
      Type = "oneshot";
      RemainAfterExit = true;
    };
    
    script = ''
      # Create self-signed certificate if it doesn't exist
      if [ ! -f /var/lib/docker-registry/certs/registry.crt ]; then
        echo "Generating self-signed certificate for Docker Registry..."
        ${pkgs.openssl}/bin/openssl req -x509 -newkey rsa:4096 -nodes \
          -keyout /var/lib/docker-registry/certs/registry.key \
          -out /var/lib/docker-registry/certs/registry.crt \
          -days 3650 \
          -subj "/CN=registry.home.lindenfelser.de" \
          -addext "subjectAltName=DNS:registry.home.lindenfelser.de,DNS:k8s-server,IP:10.202.82.7"
        chmod 644 /var/lib/docker-registry/certs/registry.key
        chmod 644 /var/lib/docker-registry/certs/registry.crt
        echo "Certificate generated successfully"
      fi
      
      # Ensure correct ownership
      chown -R docker-registry:docker-registry /var/lib/docker-registry
    '';
  };

  ########################################
  # Storage Monitoring (80% threshold)
  ########################################
  systemd.services.docker-registry-storage-check = {
    description = "Check Docker Registry storage usage";
    path = with pkgs; [ coreutils util-linux ];
    
    serviceConfig = {
      Type = "oneshot";
      User = "root";
    };
    
    script = ''
      REGISTRY_PATH="/var/lib/docker-registry"
      THRESHOLD=80
      
      if [ ! -d "$REGISTRY_PATH" ]; then
        echo "Registry path does not exist yet"
        exit 0
      fi
      
      # Get disk usage percentage of the filesystem containing the registry
      USAGE=$(df -h "$REGISTRY_PATH" | awk 'NR==2 {print $5}' | sed 's/%//')
      REGISTRY_SIZE=$(du -sh "$REGISTRY_PATH" | cut -f1)
      
      echo "Docker Registry storage: $REGISTRY_SIZE (filesystem usage: $USAGE%)"
      
      if [ "$USAGE" -gt "$THRESHOLD" ]; then
        echo "WARNING: Filesystem usage ($USAGE%) exceeds threshold ($THRESHOLD%)"
        echo "Consider cleaning up old images or expanding storage"
      fi
    '';
  };

  systemd.timers.docker-registry-storage-check = {
    description = "Timer for Docker Registry storage check";
    wantedBy = [ "timers.target" ];
    
    timerConfig = {
      OnCalendar = "daily";
      Persistent = true;
    };
  };

  ########################################
  # Daily Storage Growth Tracking
  ########################################
  systemd.services.docker-registry-growth-tracker = {
    description = "Track Docker Registry storage growth";
    path = with pkgs; [ coreutils ];
    
    serviceConfig = {
      Type = "oneshot";
      User = "root";
    };
    
    script = ''
      REGISTRY_PATH="/var/lib/docker-registry"
      LOG_FILE="/var/log/docker-registry-growth.log"
      
      if [ ! -d "$REGISTRY_PATH" ]; then
        echo "Registry path does not exist yet"
        exit 0
      fi
      
      TIMESTAMP=$(date '+%Y-%m-%d %H:%M:%S')
      SIZE_BYTES=$(du -sb "$REGISTRY_PATH" | cut -f1)
      SIZE_HUMAN=$(du -sh "$REGISTRY_PATH" | cut -f1)
      
      echo "$TIMESTAMP | Size: $SIZE_HUMAN ($SIZE_BYTES bytes)" >> "$LOG_FILE"
      
      # Keep only last 90 days of logs
      if [ -f "$LOG_FILE" ]; then
        tail -n 90 "$LOG_FILE" > "$LOG_FILE.tmp"
        mv "$LOG_FILE.tmp" "$LOG_FILE"
      fi
    '';
  };

  systemd.timers.docker-registry-growth-tracker = {
    description = "Timer for Docker Registry growth tracking";
    wantedBy = [ "timers.target" ];
    
    timerConfig = {
      OnCalendar = "daily";
      Persistent = true;
    };
  };
}