Add harbor to ansible
This commit is contained in:
parent
67d0c8d875
commit
3175b6a42b
GPG key ID:
13AD60C237A28DFE
2
.gitignore
vendored
2
.gitignore
vendored
|
|
@ -9,6 +9,7 @@
|
||||||
/forgejo-runner/
|
/forgejo-runner/
|
||||||
/gitea/
|
/gitea/
|
||||||
/gitea-runner/
|
/gitea-runner/
|
||||||
|
/harbor/
|
||||||
/healthcheck/
|
/healthcheck/
|
||||||
/homebox/
|
/homebox/
|
||||||
/influxdb/
|
/influxdb/
|
||||||
|
|
@ -35,6 +36,7 @@
|
||||||
/caddy/config/conf.002.d/matrix.msrg.cc.conf
|
/caddy/config/conf.002.d/matrix.msrg.cc.conf
|
||||||
/caddy/config/conf.002.d/media.serguzim.me.conf
|
/caddy/config/conf.002.d/media.serguzim.me.conf
|
||||||
/caddy/config/conf.002.d/recipes.serguzim.me.conf
|
/caddy/config/conf.002.d/recipes.serguzim.me.conf
|
||||||
|
/caddy/config/conf.002.d/registry.serguzim.me.conf
|
||||||
/caddy/config/conf.002.d/rss.serguzim.me.conf
|
/caddy/config/conf.002.d/rss.serguzim.me.conf
|
||||||
/caddy/config/conf.002.d/status.serguzim.me.conf
|
/caddy/config/conf.002.d/status.serguzim.me.conf
|
||||||
/caddy/config/conf.002.d/tick.serguzim.me.conf
|
/caddy/config/conf.002.d/tick.serguzim.me.conf
|
||||||
|
|
|
||||||
|
|
@ -7,6 +7,7 @@
|
||||||
- faas
|
- faas
|
||||||
- forgejo
|
- forgejo
|
||||||
- forgejo-runner
|
- forgejo-runner
|
||||||
|
- harbor
|
||||||
- healthcheck
|
- healthcheck
|
||||||
- homebox
|
- homebox
|
||||||
- influxdb
|
- influxdb
|
||||||
|
|
|
||||||
22
_ansible/roles/harbor/files/msrg.cc.log.config
Normal file
22
_ansible/roles/harbor/files/msrg.cc.log.config
Normal file
|
|
@ -0,0 +1,22 @@
|
||||||
|
version: 1
|
||||||
|
|
||||||
|
formatters:
|
||||||
|
precise:
|
||||||
|
format: '%(asctime)s - %(name)s - %(lineno)d - %(levelname)s - %(request)s - %(message)s'
|
||||||
|
|
||||||
|
handlers:
|
||||||
|
console:
|
||||||
|
class: logging.StreamHandler
|
||||||
|
formatter: precise
|
||||||
|
|
||||||
|
loggers:
|
||||||
|
synapse.storage.SQL:
|
||||||
|
# beware: increasing this to DEBUG will make synapse log sensitive
|
||||||
|
# information such as access tokens.
|
||||||
|
level: INFO
|
||||||
|
|
||||||
|
root:
|
||||||
|
level: INFO
|
||||||
|
handlers: [console]
|
||||||
|
|
||||||
|
disable_existing_loggers: false
|
||||||
35
_ansible/roles/harbor/tasks/main.yml
Normal file
35
_ansible/roles/harbor/tasks/main.yml
Normal file
|
|
@ -0,0 +1,35 @@
|
||||||
|
---
|
||||||
|
- name: Deploy {{ svc.name }}
|
||||||
|
tags:
|
||||||
|
- harbor
|
||||||
|
- registry
|
||||||
|
block:
|
||||||
|
- import_tasks: steps/create-service-directory.yml
|
||||||
|
- import_tasks: steps/template-site-config.yml
|
||||||
|
|
||||||
|
- name: Template config
|
||||||
|
ansible.builtin.template:
|
||||||
|
src: service.yml.j2
|
||||||
|
dest: "{{ (service_path, 'harbor.yml') | path_join }}"
|
||||||
|
mode: "0644"
|
||||||
|
|
||||||
|
- name: Download harbor
|
||||||
|
ansible.builtin.unarchive:
|
||||||
|
src: https://github.com/goharbor/harbor/releases/download/v{{ svc.harbor_version }}/harbor-online-installer-v{{ svc.harbor_version }}.tgz
|
||||||
|
dest: "{{ service_path }}"
|
||||||
|
remote_src: yes
|
||||||
|
|
||||||
|
- name: Run the harbor prepare command
|
||||||
|
ansible.builtin.command:
|
||||||
|
cmd: "{{ service_path }}/harbor/prepare"
|
||||||
|
chdir: "{{ service_path }}"
|
||||||
|
environment:
|
||||||
|
HARBOR_BUNDLE_DIR: "{{ service_path }}"
|
||||||
|
|
||||||
|
- name: Run the harbor install command
|
||||||
|
ansible.builtin.command:
|
||||||
|
cmd: "{{ service_path }}/harbor/install.sh"
|
||||||
|
chdir: "{{ service_path }}"
|
||||||
|
environment:
|
||||||
|
HARBOR_BUNDLE_DIR: "{{ service_path }}"
|
||||||
|
become: true
|
||||||
96
_ansible/roles/harbor/vars/main.yml
Normal file
96
_ansible/roles/harbor/vars/main.yml
Normal file
|
|
@ -0,0 +1,96 @@
|
||||||
|
svc_ports:
|
||||||
|
http: 20080
|
||||||
|
https: 20443
|
||||||
|
metrics: 29000
|
||||||
|
|
||||||
|
svc:
|
||||||
|
name: harbor
|
||||||
|
domain: "registry.serguzim.me"
|
||||||
|
caddy_extra: |
|
||||||
|
reverse_proxy /metrics host.docker.internal:{{ svc_ports.metrics }}
|
||||||
|
reverse_proxy host.docker.internal:{{ svc_ports.https }} {
|
||||||
|
transport http {
|
||||||
|
tls
|
||||||
|
tls_server_name registry.serguzim.me
|
||||||
|
}
|
||||||
|
}
|
||||||
|
caddy_default: false
|
||||||
|
db:
|
||||||
|
host: "{{ postgres.host }}"
|
||||||
|
port: "{{ postgres.port }}"
|
||||||
|
database: harbor
|
||||||
|
user: "{{ vault_harbor.db.user }}"
|
||||||
|
pass: "{{ vault_harbor.db.pass }}"
|
||||||
|
harbor_version: 2.9.0
|
||||||
|
|
||||||
|
svc_yml:
|
||||||
|
hostname: "{{ svc.domain }}"
|
||||||
|
http:
|
||||||
|
port: "{{ svc_ports.http }}"
|
||||||
|
https:
|
||||||
|
port: "{{ svc_ports.https }}"
|
||||||
|
certificate: /opt/services/.lego/certificates/registry.serguzim.me.crt
|
||||||
|
private_key: /opt/services/.lego/certificates/registry.serguzim.me.key
|
||||||
|
external_url: https://registry.serguzim.me
|
||||||
|
harbor_admin_password: "{{ vault_harbor.admin_password }}"
|
||||||
|
data_volume: "{{ (service_path, 'data') | path_join }}"
|
||||||
|
storage_service:
|
||||||
|
s3:
|
||||||
|
accesskey: "{{ vault_harbor.minio.accesskey }}"
|
||||||
|
secretkey: "{{ vault_harbor.minio.secretkey }}"
|
||||||
|
region: de-contabo-1
|
||||||
|
regionendpoint: https://s3.serguzim.me
|
||||||
|
bucket: registry
|
||||||
|
secure: true
|
||||||
|
trivy:
|
||||||
|
ignore_unfixed: false
|
||||||
|
skip_update: false
|
||||||
|
offline_scan: false
|
||||||
|
security_check: vuln
|
||||||
|
insecure: false
|
||||||
|
jobservice:
|
||||||
|
max_job_workers: 10
|
||||||
|
job_loggers:
|
||||||
|
- STD_OUTPUT
|
||||||
|
- FILE
|
||||||
|
logger_sweeper_duration: 1
|
||||||
|
notification:
|
||||||
|
webhook_job_max_retry: 3
|
||||||
|
webhook_job_http_client_timeout: 3
|
||||||
|
log:
|
||||||
|
level: info
|
||||||
|
local:
|
||||||
|
rotate_count: 50
|
||||||
|
rotate_size: 200M
|
||||||
|
location: /var/log/harbor
|
||||||
|
_version: "{{ svc.harbor_version }}"
|
||||||
|
external_database:
|
||||||
|
harbor:
|
||||||
|
host: "{{ svc.db.host }}"
|
||||||
|
port: "{{ svc.db.port }}"
|
||||||
|
db_name: "{{ svc.db.database }}"
|
||||||
|
username: "{{ svc.db.user }}"
|
||||||
|
password: "{{ svc.db.pass }}"
|
||||||
|
ssl_mode: verify-full
|
||||||
|
max_idle_conns: 2
|
||||||
|
max_open_conns: 0
|
||||||
|
proxy:
|
||||||
|
http_proxy: null
|
||||||
|
https_proxy: null
|
||||||
|
no_proxy: null
|
||||||
|
components:
|
||||||
|
- core
|
||||||
|
- jobservice
|
||||||
|
- trivy
|
||||||
|
metric:
|
||||||
|
enabled: enabled
|
||||||
|
port: "{{ svc_ports.metrics }}"
|
||||||
|
path: /metrics
|
||||||
|
upload_purging:
|
||||||
|
enabled: true
|
||||||
|
age: 168h
|
||||||
|
interval: 24h
|
||||||
|
dryrun: false
|
||||||
|
cache:
|
||||||
|
enabled: false
|
||||||
|
expire_hours: 24
|
||||||
|
|
@ -14,6 +14,7 @@
|
||||||
|
|
||||||
{{ svc.caddy_extra | indent(width='\t', first=True) if svc.caddy_extra|default(false) }}
|
{{ svc.caddy_extra | indent(width='\t', first=True) if svc.caddy_extra|default(false) }}
|
||||||
|
|
||||||
|
{% if svc.caddy_default|default(true) %}
|
||||||
handle {
|
handle {
|
||||||
{% if svc.faas_function|default(false) %}
|
{% if svc.faas_function|default(false) %}
|
||||||
import faas {{ svc.faas_function }}
|
import faas {{ svc.faas_function }}
|
||||||
|
|
@ -21,6 +22,7 @@
|
||||||
reverse_proxy {{ svc.docker_host|default(svc.name) }}:{{ svc.port }}
|
reverse_proxy {{ svc.docker_host|default(svc.name) }}:{{ svc.port }}
|
||||||
{% endif %}
|
{% endif %}
|
||||||
}
|
}
|
||||||
|
{% endif %}
|
||||||
}
|
}
|
||||||
|
|
||||||
{% if svc.www_domain|default(false) %}
|
{% if svc.www_domain|default(false) %}
|
||||||
|
|
|
||||||
|
|
@ -1,12 +0,0 @@
|
||||||
registry.serguzim.me {
|
|
||||||
import default
|
|
||||||
reverse_proxy /metrics host.docker.internal:3059
|
|
||||||
reverse_proxy host.docker.internal:3051 {
|
|
||||||
transport http {
|
|
||||||
tls
|
|
||||||
tls_server_name registry.serguzim.me
|
|
||||||
}
|
|
||||||
}
|
|
||||||
#reverse_proxy /metrics https://registry.serguzim.me:3059
|
|
||||||
#reverse_proxy https://registry.serguzim.me:3051
|
|
||||||
}
|
|
||||||
4
harbor/.gitignore
vendored
4
harbor/.gitignore
vendored
|
|
@ -1,4 +0,0 @@
|
||||||
common/
|
|
||||||
data/
|
|
||||||
docker-compose.yml
|
|
||||||
harbor.yml
|
|
||||||
201
harbor/LICENSE
201
harbor/LICENSE
|
|
@ -1,201 +0,0 @@
|
||||||
Apache License
|
|
||||||
Version 2.0, January 2004
|
|
||||||
http://www.apache.org/licenses/
|
|
||||||
|
|
||||||
TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION
|
|
||||||
|
|
||||||
1. Definitions.
|
|
||||||
|
|
||||||
"License" shall mean the terms and conditions for use, reproduction,
|
|
||||||
and distribution as defined by Sections 1 through 9 of this document.
|
|
||||||
|
|
||||||
"Licensor" shall mean the copyright owner or entity authorized by
|
|
||||||
the copyright owner that is granting the License.
|
|
||||||
|
|
||||||
"Legal Entity" shall mean the union of the acting entity and all
|
|
||||||
other entities that control, are controlled by, or are under common
|
|
||||||
control with that entity. For the purposes of this definition,
|
|
||||||
"control" means (i) the power, direct or indirect, to cause the
|
|
||||||
direction or management of such entity, whether by contract or
|
|
||||||
otherwise, or (ii) ownership of fifty percent (50%) or more of the
|
|
||||||
outstanding shares, or (iii) beneficial ownership of such entity.
|
|
||||||
|
|
||||||
"You" (or "Your") shall mean an individual or Legal Entity
|
|
||||||
exercising permissions granted by this License.
|
|
||||||
|
|
||||||
"Source" form shall mean the preferred form for making modifications,
|
|
||||||
including but not limited to software source code, documentation
|
|
||||||
source, and configuration files.
|
|
||||||
|
|
||||||
"Object" form shall mean any form resulting from mechanical
|
|
||||||
transformation or translation of a Source form, including but
|
|
||||||
not limited to compiled object code, generated documentation,
|
|
||||||
and conversions to other media types.
|
|
||||||
|
|
||||||
"Work" shall mean the work of authorship, whether in Source or
|
|
||||||
Object form, made available under the License, as indicated by a
|
|
||||||
copyright notice that is included in or attached to the work
|
|
||||||
(an example is provided in the Appendix below).
|
|
||||||
|
|
||||||
"Derivative Works" shall mean any work, whether in Source or Object
|
|
||||||
form, that is based on (or derived from) the Work and for which the
|
|
||||||
editorial revisions, annotations, elaborations, or other modifications
|
|
||||||
represent, as a whole, an original work of authorship. For the purposes
|
|
||||||
of this License, Derivative Works shall not include works that remain
|
|
||||||
separable from, or merely link (or bind by name) to the interfaces of,
|
|
||||||
the Work and Derivative Works thereof.
|
|
||||||
|
|
||||||
"Contribution" shall mean any work of authorship, including
|
|
||||||
the original version of the Work and any modifications or additions
|
|
||||||
to that Work or Derivative Works thereof, that is intentionally
|
|
||||||
submitted to Licensor for inclusion in the Work by the copyright owner
|
|
||||||
or by an individual or Legal Entity authorized to submit on behalf of
|
|
||||||
the copyright owner. For the purposes of this definition, "submitted"
|
|
||||||
means any form of electronic, verbal, or written communication sent
|
|
||||||
to the Licensor or its representatives, including but not limited to
|
|
||||||
communication on electronic mailing lists, source code control systems,
|
|
||||||
and issue tracking systems that are managed by, or on behalf of, the
|
|
||||||
Licensor for the purpose of discussing and improving the Work, but
|
|
||||||
excluding communication that is conspicuously marked or otherwise
|
|
||||||
designated in writing by the copyright owner as "Not a Contribution."
|
|
||||||
|
|
||||||
"Contributor" shall mean Licensor and any individual or Legal Entity
|
|
||||||
on behalf of whom a Contribution has been received by Licensor and
|
|
||||||
subsequently incorporated within the Work.
|
|
||||||
|
|
||||||
2. Grant of Copyright License. Subject to the terms and conditions of
|
|
||||||
this License, each Contributor hereby grants to You a perpetual,
|
|
||||||
worldwide, non-exclusive, no-charge, royalty-free, irrevocable
|
|
||||||
copyright license to reproduce, prepare Derivative Works of,
|
|
||||||
publicly display, publicly perform, sublicense, and distribute the
|
|
||||||
Work and such Derivative Works in Source or Object form.
|
|
||||||
|
|
||||||
3. Grant of Patent License. Subject to the terms and conditions of
|
|
||||||
this License, each Contributor hereby grants to You a perpetual,
|
|
||||||
worldwide, non-exclusive, no-charge, royalty-free, irrevocable
|
|
||||||
(except as stated in this section) patent license to make, have made,
|
|
||||||
use, offer to sell, sell, import, and otherwise transfer the Work,
|
|
||||||
where such license applies only to those patent claims licensable
|
|
||||||
by such Contributor that are necessarily infringed by their
|
|
||||||
Contribution(s) alone or by combination of their Contribution(s)
|
|
||||||
with the Work to which such Contribution(s) was submitted. If You
|
|
||||||
institute patent litigation against any entity (including a
|
|
||||||
cross-claim or counterclaim in a lawsuit) alleging that the Work
|
|
||||||
or a Contribution incorporated within the Work constitutes direct
|
|
||||||
or contributory patent infringement, then any patent licenses
|
|
||||||
granted to You under this License for that Work shall terminate
|
|
||||||
as of the date such litigation is filed.
|
|
||||||
|
|
||||||
4. Redistribution. You may reproduce and distribute copies of the
|
|
||||||
Work or Derivative Works thereof in any medium, with or without
|
|
||||||
modifications, and in Source or Object form, provided that You
|
|
||||||
meet the following conditions:
|
|
||||||
|
|
||||||
(a) You must give any other recipients of the Work or
|
|
||||||
Derivative Works a copy of this License; and
|
|
||||||
|
|
||||||
(b) You must cause any modified files to carry prominent notices
|
|
||||||
stating that You changed the files; and
|
|
||||||
|
|
||||||
(c) You must retain, in the Source form of any Derivative Works
|
|
||||||
that You distribute, all copyright, patent, trademark, and
|
|
||||||
attribution notices from the Source form of the Work,
|
|
||||||
excluding those notices that do not pertain to any part of
|
|
||||||
the Derivative Works; and
|
|
||||||
|
|
||||||
(d) If the Work includes a "NOTICE" text file as part of its
|
|
||||||
distribution, then any Derivative Works that You distribute must
|
|
||||||
include a readable copy of the attribution notices contained
|
|
||||||
within such NOTICE file, excluding those notices that do not
|
|
||||||
pertain to any part of the Derivative Works, in at least one
|
|
||||||
of the following places: within a NOTICE text file distributed
|
|
||||||
as part of the Derivative Works; within the Source form or
|
|
||||||
documentation, if provided along with the Derivative Works; or,
|
|
||||||
within a display generated by the Derivative Works, if and
|
|
||||||
wherever such third-party notices normally appear. The contents
|
|
||||||
of the NOTICE file are for informational purposes only and
|
|
||||||
do not modify the License. You may add Your own attribution
|
|
||||||
notices within Derivative Works that You distribute, alongside
|
|
||||||
or as an addendum to the NOTICE text from the Work, provided
|
|
||||||
that such additional attribution notices cannot be construed
|
|
||||||
as modifying the License.
|
|
||||||
|
|
||||||
You may add Your own copyright statement to Your modifications and
|
|
||||||
may provide additional or different license terms and conditions
|
|
||||||
for use, reproduction, or distribution of Your modifications, or
|
|
||||||
for any such Derivative Works as a whole, provided Your use,
|
|
||||||
reproduction, and distribution of the Work otherwise complies with
|
|
||||||
the conditions stated in this License.
|
|
||||||
|
|
||||||
5. Submission of Contributions. Unless You explicitly state otherwise,
|
|
||||||
any Contribution intentionally submitted for inclusion in the Work
|
|
||||||
by You to the Licensor shall be under the terms and conditions of
|
|
||||||
this License, without any additional terms or conditions.
|
|
||||||
Notwithstanding the above, nothing herein shall supersede or modify
|
|
||||||
the terms of any separate license agreement you may have executed
|
|
||||||
with Licensor regarding such Contributions.
|
|
||||||
|
|
||||||
6. Trademarks. This License does not grant permission to use the trade
|
|
||||||
names, trademarks, service marks, or product names of the Licensor,
|
|
||||||
except as required for reasonable and customary use in describing the
|
|
||||||
origin of the Work and reproducing the content of the NOTICE file.
|
|
||||||
|
|
||||||
7. Disclaimer of Warranty. Unless required by applicable law or
|
|
||||||
agreed to in writing, Licensor provides the Work (and each
|
|
||||||
Contributor provides its Contributions) on an "AS IS" BASIS,
|
|
||||||
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
|
|
||||||
implied, including, without limitation, any warranties or conditions
|
|
||||||
of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A
|
|
||||||
PARTICULAR PURPOSE. You are solely responsible for determining the
|
|
||||||
appropriateness of using or redistributing the Work and assume any
|
|
||||||
risks associated with Your exercise of permissions under this License.
|
|
||||||
|
|
||||||
8. Limitation of Liability. In no event and under no legal theory,
|
|
||||||
whether in tort (including negligence), contract, or otherwise,
|
|
||||||
unless required by applicable law (such as deliberate and grossly
|
|
||||||
negligent acts) or agreed to in writing, shall any Contributor be
|
|
||||||
liable to You for damages, including any direct, indirect, special,
|
|
||||||
incidental, or consequential damages of any character arising as a
|
|
||||||
result of this License or out of the use or inability to use the
|
|
||||||
Work (including but not limited to damages for loss of goodwill,
|
|
||||||
work stoppage, computer failure or malfunction, or any and all
|
|
||||||
other commercial damages or losses), even if such Contributor
|
|
||||||
has been advised of the possibility of such damages.
|
|
||||||
|
|
||||||
9. Accepting Warranty or Additional Liability. While redistributing
|
|
||||||
the Work or Derivative Works thereof, You may choose to offer,
|
|
||||||
and charge a fee for, acceptance of support, warranty, indemnity,
|
|
||||||
or other liability obligations and/or rights consistent with this
|
|
||||||
License. However, in accepting such obligations, You may act only
|
|
||||||
on Your own behalf and on Your sole responsibility, not on behalf
|
|
||||||
of any other Contributor, and only if You agree to indemnify,
|
|
||||||
defend, and hold each Contributor harmless for any liability
|
|
||||||
incurred by, or claims asserted against, such Contributor by reason
|
|
||||||
of your accepting any such warranty or additional liability.
|
|
||||||
|
|
||||||
END OF TERMS AND CONDITIONS
|
|
||||||
|
|
||||||
APPENDIX: How to apply the Apache License to your work.
|
|
||||||
|
|
||||||
To apply the Apache License to your work, attach the following
|
|
||||||
boilerplate notice, with the fields enclosed by brackets "[]"
|
|
||||||
replaced with your own identifying information. (Don't include
|
|
||||||
the brackets!) The text should be enclosed in the appropriate
|
|
||||||
comment syntax for the file format. We also recommend that a
|
|
||||||
file or class name and description of purpose be included on the
|
|
||||||
same "printed page" as the copyright notice for easier
|
|
||||||
identification within third-party archives.
|
|
||||||
|
|
||||||
Copyright Project Harbor Authors
|
|
||||||
|
|
||||||
Licensed under the Apache License, Version 2.0 (the "License");
|
|
||||||
you may not use this file except in compliance with the License.
|
|
||||||
You may obtain a copy of the License at
|
|
||||||
|
|
||||||
http://www.apache.org/licenses/LICENSE-2.0
|
|
||||||
|
|
||||||
Unless required by applicable law or agreed to in writing, software
|
|
||||||
distributed under the License is distributed on an "AS IS" BASIS,
|
|
||||||
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
|
||||||
See the License for the specific language governing permissions and
|
|
||||||
limitations under the License.
|
|
||||||
138
harbor/common.sh
138
harbor/common.sh
|
|
@ -1,138 +0,0 @@
|
||||||
#!/bin/bash
|
|
||||||
#docker version: 17.06.0+
|
|
||||||
#docker-compose version: 1.18.0+
|
|
||||||
#golang version: 1.12.0+
|
|
||||||
|
|
||||||
set +e
|
|
||||||
set -o noglob
|
|
||||||
|
|
||||||
#
|
|
||||||
# Set Colors
|
|
||||||
#
|
|
||||||
|
|
||||||
bold=$(tput bold)
|
|
||||||
underline=$(tput sgr 0 1)
|
|
||||||
reset=$(tput sgr0)
|
|
||||||
|
|
||||||
red=$(tput setaf 1)
|
|
||||||
green=$(tput setaf 76)
|
|
||||||
white=$(tput setaf 7)
|
|
||||||
tan=$(tput setaf 202)
|
|
||||||
blue=$(tput setaf 25)
|
|
||||||
|
|
||||||
#
|
|
||||||
# Headers and Logging
|
|
||||||
#
|
|
||||||
|
|
||||||
underline() { printf "${underline}${bold}%s${reset}\n" "$@"
|
|
||||||
}
|
|
||||||
h1() { printf "\n${underline}${bold}${blue}%s${reset}\n" "$@"
|
|
||||||
}
|
|
||||||
h2() { printf "\n${underline}${bold}${white}%s${reset}\n" "$@"
|
|
||||||
}
|
|
||||||
debug() { printf "${white}%s${reset}\n" "$@"
|
|
||||||
}
|
|
||||||
info() { printf "${white}➜ %s${reset}\n" "$@"
|
|
||||||
}
|
|
||||||
success() { printf "${green}✔ %s${reset}\n" "$@"
|
|
||||||
}
|
|
||||||
error() { printf "${red}✖ %s${reset}\n" "$@"
|
|
||||||
}
|
|
||||||
warn() { printf "${tan}➜ %s${reset}\n" "$@"
|
|
||||||
}
|
|
||||||
bold() { printf "${bold}%s${reset}\n" "$@"
|
|
||||||
}
|
|
||||||
note() { printf "\n${underline}${bold}${blue}Note:${reset} ${blue}%s${reset}\n" "$@"
|
|
||||||
}
|
|
||||||
|
|
||||||
set -e
|
|
||||||
|
|
||||||
function check_golang {
|
|
||||||
if ! go version &> /dev/null
|
|
||||||
then
|
|
||||||
warn "No golang package in your environment. You should use golang docker image build binary."
|
|
||||||
return
|
|
||||||
fi
|
|
||||||
|
|
||||||
# golang has been installed and check its version
|
|
||||||
if [[ $(go version) =~ (([0-9]+)\.([0-9]+)([\.0-9]*)) ]]
|
|
||||||
then
|
|
||||||
golang_version=${BASH_REMATCH[1]}
|
|
||||||
golang_version_part1=${BASH_REMATCH[2]}
|
|
||||||
golang_version_part2=${BASH_REMATCH[3]}
|
|
||||||
|
|
||||||
# the version of golang does not meet the requirement
|
|
||||||
if [ "$golang_version_part1" -lt 1 ] || ([ "$golang_version_part1" -eq 1 ] && [ "$golang_version_part2" -lt 12 ])
|
|
||||||
then
|
|
||||||
warn "Better to upgrade golang package to 1.12.0+ or use golang docker image build binary."
|
|
||||||
return
|
|
||||||
else
|
|
||||||
note "golang version: $golang_version"
|
|
||||||
fi
|
|
||||||
else
|
|
||||||
warn "Failed to parse golang version."
|
|
||||||
return
|
|
||||||
fi
|
|
||||||
}
|
|
||||||
|
|
||||||
function check_docker {
|
|
||||||
if ! docker --version &> /dev/null
|
|
||||||
then
|
|
||||||
error "Need to install docker(17.06.0+) first and run this script again."
|
|
||||||
exit 1
|
|
||||||
fi
|
|
||||||
|
|
||||||
# docker has been installed and check its version
|
|
||||||
if [[ $(docker --version) =~ (([0-9]+)\.([0-9]+)([\.0-9]*)) ]]
|
|
||||||
then
|
|
||||||
docker_version=${BASH_REMATCH[1]}
|
|
||||||
docker_version_part1=${BASH_REMATCH[2]}
|
|
||||||
docker_version_part2=${BASH_REMATCH[3]}
|
|
||||||
|
|
||||||
note "docker version: $docker_version"
|
|
||||||
# the version of docker does not meet the requirement
|
|
||||||
if [ "$docker_version_part1" -lt 17 ] || ([ "$docker_version_part1" -eq 17 ] && [ "$docker_version_part2" -lt 6 ])
|
|
||||||
then
|
|
||||||
error "Need to upgrade docker package to 17.06.0+."
|
|
||||||
exit 1
|
|
||||||
fi
|
|
||||||
else
|
|
||||||
error "Failed to parse docker version."
|
|
||||||
exit 1
|
|
||||||
fi
|
|
||||||
}
|
|
||||||
|
|
||||||
function check_dockercompose {
|
|
||||||
if [! docker compose version] &> /dev/null || [! docker-compose --version] &> /dev/null
|
|
||||||
then
|
|
||||||
error "Need to install docker-compose(1.18.0+) or a docker-compose-plugin (https://docs.docker.com/compose/)by yourself first and run this script again."
|
|
||||||
exit 1
|
|
||||||
fi
|
|
||||||
|
|
||||||
# either docker compose plugin has been installed
|
|
||||||
if docker compose version &> /dev/null
|
|
||||||
then
|
|
||||||
note "$(docker compose version)"
|
|
||||||
DOCKER_COMPOSE="docker compose"
|
|
||||||
|
|
||||||
# or docker-compose has been installed, check its version
|
|
||||||
elif [[ $(docker-compose --version) =~ (([0-9]+)\.([0-9]+)([\.0-9]*)) ]]
|
|
||||||
then
|
|
||||||
docker_compose_version=${BASH_REMATCH[1]}
|
|
||||||
docker_compose_version_part1=${BASH_REMATCH[2]}
|
|
||||||
docker_compose_version_part2=${BASH_REMATCH[3]}
|
|
||||||
|
|
||||||
note "docker-compose version: $docker_compose_version"
|
|
||||||
# the version of docker-compose does not meet the requirement
|
|
||||||
if [ "$docker_compose_version_part1" -lt 1 ] || ([ "$docker_compose_version_part1" -eq 1 ] && [ "$docker_compose_version_part2" -lt 18 ])
|
|
||||||
then
|
|
||||||
error "Need to upgrade docker-compose package to 1.18.0+."
|
|
||||||
exit 1
|
|
||||||
fi
|
|
||||||
else
|
|
||||||
error "Failed to parse docker-compose version."
|
|
||||||
exit 1
|
|
||||||
fi
|
|
||||||
}
|
|
||||||
|
|
||||||
|
|
||||||
|
|
@ -1,270 +0,0 @@
|
||||||
# Configuration file of Harbor
|
|
||||||
|
|
||||||
# The IP address or hostname to access admin UI and registry service.
|
|
||||||
# DO NOT use localhost or 127.0.0.1, because Harbor needs to be accessed by external clients.
|
|
||||||
hostname: registry.serguzim.me
|
|
||||||
|
|
||||||
# http related config
|
|
||||||
http:
|
|
||||||
# port for http, default is 80. If https enabled, this port will redirect to https port
|
|
||||||
port: 3050
|
|
||||||
|
|
||||||
# https related config
|
|
||||||
https:
|
|
||||||
# # https port for harbor, default is 443
|
|
||||||
port: 3051
|
|
||||||
# # The path of cert and key files for nginx
|
|
||||||
certificate: /opt/services/.lego/certificates/registry.serguzim.me.crt
|
|
||||||
private_key: /opt/services/.lego/certificates/registry.serguzim.me.key
|
|
||||||
|
|
||||||
# # Uncomment following will enable tls communication between all harbor components
|
|
||||||
# internal_tls:
|
|
||||||
# # set enabled to true means internal tls is enabled
|
|
||||||
# enabled: true
|
|
||||||
# # put your cert and key files on dir
|
|
||||||
# dir: /etc/harbor/tls/internal
|
|
||||||
|
|
||||||
# Uncomment external_url if you want to enable external proxy
|
|
||||||
# And when it enabled the hostname will no longer used
|
|
||||||
external_url: https://registry.serguzim.me
|
|
||||||
|
|
||||||
# The initial password of Harbor admin
|
|
||||||
# It only works in first time to install harbor
|
|
||||||
# Remember Change the admin password from UI after launching Harbor.
|
|
||||||
harbor_admin_password: Harbor12345
|
|
||||||
|
|
||||||
# Harbor DB configuration
|
|
||||||
database:
|
|
||||||
# The password for the root user of Harbor DB. Change this before any production use.
|
|
||||||
password: root123
|
|
||||||
# The maximum number of connections in the idle connection pool. If it <=0, no idle connections are retained.
|
|
||||||
max_idle_conns: 100
|
|
||||||
# The maximum number of open connections to the database. If it <= 0, then there is no limit on the number of open connections.
|
|
||||||
# Note: the default number of connections is 1024 for postgres of harbor.
|
|
||||||
max_open_conns: 900
|
|
||||||
# The maximum amount of time a connection may be reused. Expired connections may be closed lazily before reuse. If it <= 0, connections are not closed due to a connection's age.
|
|
||||||
# The value is a duration string. A duration string is a possibly signed sequence of decimal numbers, each with optional fraction and a unit suffix, such as "300ms", "-1.5h" or "2h45m". Valid time units are "ns", "us" (or "µs"), "ms", "s", "m", "h".
|
|
||||||
conn_max_lifetime: 5m
|
|
||||||
# The maximum amount of time a connection may be idle. Expired connections may be closed lazily before reuse. If it <= 0, connections are not closed due to a connection's idle time.
|
|
||||||
# The value is a duration string. A duration string is a possibly signed sequence of decimal numbers, each with optional fraction and a unit suffix, such as "300ms", "-1.5h" or "2h45m". Valid time units are "ns", "us" (or "µs"), "ms", "s", "m", "h".
|
|
||||||
conn_max_idle_time: 0
|
|
||||||
|
|
||||||
# The default data volume
|
|
||||||
data_volume: /opt/services/harbor/data/
|
|
||||||
|
|
||||||
# Harbor Storage settings by default is using /data dir on local filesystem
|
|
||||||
# Uncomment storage_service setting If you want to using external storage
|
|
||||||
storage_service:
|
|
||||||
s3:
|
|
||||||
accesskey: ${HARBOR_S3_ACCESS_KEY}
|
|
||||||
secretkey: ${HARBOR_S3_SECRET_KEY}
|
|
||||||
region: de-contabo-1
|
|
||||||
regionendpoint: https://s3.serguzim.me
|
|
||||||
bucket: registry
|
|
||||||
secure: true
|
|
||||||
redirect:
|
|
||||||
disabled: false
|
|
||||||
|
|
||||||
# Trivy configuration
|
|
||||||
#
|
|
||||||
# Trivy DB contains vulnerability information from NVD, Red Hat, and many other upstream vulnerability databases.
|
|
||||||
# It is downloaded by Trivy from the GitHub release page https://github.com/aquasecurity/trivy-db/releases and cached
|
|
||||||
# in the local file system. In addition, the database contains the update timestamp so Trivy can detect whether it
|
|
||||||
# should download a newer version from the Internet or use the cached one. Currently, the database is updated every
|
|
||||||
# 12 hours and published as a new release to GitHub.
|
|
||||||
trivy:
|
|
||||||
# ignoreUnfixed The flag to display only fixed vulnerabilities
|
|
||||||
ignore_unfixed: false
|
|
||||||
# skipUpdate The flag to enable or disable Trivy DB downloads from GitHub
|
|
||||||
#
|
|
||||||
# You might want to enable this flag in test or CI/CD environments to avoid GitHub rate limiting issues.
|
|
||||||
# If the flag is enabled you have to download the `trivy-offline.tar.gz` archive manually, extract `trivy.db` and
|
|
||||||
# `metadata.json` files and mount them in the `/home/scanner/.cache/trivy/db` path.
|
|
||||||
skip_update: false
|
|
||||||
#
|
|
||||||
# The offline_scan option prevents Trivy from sending API requests to identify dependencies.
|
|
||||||
# Scanning JAR files and pom.xml may require Internet access for better detection, but this option tries to avoid it.
|
|
||||||
# For example, the offline mode will not try to resolve transitive dependencies in pom.xml when the dependency doesn't
|
|
||||||
# exist in the local repositories. It means a number of detected vulnerabilities might be fewer in offline mode.
|
|
||||||
# It would work if all the dependencies are in local.
|
|
||||||
# This option doesn't affect DB download. You need to specify "skip-update" as well as "offline-scan" in an air-gapped environment.
|
|
||||||
offline_scan: false
|
|
||||||
#
|
|
||||||
# Comma-separated list of what security issues to detect. Possible values are `vuln`, `config` and `secret`. Defaults to `vuln`.
|
|
||||||
security_check: vuln
|
|
||||||
#
|
|
||||||
# insecure The flag to skip verifying registry certificate
|
|
||||||
insecure: false
|
|
||||||
# github_token The GitHub access token to download Trivy DB
|
|
||||||
#
|
|
||||||
# Anonymous downloads from GitHub are subject to the limit of 60 requests per hour. Normally such rate limit is enough
|
|
||||||
# for production operations. If, for any reason, it's not enough, you could increase the rate limit to 5000
|
|
||||||
# requests per hour by specifying the GitHub access token. For more details on GitHub rate limiting please consult
|
|
||||||
# https://developer.github.com/v3/#rate-limiting
|
|
||||||
#
|
|
||||||
# You can create a GitHub token by following the instructions in
|
|
||||||
# https://help.github.com/en/github/authenticating-to-github/creating-a-personal-access-token-for-the-command-line
|
|
||||||
#
|
|
||||||
# github_token: xxx
|
|
||||||
|
|
||||||
jobservice:
|
|
||||||
# Maximum number of job workers in job service
|
|
||||||
max_job_workers: 10
|
|
||||||
# The jobLogger sweeper duration (ignored if `jobLogger` is `stdout`)
|
|
||||||
logger_sweeper_duration: 1 #days
|
|
||||||
|
|
||||||
notification:
|
|
||||||
# Maximum retry count for webhook job
|
|
||||||
webhook_job_max_retry: 3
|
|
||||||
# HTTP client timeout for webhook job
|
|
||||||
webhook_job_http_client_timeout: 3 #seconds
|
|
||||||
|
|
||||||
# Log configurations
|
|
||||||
log:
|
|
||||||
# options are debug, info, warning, error, fatal
|
|
||||||
level: info
|
|
||||||
# configs for logs in local storage
|
|
||||||
local:
|
|
||||||
# Log files are rotated log_rotate_count times before being removed. If count is 0, old versions are removed rather than rotated.
|
|
||||||
rotate_count: 50
|
|
||||||
# Log files are rotated only if they grow bigger than log_rotate_size bytes. If size is followed by k, the size is assumed to be in kilobytes.
|
|
||||||
# If the M is used, the size is in megabytes, and if G is used, the size is in gigabytes. So size 100, size 100k, size 100M and size 100G
|
|
||||||
# are all valid.
|
|
||||||
rotate_size: 200M
|
|
||||||
# The directory on your host that store log
|
|
||||||
location: /var/log/harbor
|
|
||||||
|
|
||||||
# Uncomment following lines to enable external syslog endpoint.
|
|
||||||
# external_endpoint:
|
|
||||||
# # protocol used to transmit log to external endpoint, options is tcp or udp
|
|
||||||
# protocol: tcp
|
|
||||||
# # The host of external endpoint
|
|
||||||
# host: localhost
|
|
||||||
# # Port of external endpoint
|
|
||||||
# port: 5140
|
|
||||||
|
|
||||||
#This attribute is for migrator to detect the version of the .cfg file, DO NOT MODIFY!
|
|
||||||
_version: 2.8.0
|
|
||||||
|
|
||||||
# Uncomment external_database if using external database.
|
|
||||||
external_database:
|
|
||||||
harbor:
|
|
||||||
host: db.serguzim.me
|
|
||||||
port: 5432
|
|
||||||
db_name: harbor
|
|
||||||
username: harbor
|
|
||||||
password: ${HARBOR_DATABASE_PASSWORD}
|
|
||||||
ssl_mode: verify-full
|
|
||||||
max_idle_conns: 2
|
|
||||||
max_open_conns: 0
|
|
||||||
# notary_signer:
|
|
||||||
# host: notary_signer_db_host
|
|
||||||
# port: notary_signer_db_port
|
|
||||||
# db_name: notary_signer_db_name
|
|
||||||
# username: notary_signer_db_username
|
|
||||||
# password: notary_signer_db_password
|
|
||||||
# ssl_mode: disable
|
|
||||||
# notary_server:
|
|
||||||
# host: notary_server_db_host
|
|
||||||
# port: notary_server_db_port
|
|
||||||
# db_name: notary_server_db_name
|
|
||||||
# username: notary_server_db_username
|
|
||||||
# password: notary_server_db_password
|
|
||||||
# ssl_mode: disable
|
|
||||||
|
|
||||||
# Uncomment external_redis if using external Redis server
|
|
||||||
# external_redis:
|
|
||||||
# # support redis, redis+sentinel
|
|
||||||
# # host for redis: <host_redis>:<port_redis>
|
|
||||||
# # host for redis+sentinel:
|
|
||||||
# # <host_sentinel1>:<port_sentinel1>,<host_sentinel2>:<port_sentinel2>,<host_sentinel3>:<port_sentinel3>
|
|
||||||
# host: redis:6379
|
|
||||||
# password:
|
|
||||||
# # Redis AUTH command was extended in Redis 6, it is possible to use it in the two-arguments AUTH <username> <password> form.
|
|
||||||
# # username:
|
|
||||||
# # sentinel_master_set must be set to support redis+sentinel
|
|
||||||
# #sentinel_master_set:
|
|
||||||
# # db_index 0 is for core, it's unchangeable
|
|
||||||
# registry_db_index: 1
|
|
||||||
# jobservice_db_index: 2
|
|
||||||
# trivy_db_index: 5
|
|
||||||
# idle_timeout_seconds: 30
|
|
||||||
|
|
||||||
# Uncomment uaa for trusting the certificate of uaa instance that is hosted via self-signed cert.
|
|
||||||
# uaa:
|
|
||||||
# ca_file: /path/to/ca
|
|
||||||
|
|
||||||
# Global proxy
|
|
||||||
# Config http proxy for components, e.g. http://my.proxy.com:3128
|
|
||||||
# Components doesn't need to connect to each others via http proxy.
|
|
||||||
# Remove component from `components` array if want disable proxy
|
|
||||||
# for it. If you want use proxy for replication, MUST enable proxy
|
|
||||||
# for core and jobservice, and set `http_proxy` and `https_proxy`.
|
|
||||||
# Add domain to the `no_proxy` field, when you want disable proxy
|
|
||||||
# for some special registry.
|
|
||||||
proxy:
|
|
||||||
http_proxy:
|
|
||||||
https_proxy:
|
|
||||||
no_proxy:
|
|
||||||
components:
|
|
||||||
- core
|
|
||||||
- jobservice
|
|
||||||
- trivy
|
|
||||||
|
|
||||||
metric:
|
|
||||||
enabled: enabled
|
|
||||||
port: 3059
|
|
||||||
path: /metrics
|
|
||||||
|
|
||||||
# Trace related config
|
|
||||||
# only can enable one trace provider(jaeger or otel) at the same time,
|
|
||||||
# and when using jaeger as provider, can only enable it with agent mode or collector mode.
|
|
||||||
# if using jaeger collector mode, uncomment endpoint and uncomment username, password if needed
|
|
||||||
# if using jaeger agetn mode uncomment agent_host and agent_port
|
|
||||||
# trace:
|
|
||||||
# enabled: true
|
|
||||||
# # set sample_rate to 1 if you wanna sampling 100% of trace data; set 0.5 if you wanna sampling 50% of trace data, and so forth
|
|
||||||
# sample_rate: 1
|
|
||||||
# # # namespace used to differenciate different harbor services
|
|
||||||
# # namespace:
|
|
||||||
# # # attributes is a key value dict contains user defined attributes used to initialize trace provider
|
|
||||||
# # attributes:
|
|
||||||
# # application: harbor
|
|
||||||
# # # jaeger should be 1.26 or newer.
|
|
||||||
# # jaeger:
|
|
||||||
# # endpoint: http://hostname:14268/api/traces
|
|
||||||
# # username:
|
|
||||||
# # password:
|
|
||||||
# # agent_host: hostname
|
|
||||||
# # # export trace data by jaeger.thrift in compact mode
|
|
||||||
# # agent_port: 6831
|
|
||||||
# # otel:
|
|
||||||
# # endpoint: hostname:4318
|
|
||||||
# # url_path: /v1/traces
|
|
||||||
# # compression: false
|
|
||||||
# # insecure: true
|
|
||||||
# # timeout: 10s
|
|
||||||
|
|
||||||
# Enable purge _upload directories
|
|
||||||
upload_purging:
|
|
||||||
enabled: true
|
|
||||||
# remove files in _upload directories which exist for a period of time, default is one week.
|
|
||||||
age: 168h
|
|
||||||
# the interval of the purge operations
|
|
||||||
interval: 24h
|
|
||||||
dryrun: false
|
|
||||||
|
|
||||||
# Cache layer configurations
|
|
||||||
# If this feature enabled, harbor will cache the resource
|
|
||||||
# `project/project_metadata/repository/artifact/manifest` in the redis
|
|
||||||
# which can especially help to improve the performance of high concurrent
|
|
||||||
# manifest pulling.
|
|
||||||
# NOTICE
|
|
||||||
# If you are deploying Harbor in HA mode, make sure that all the harbor
|
|
||||||
# instances have the same behaviour, all with caching enabled or disabled,
|
|
||||||
# otherwise it can lead to potential data inconsistency.
|
|
||||||
cache:
|
|
||||||
# not enabled by default
|
|
||||||
enabled: false
|
|
||||||
# keep cache for one day by default
|
|
||||||
expire_hours: 24
|
|
||||||
|
|
@ -1,80 +0,0 @@
|
||||||
#!/bin/bash
|
|
||||||
|
|
||||||
set -e
|
|
||||||
|
|
||||||
DIR="$(cd "$(dirname "$0")" && pwd)"
|
|
||||||
source $DIR/common.sh
|
|
||||||
|
|
||||||
set +o noglob
|
|
||||||
|
|
||||||
usage=$'Please set hostname and other necessary attributes in harbor.yml first. DO NOT use localhost or 127.0.0.1 for hostname, because Harbor needs to be accessed by external clients.
|
|
||||||
Please set --with-trivy if needs enable Trivy in Harbor.
|
|
||||||
Please do NOT set --with-chartmuseum, as chartmusuem has been deprecated and removed.
|
|
||||||
Please do NOT set --with-notary, as notary has been deprecated and removed.'
|
|
||||||
item=0
|
|
||||||
|
|
||||||
# clair is deprecated
|
|
||||||
with_clair=$false
|
|
||||||
# trivy is not enabled by default
|
|
||||||
with_trivy=$false
|
|
||||||
|
|
||||||
# flag to using docker compose v1 or v2, default would using v1 docker-compose
|
|
||||||
DOCKER_COMPOSE=docker-compose
|
|
||||||
|
|
||||||
while [ $# -gt 0 ]; do
|
|
||||||
case $1 in
|
|
||||||
--help)
|
|
||||||
note "$usage"
|
|
||||||
exit 0;;
|
|
||||||
--with-trivy)
|
|
||||||
with_trivy=true;;
|
|
||||||
*)
|
|
||||||
note "$usage"
|
|
||||||
exit 1;;
|
|
||||||
esac
|
|
||||||
shift || true
|
|
||||||
done
|
|
||||||
|
|
||||||
workdir="$( cd "$( dirname "${BASH_SOURCE[0]}" )" && pwd )"
|
|
||||||
cd $workdir
|
|
||||||
|
|
||||||
h2 "[Step $item]: checking if docker is installed ..."; let item+=1
|
|
||||||
check_docker
|
|
||||||
|
|
||||||
h2 "[Step $item]: checking docker-compose is installed ..."; let item+=1
|
|
||||||
check_dockercompose
|
|
||||||
|
|
||||||
if [ -f harbor*.tar.gz ]
|
|
||||||
then
|
|
||||||
h2 "[Step $item]: loading Harbor images ..."; let item+=1
|
|
||||||
docker load -i ./harbor*.tar.gz
|
|
||||||
fi
|
|
||||||
echo ""
|
|
||||||
|
|
||||||
h2 "[Step $item]: preparing environment ..."; let item+=1
|
|
||||||
if [ -n "$host" ]
|
|
||||||
then
|
|
||||||
sed "s/^hostname: .*/hostname: $host/g" -i ./harbor.yml
|
|
||||||
fi
|
|
||||||
|
|
||||||
h2 "[Step $item]: preparing harbor configs ..."; let item+=1
|
|
||||||
prepare_para=
|
|
||||||
if [ $with_trivy ]
|
|
||||||
then
|
|
||||||
prepare_para="${prepare_para} --with-trivy"
|
|
||||||
fi
|
|
||||||
|
|
||||||
./prepare $prepare_para
|
|
||||||
echo ""
|
|
||||||
|
|
||||||
if [ -n "$DOCKER_COMPOSE ps -q" ]
|
|
||||||
then
|
|
||||||
note "stopping existing Harbor instance ..."
|
|
||||||
$DOCKER_COMPOSE down -v
|
|
||||||
fi
|
|
||||||
echo ""
|
|
||||||
|
|
||||||
h2 "[Step $item]: starting Harbor ..."
|
|
||||||
$DOCKER_COMPOSE up -d
|
|
||||||
|
|
||||||
success $"----Harbor has been installed and started successfully.----"
|
|
||||||
|
|
@ -1,64 +0,0 @@
|
||||||
#!/bin/bash
|
|
||||||
set -e
|
|
||||||
|
|
||||||
# If compiling source code this dir is harbor's make dir.
|
|
||||||
# If installing harbor via package, this dir is harbor's root dir.
|
|
||||||
if [[ -n "$HARBOR_BUNDLE_DIR" ]]; then
|
|
||||||
harbor_prepare_path=$HARBOR_BUNDLE_DIR
|
|
||||||
else
|
|
||||||
harbor_prepare_path="$( cd "$(dirname "$0")" ; pwd -P )"
|
|
||||||
fi
|
|
||||||
echo "prepare base dir is set to ${harbor_prepare_path}"
|
|
||||||
|
|
||||||
# Clean up input dir
|
|
||||||
rm -rf ${harbor_prepare_path}/input
|
|
||||||
# Create a input dirs
|
|
||||||
mkdir -p ${harbor_prepare_path}/input
|
|
||||||
input_dir=${harbor_prepare_path}/input
|
|
||||||
|
|
||||||
# Copy harbor.yml to input dir
|
|
||||||
if [[ ! "$1" =~ ^\-\- ]] && [ -f "$1" ]
|
|
||||||
then
|
|
||||||
cp $1 $input_dir/harbor.yml
|
|
||||||
shift
|
|
||||||
else
|
|
||||||
if [ -f "${harbor_prepare_path}/harbor.yml" ];then
|
|
||||||
cp ${harbor_prepare_path}/harbor.yml $input_dir/harbor.yml
|
|
||||||
else
|
|
||||||
echo "no config file: ${harbor_prepare_path}/harbor.yml"
|
|
||||||
exit 1
|
|
||||||
fi
|
|
||||||
fi
|
|
||||||
|
|
||||||
data_path=$(grep '^[^#]*data_volume:' $input_dir/harbor.yml | awk '{print $NF}')
|
|
||||||
|
|
||||||
# If previous secretkeys exist, move it to new location
|
|
||||||
previous_secretkey_path=/data/secretkey
|
|
||||||
previous_defaultalias_path=/data/defaultalias
|
|
||||||
|
|
||||||
if [ -f $previous_secretkey_path ]; then
|
|
||||||
mkdir -p $data_path/secret/keys
|
|
||||||
mv $previous_secretkey_path $data_path/secret/keys
|
|
||||||
fi
|
|
||||||
if [ -f $previous_defaultalias_path ]; then
|
|
||||||
mkdir -p $data_path/secret/keys
|
|
||||||
mv $previous_defaultalias_path $data_path/secret/keys
|
|
||||||
fi
|
|
||||||
|
|
||||||
|
|
||||||
# Create secret dir
|
|
||||||
secret_dir=${data_path}/secret
|
|
||||||
config_dir=$harbor_prepare_path/common/config
|
|
||||||
|
|
||||||
# Run prepare script
|
|
||||||
docker run --rm -v $input_dir:/input \
|
|
||||||
-v $data_path:/data \
|
|
||||||
-v $harbor_prepare_path:/compose_location \
|
|
||||||
-v $config_dir:/config \
|
|
||||||
-v /:/hostfs \
|
|
||||||
--privileged \
|
|
||||||
goharbor/prepare:v2.9.0 prepare $@
|
|
||||||
|
|
||||||
echo "Clean up the input dir"
|
|
||||||
# Clean up input dir
|
|
||||||
rm -rf ${harbor_prepare_path}/input
|
|
||||||
Loading…
Reference in a new issue