Add harbor to ansible

.gitignore

@@ -9,6 +9,7 @@
 /forgejo-runner/
 /gitea/
 /gitea-runner/
+/harbor/
 /healthcheck/
 /homebox/
 /influxdb/
@@ -35,6 +36,7 @@
 /caddy/config/conf.002.d/matrix.msrg.cc.conf
 /caddy/config/conf.002.d/media.serguzim.me.conf
 /caddy/config/conf.002.d/recipes.serguzim.me.conf
+/caddy/config/conf.002.d/registry.serguzim.me.conf
 /caddy/config/conf.002.d/rss.serguzim.me.conf
 /caddy/config/conf.002.d/status.serguzim.me.conf
 /caddy/config/conf.002.d/tick.serguzim.me.conf

_ansible/node002.yml

@@ -7,6 +7,7 @@
     - faas
     - forgejo
     - forgejo-runner
+    - harbor
     - healthcheck
     - homebox
     - influxdb

_ansible/roles/harbor/files/msrg.cc.log.config

@@ -0,0 +1,22 @@
+version: 1
+
+formatters:
+  precise:
+   format: '%(asctime)s - %(name)s - %(lineno)d - %(levelname)s - %(request)s - %(message)s'
+
+handlers:
+  console:
+    class: logging.StreamHandler
+    formatter: precise
+
+loggers:
+    synapse.storage.SQL:
+        # beware: increasing this to DEBUG will make synapse log sensitive
+        # information such as access tokens.
+        level: INFO
+
+root:
+    level: INFO
+    handlers: [console]
+
+disable_existing_loggers: false

_ansible/roles/harbor/tasks/main.yml

@@ -0,0 +1,35 @@
+---
+- name: Deploy {{ svc.name }}
+  tags:
+    - harbor
+    - registry
+  block:
+    - import_tasks: steps/create-service-directory.yml
+    - import_tasks: steps/template-site-config.yml
+
+    - name: Template config
+      ansible.builtin.template:
+        src: service.yml.j2
+        dest: "{{ (service_path, 'harbor.yml') | path_join }}"
+        mode: "0644"
+
+    - name: Download harbor
+      ansible.builtin.unarchive:
+        src: https://github.com/goharbor/harbor/releases/download/v{{ svc.harbor_version }}/harbor-online-installer-v{{ svc.harbor_version }}.tgz
+        dest: "{{ service_path }}"
+        remote_src: yes
+
+    - name: Run the harbor prepare command
+      ansible.builtin.command:
+        cmd: "{{ service_path }}/harbor/prepare"
+        chdir: "{{ service_path }}"
+      environment:
+        HARBOR_BUNDLE_DIR: "{{ service_path }}"
+
+    - name: Run the harbor install command
+      ansible.builtin.command:
+        cmd: "{{ service_path }}/harbor/install.sh"
+        chdir: "{{ service_path }}"
+      environment:
+        HARBOR_BUNDLE_DIR: "{{ service_path }}"
+      become: true

_ansible/roles/harbor/vars/main.yml

@@ -0,0 +1,96 @@
+svc_ports:
+  http: 20080
+  https: 20443
+  metrics: 29000
+
+svc:
+  name: harbor
+  domain: "registry.serguzim.me"
+  caddy_extra: |
+    reverse_proxy /metrics host.docker.internal:{{ svc_ports.metrics }}
+    reverse_proxy host.docker.internal:{{ svc_ports.https }} {
+        transport http {
+            tls
+            tls_server_name registry.serguzim.me
+        }
+    }
+  caddy_default: false
+  db:
+    host: "{{ postgres.host }}"
+    port: "{{ postgres.port }}"
+    database: harbor
+    user: "{{ vault_harbor.db.user }}"
+    pass: "{{ vault_harbor.db.pass }}"
+  harbor_version: 2.9.0
+
+svc_yml:
+  hostname: "{{ svc.domain }}"
+  http:
+    port: "{{ svc_ports.http }}"
+  https:
+    port: "{{ svc_ports.https }}"
+    certificate: /opt/services/.lego/certificates/registry.serguzim.me.crt
+    private_key: /opt/services/.lego/certificates/registry.serguzim.me.key
+  external_url: https://registry.serguzim.me
+  harbor_admin_password: "{{ vault_harbor.admin_password }}"
+  data_volume: "{{ (service_path, 'data') | path_join }}"
+  storage_service:
+    s3:
+      accesskey: "{{ vault_harbor.minio.accesskey }}"
+      secretkey: "{{ vault_harbor.minio.secretkey }}"
+      region: de-contabo-1
+      regionendpoint: https://s3.serguzim.me
+      bucket: registry
+      secure: true
+  trivy:
+    ignore_unfixed: false
+    skip_update: false
+    offline_scan: false
+    security_check: vuln
+    insecure: false
+  jobservice:
+    max_job_workers: 10
+    job_loggers:
+      - STD_OUTPUT
+      - FILE
+    logger_sweeper_duration: 1
+  notification:
+    webhook_job_max_retry: 3
+    webhook_job_http_client_timeout: 3
+  log:
+    level: info
+    local:
+      rotate_count: 50
+      rotate_size: 200M
+      location: /var/log/harbor
+  _version: "{{ svc.harbor_version }}"
+  external_database:
+    harbor:
+      host: "{{ svc.db.host }}"
+      port: "{{ svc.db.port }}"
+      db_name: "{{ svc.db.database }}"
+      username: "{{ svc.db.user }}"
+      password: "{{ svc.db.pass }}"
+      ssl_mode: verify-full
+      max_idle_conns: 2
+      max_open_conns: 0
+  proxy:
+    http_proxy: null
+    https_proxy: null
+    no_proxy: null
+    components:
+      - core
+      - jobservice
+      - trivy
+  metric:
+    enabled: enabled
+    port: "{{ svc_ports.metrics }}"
+    path: /metrics
+  upload_purging:
+    enabled: true
+    age: 168h
+    interval: 24h
+    dryrun: false
+  cache:
+    enabled: false
+    expire_hours: 24

_ansible/templates/caddy_site.conf.j2

@@ -14,6 +14,7 @@
 
 {{ svc.caddy_extra | indent(width='\t', first=True) if svc.caddy_extra|default(false) }}
 
+{% if svc.caddy_default|default(true) %}
 	handle {
 {% if svc.faas_function|default(false) %}
 		import faas {{ svc.faas_function }}
@@ -21,6 +22,7 @@
 		reverse_proxy {{ svc.docker_host|default(svc.name) }}:{{ svc.port }}
 {% endif %}
 	}
+{% endif %}
 }
 
 {% if svc.www_domain|default(false) %}

caddy/config/conf.002.d/registry.serguzim.me.conf

@@ -1,12 +0,0 @@
-registry.serguzim.me {
-	import default
-	reverse_proxy /metrics host.docker.internal:3059
-	reverse_proxy host.docker.internal:3051 {
-		transport http {
-			tls
-			tls_server_name registry.serguzim.me
-		}
-	}
-	#reverse_proxy /metrics https://registry.serguzim.me:3059
-	#reverse_proxy https://registry.serguzim.me:3051
-}

harbor/.gitignore

@@ -1,4 +0,0 @@
-common/
-data/
-docker-compose.yml
-harbor.yml

harbor/LICENSE

@@ -1,201 +0,0 @@
-                                 Apache License
-                           Version 2.0, January 2004
-                        http://www.apache.org/licenses/
-
-   TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION
-
-   1. Definitions.
-
-      "License" shall mean the terms and conditions for use, reproduction,
-      and distribution as defined by Sections 1 through 9 of this document.
-
-      "Licensor" shall mean the copyright owner or entity authorized by
-      the copyright owner that is granting the License.
-
-      "Legal Entity" shall mean the union of the acting entity and all
-      other entities that control, are controlled by, or are under common
-      control with that entity. For the purposes of this definition,
-      "control" means (i) the power, direct or indirect, to cause the
-      direction or management of such entity, whether by contract or
-      otherwise, or (ii) ownership of fifty percent (50%) or more of the
-      outstanding shares, or (iii) beneficial ownership of such entity.
-
-      "You" (or "Your") shall mean an individual or Legal Entity
-      exercising permissions granted by this License.
-
-      "Source" form shall mean the preferred form for making modifications,
-      including but not limited to software source code, documentation
-      source, and configuration files.
-
-      "Object" form shall mean any form resulting from mechanical
-      transformation or translation of a Source form, including but
-      not limited to compiled object code, generated documentation,
-      and conversions to other media types.
-
-      "Work" shall mean the work of authorship, whether in Source or
-      Object form, made available under the License, as indicated by a
-      copyright notice that is included in or attached to the work
-      (an example is provided in the Appendix below).
-
-      "Derivative Works" shall mean any work, whether in Source or Object
-      form, that is based on (or derived from) the Work and for which the
-      editorial revisions, annotations, elaborations, or other modifications
-      represent, as a whole, an original work of authorship. For the purposes
-      of this License, Derivative Works shall not include works that remain
-      separable from, or merely link (or bind by name) to the interfaces of,
-      the Work and Derivative Works thereof.
-
-      "Contribution" shall mean any work of authorship, including
-      the original version of the Work and any modifications or additions
-      to that Work or Derivative Works thereof, that is intentionally
-      submitted to Licensor for inclusion in the Work by the copyright owner
-      or by an individual or Legal Entity authorized to submit on behalf of
-      the copyright owner. For the purposes of this definition, "submitted"
-      means any form of electronic, verbal, or written communication sent
-      to the Licensor or its representatives, including but not limited to
-      communication on electronic mailing lists, source code control systems,
-      and issue tracking systems that are managed by, or on behalf of, the
-      Licensor for the purpose of discussing and improving the Work, but
-      excluding communication that is conspicuously marked or otherwise
-      designated in writing by the copyright owner as "Not a Contribution."
-
-      "Contributor" shall mean Licensor and any individual or Legal Entity
-      on behalf of whom a Contribution has been received by Licensor and
-      subsequently incorporated within the Work.
-
-   2. Grant of Copyright License. Subject to the terms and conditions of
-      this License, each Contributor hereby grants to You a perpetual,
-      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
-      copyright license to reproduce, prepare Derivative Works of,
-      publicly display, publicly perform, sublicense, and distribute the
-      Work and such Derivative Works in Source or Object form.
-
-   3. Grant of Patent License. Subject to the terms and conditions of
-      this License, each Contributor hereby grants to You a perpetual,
-      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
-      (except as stated in this section) patent license to make, have made,
-      use, offer to sell, sell, import, and otherwise transfer the Work,
-      where such license applies only to those patent claims licensable
-      by such Contributor that are necessarily infringed by their
-      Contribution(s) alone or by combination of their Contribution(s)
-      with the Work to which such Contribution(s) was submitted. If You
-      institute patent litigation against any entity (including a
-      cross-claim or counterclaim in a lawsuit) alleging that the Work
-      or a Contribution incorporated within the Work constitutes direct
-      or contributory patent infringement, then any patent licenses
-      granted to You under this License for that Work shall terminate
-      as of the date such litigation is filed.
-
-   4. Redistribution. You may reproduce and distribute copies of the
-      Work or Derivative Works thereof in any medium, with or without
-      modifications, and in Source or Object form, provided that You
-      meet the following conditions:
-
-      (a) You must give any other recipients of the Work or
-          Derivative Works a copy of this License; and
-
-      (b) You must cause any modified files to carry prominent notices
-          stating that You changed the files; and
-
-      (c) You must retain, in the Source form of any Derivative Works
-          that You distribute, all copyright, patent, trademark, and
-          attribution notices from the Source form of the Work,
-          excluding those notices that do not pertain to any part of
-          the Derivative Works; and
-
-      (d) If the Work includes a "NOTICE" text file as part of its
-          distribution, then any Derivative Works that You distribute must
-          include a readable copy of the attribution notices contained
-          within such NOTICE file, excluding those notices that do not
-          pertain to any part of the Derivative Works, in at least one
-          of the following places: within a NOTICE text file distributed
-          as part of the Derivative Works; within the Source form or
-          documentation, if provided along with the Derivative Works; or,
-          within a display generated by the Derivative Works, if and
-          wherever such third-party notices normally appear. The contents
-          of the NOTICE file are for informational purposes only and
-          do not modify the License. You may add Your own attribution
-          notices within Derivative Works that You distribute, alongside
-          or as an addendum to the NOTICE text from the Work, provided
-          that such additional attribution notices cannot be construed
-          as modifying the License.
-
-      You may add Your own copyright statement to Your modifications and
-      may provide additional or different license terms and conditions
-      for use, reproduction, or distribution of Your modifications, or
-      for any such Derivative Works as a whole, provided Your use,
-      reproduction, and distribution of the Work otherwise complies with
-      the conditions stated in this License.
-
-   5. Submission of Contributions. Unless You explicitly state otherwise,
-      any Contribution intentionally submitted for inclusion in the Work
-      by You to the Licensor shall be under the terms and conditions of
-      this License, without any additional terms or conditions.
-      Notwithstanding the above, nothing herein shall supersede or modify
-      the terms of any separate license agreement you may have executed
-      with Licensor regarding such Contributions.
-
-   6. Trademarks. This License does not grant permission to use the trade
-      names, trademarks, service marks, or product names of the Licensor,
-      except as required for reasonable and customary use in describing the
-      origin of the Work and reproducing the content of the NOTICE file.
-
-   7. Disclaimer of Warranty. Unless required by applicable law or
-      agreed to in writing, Licensor provides the Work (and each
-      Contributor provides its Contributions) on an "AS IS" BASIS,
-      WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
-      implied, including, without limitation, any warranties or conditions
-      of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A
-      PARTICULAR PURPOSE. You are solely responsible for determining the
-      appropriateness of using or redistributing the Work and assume any
-      risks associated with Your exercise of permissions under this License.
-
-   8. Limitation of Liability. In no event and under no legal theory,
-      whether in tort (including negligence), contract, or otherwise,
-      unless required by applicable law (such as deliberate and grossly
-      negligent acts) or agreed to in writing, shall any Contributor be
-      liable to You for damages, including any direct, indirect, special,
-      incidental, or consequential damages of any character arising as a
-      result of this License or out of the use or inability to use the
-      Work (including but not limited to damages for loss of goodwill,
-      work stoppage, computer failure or malfunction, or any and all
-      other commercial damages or losses), even if such Contributor
-      has been advised of the possibility of such damages.
-
-   9. Accepting Warranty or Additional Liability. While redistributing
-      the Work or Derivative Works thereof, You may choose to offer,
-      and charge a fee for, acceptance of support, warranty, indemnity,
-      or other liability obligations and/or rights consistent with this
-      License. However, in accepting such obligations, You may act only
-      on Your own behalf and on Your sole responsibility, not on behalf
-      of any other Contributor, and only if You agree to indemnify,
-      defend, and hold each Contributor harmless for any liability
-      incurred by, or claims asserted against, such Contributor by reason
-      of your accepting any such warranty or additional liability.
-
-   END OF TERMS AND CONDITIONS
-
-   APPENDIX: How to apply the Apache License to your work.
-
-      To apply the Apache License to your work, attach the following
-      boilerplate notice, with the fields enclosed by brackets "[]"
-      replaced with your own identifying information. (Don't include
-      the brackets!)  The text should be enclosed in the appropriate
-      comment syntax for the file format. We also recommend that a
-      file or class name and description of purpose be included on the
-      same "printed page" as the copyright notice for easier
-      identification within third-party archives.
-
-   Copyright Project Harbor Authors
-
-   Licensed under the Apache License, Version 2.0 (the "License");
-   you may not use this file except in compliance with the License.
-   You may obtain a copy of the License at
-
-       http://www.apache.org/licenses/LICENSE-2.0
-
-   Unless required by applicable law or agreed to in writing, software
-   distributed under the License is distributed on an "AS IS" BASIS,
-   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-   See the License for the specific language governing permissions and
-   limitations under the License.

harbor/common.sh

@@ -1,138 +0,0 @@
-#!/bin/bash
-#docker version: 17.06.0+
-#docker-compose version: 1.18.0+
-#golang version: 1.12.0+
-
-set +e
-set -o noglob
-
-#
-# Set Colors
-#
-
-bold=$(tput bold)
-underline=$(tput sgr 0 1)
-reset=$(tput sgr0)
-
-red=$(tput setaf 1)
-green=$(tput setaf 76)
-white=$(tput setaf 7)
-tan=$(tput setaf 202)
-blue=$(tput setaf 25)
-
-#
-# Headers and Logging
-#
-
-underline() { printf "${underline}${bold}%s${reset}\n" "$@"
-}
-h1() { printf "\n${underline}${bold}${blue}%s${reset}\n" "$@"
-}
-h2() { printf "\n${underline}${bold}${white}%s${reset}\n" "$@"
-}
-debug() { printf "${white}%s${reset}\n" "$@"
-}
-info() { printf "${white}➜ %s${reset}\n" "$@"
-}
-success() { printf "${green}✔ %s${reset}\n" "$@"
-}
-error() { printf "${red}✖ %s${reset}\n" "$@"
-}
-warn() { printf "${tan}➜ %s${reset}\n" "$@"
-}
-bold() { printf "${bold}%s${reset}\n" "$@"
-}
-note() { printf "\n${underline}${bold}${blue}Note:${reset} ${blue}%s${reset}\n" "$@"
-}
-
-set -e
-
-function check_golang {
-	if ! go version &> /dev/null
-	then
-		warn "No golang package in your environment. You should use golang docker image build binary."
-		return
-	fi
-
-	# golang has been installed and check its version
-	if [[ $(go version) =~ (([0-9]+)\.([0-9]+)([\.0-9]*)) ]]
-	then
-		golang_version=${BASH_REMATCH[1]}
-		golang_version_part1=${BASH_REMATCH[2]}
-		golang_version_part2=${BASH_REMATCH[3]}
-
-		# the version of golang does not meet the requirement
-		if [ "$golang_version_part1" -lt 1 ] || ([ "$golang_version_part1" -eq 1 ] && [ "$golang_version_part2" -lt 12 ])
-		then
-			warn "Better to upgrade golang package to 1.12.0+ or use golang docker image build binary."
-			return
-		else
-			note "golang version: $golang_version"
-		fi
-	else
-		warn "Failed to parse golang version."
-		return
-	fi
-}
-
-function check_docker {
-	if ! docker --version &> /dev/null
-	then
-		error "Need to install docker(17.06.0+) first and run this script again."
-		exit 1
-	fi
-
-	# docker has been installed and check its version
-	if [[ $(docker --version) =~ (([0-9]+)\.([0-9]+)([\.0-9]*)) ]]
-	then
-		docker_version=${BASH_REMATCH[1]}
-		docker_version_part1=${BASH_REMATCH[2]}
-		docker_version_part2=${BASH_REMATCH[3]}
-
-		note "docker version: $docker_version"
-		# the version of docker does not meet the requirement
-		if [ "$docker_version_part1" -lt 17 ] || ([ "$docker_version_part1" -eq 17 ] && [ "$docker_version_part2" -lt 6 ])
-		then
-			error "Need to upgrade docker package to 17.06.0+."
-			exit 1
-		fi
-	else
-		error "Failed to parse docker version."
-		exit 1
-	fi
-}
-
-function check_dockercompose {
-	if [! docker compose version] &> /dev/null || [! docker-compose --version] &> /dev/null
-	then
-		error "Need to install docker-compose(1.18.0+) or a docker-compose-plugin (https://docs.docker.com/compose/)by yourself first and run this script again."
-		exit 1
-	fi
-
-	# either docker compose plugin has been installed
-	if docker compose version &> /dev/null
-	then
-		note "$(docker compose version)"
-		DOCKER_COMPOSE="docker compose"
-
-	# or docker-compose has been installed, check its version
-	elif [[ $(docker-compose --version) =~ (([0-9]+)\.([0-9]+)([\.0-9]*)) ]]
-	then
-		docker_compose_version=${BASH_REMATCH[1]}
-		docker_compose_version_part1=${BASH_REMATCH[2]}
-		docker_compose_version_part2=${BASH_REMATCH[3]}
-
-		note "docker-compose version: $docker_compose_version"
-		# the version of docker-compose does not meet the requirement
-		if [ "$docker_compose_version_part1" -lt 1 ] || ([ "$docker_compose_version_part1" -eq 1 ] && [ "$docker_compose_version_part2" -lt 18 ])
-		then
-			error "Need to upgrade docker-compose package to 1.18.0+."
-			exit 1
-		fi
-	else
-		error "Failed to parse docker-compose version."
-		exit 1
-	fi
-}
-
-

harbor/harbor.template.yml

@@ -1,270 +0,0 @@
-# Configuration file of Harbor
-
-# The IP address or hostname to access admin UI and registry service.
-# DO NOT use localhost or 127.0.0.1, because Harbor needs to be accessed by external clients.
-hostname: registry.serguzim.me
-
-# http related config
-http:
-  # port for http, default is 80. If https enabled, this port will redirect to https port
-  port: 3050
-
-# https related config
-https:
-#  # https port for harbor, default is 443
-  port: 3051
-#  # The path of cert and key files for nginx
-  certificate: /opt/services/.lego/certificates/registry.serguzim.me.crt
-  private_key: /opt/services/.lego/certificates/registry.serguzim.me.key
-
-# # Uncomment following will enable tls communication between all harbor components
-# internal_tls:
-#   # set enabled to true means internal tls is enabled
-#   enabled: true
-#   # put your cert and key files on dir
-#   dir: /etc/harbor/tls/internal
-
-# Uncomment external_url if you want to enable external proxy
-# And when it enabled the hostname will no longer used
-external_url: https://registry.serguzim.me
-
-# The initial password of Harbor admin
-# It only works in first time to install harbor
-# Remember Change the admin password from UI after launching Harbor.
-harbor_admin_password: Harbor12345
-
-# Harbor DB configuration
-database:
-  # The password for the root user of Harbor DB. Change this before any production use.
-  password: root123
-  # The maximum number of connections in the idle connection pool. If it <=0, no idle connections are retained.
-  max_idle_conns: 100
-  # The maximum number of open connections to the database. If it <= 0, then there is no limit on the number of open connections.
-  # Note: the default number of connections is 1024 for postgres of harbor.
-  max_open_conns: 900
-  # The maximum amount of time a connection may be reused. Expired connections may be closed lazily before reuse. If it <= 0, connections are not closed due to a connection's age.
-  # The value is a duration string. A duration string is a possibly signed sequence of decimal numbers, each with optional fraction and a unit suffix, such as "300ms", "-1.5h" or "2h45m". Valid time units are "ns", "us" (or "µs"), "ms", "s", "m", "h".
-  conn_max_lifetime: 5m
-  # The maximum amount of time a connection may be idle. Expired connections may be closed lazily before reuse. If it <= 0, connections are not closed due to a connection's idle time.
-  # The value is a duration string. A duration string is a possibly signed sequence of decimal numbers, each with optional fraction and a unit suffix, such as "300ms", "-1.5h" or "2h45m". Valid time units are "ns", "us" (or "µs"), "ms", "s", "m", "h".
-  conn_max_idle_time: 0
-
-# The default data volume
-data_volume: /opt/services/harbor/data/
-
-# Harbor Storage settings by default is using /data dir on local filesystem
-# Uncomment storage_service setting If you want to using external storage
-storage_service:
-  s3:
-    accesskey: ${HARBOR_S3_ACCESS_KEY}
-    secretkey: ${HARBOR_S3_SECRET_KEY}
-    region: de-contabo-1
-    regionendpoint: https://s3.serguzim.me
-    bucket: registry
-    secure: true
-  redirect:
-    disabled: false
-
-# Trivy configuration
-#
-# Trivy DB contains vulnerability information from NVD, Red Hat, and many other upstream vulnerability databases.
-# It is downloaded by Trivy from the GitHub release page https://github.com/aquasecurity/trivy-db/releases and cached
-# in the local file system. In addition, the database contains the update timestamp so Trivy can detect whether it
-# should download a newer version from the Internet or use the cached one. Currently, the database is updated every
-# 12 hours and published as a new release to GitHub.
-trivy:
-  # ignoreUnfixed The flag to display only fixed vulnerabilities
-  ignore_unfixed: false
-  # skipUpdate The flag to enable or disable Trivy DB downloads from GitHub
-  #
-  # You might want to enable this flag in test or CI/CD environments to avoid GitHub rate limiting issues.
-  # If the flag is enabled you have to download the `trivy-offline.tar.gz` archive manually, extract `trivy.db` and
-  # `metadata.json` files and mount them in the `/home/scanner/.cache/trivy/db` path.
-  skip_update: false
-  #
-  # The offline_scan option prevents Trivy from sending API requests to identify dependencies.
-  # Scanning JAR files and pom.xml may require Internet access for better detection, but this option tries to avoid it.
-  # For example, the offline mode will not try to resolve transitive dependencies in pom.xml when the dependency doesn't
-  # exist in the local repositories. It means a number of detected vulnerabilities might be fewer in offline mode.
-  # It would work if all the dependencies are in local.
-  # This option doesn't affect DB download. You need to specify "skip-update" as well as "offline-scan" in an air-gapped environment.
-  offline_scan: false
-  #
-  # Comma-separated list of what security issues to detect. Possible values are `vuln`, `config` and `secret`. Defaults to `vuln`.
-  security_check: vuln
-  #
-  # insecure The flag to skip verifying registry certificate
-  insecure: false
-  # github_token The GitHub access token to download Trivy DB
-  #
-  # Anonymous downloads from GitHub are subject to the limit of 60 requests per hour. Normally such rate limit is enough
-  # for production operations. If, for any reason, it's not enough, you could increase the rate limit to 5000
-  # requests per hour by specifying the GitHub access token. For more details on GitHub rate limiting please consult
-  # https://developer.github.com/v3/#rate-limiting
-  #
-  # You can create a GitHub token by following the instructions in
-  # https://help.github.com/en/github/authenticating-to-github/creating-a-personal-access-token-for-the-command-line
-  #
-  # github_token: xxx
-
-jobservice:
-  # Maximum number of job workers in job service
-  max_job_workers: 10
-  # The jobLogger sweeper duration (ignored if `jobLogger` is `stdout`)
-  logger_sweeper_duration: 1 #days
-
-notification:
-  # Maximum retry count for webhook job
-  webhook_job_max_retry: 3
-  # HTTP client timeout for webhook job
-  webhook_job_http_client_timeout: 3 #seconds
-
-# Log configurations
-log:
-  # options are debug, info, warning, error, fatal
-  level: info
-  # configs for logs in local storage
-  local:
-    # Log files are rotated log_rotate_count times before being removed. If count is 0, old versions are removed rather than rotated.
-    rotate_count: 50
-    # Log files are rotated only if they grow bigger than log_rotate_size bytes. If size is followed by k, the size is assumed to be in kilobytes.
-    # If the M is used, the size is in megabytes, and if G is used, the size is in gigabytes. So size 100, size 100k, size 100M and size 100G
-    # are all valid.
-    rotate_size: 200M
-    # The directory on your host that store log
-    location: /var/log/harbor
-
-  # Uncomment following lines to enable external syslog endpoint.
-  # external_endpoint:
-  #   # protocol used to transmit log to external endpoint, options is tcp or udp
-  #   protocol: tcp
-  #   # The host of external endpoint
-  #   host: localhost
-  #   # Port of external endpoint
-  #   port: 5140
-
-#This attribute is for migrator to detect the version of the .cfg file, DO NOT MODIFY!
-_version: 2.8.0
-
-# Uncomment external_database if using external database.
-external_database:
-  harbor:
-    host: db.serguzim.me
-    port: 5432
-    db_name: harbor
-    username: harbor
-    password: ${HARBOR_DATABASE_PASSWORD}
-    ssl_mode: verify-full
-    max_idle_conns: 2
-    max_open_conns: 0
-#   notary_signer:
-#     host: notary_signer_db_host
-#     port: notary_signer_db_port
-#     db_name: notary_signer_db_name
-#     username: notary_signer_db_username
-#     password: notary_signer_db_password
-#     ssl_mode: disable
-#   notary_server:
-#     host: notary_server_db_host
-#     port: notary_server_db_port
-#     db_name: notary_server_db_name
-#     username: notary_server_db_username
-#     password: notary_server_db_password
-#     ssl_mode: disable
-
-# Uncomment external_redis if using external Redis server
-# external_redis:
-#   # support redis, redis+sentinel
-#   # host for redis: <host_redis>:<port_redis>
-#   # host for redis+sentinel:
-#   #  <host_sentinel1>:<port_sentinel1>,<host_sentinel2>:<port_sentinel2>,<host_sentinel3>:<port_sentinel3>
-#   host: redis:6379
-#   password: 
-#   # Redis AUTH command was extended in Redis 6, it is possible to use it in the two-arguments AUTH <username> <password> form.
-#   # username:
-#   # sentinel_master_set must be set to support redis+sentinel
-#   #sentinel_master_set:
-#   # db_index 0 is for core, it's unchangeable
-#   registry_db_index: 1
-#   jobservice_db_index: 2
-#   trivy_db_index: 5
-#   idle_timeout_seconds: 30
-
-# Uncomment uaa for trusting the certificate of uaa instance that is hosted via self-signed cert.
-# uaa:
-#   ca_file: /path/to/ca
-
-# Global proxy
-# Config http proxy for components, e.g. http://my.proxy.com:3128
-# Components doesn't need to connect to each others via http proxy.
-# Remove component from `components` array if want disable proxy
-# for it. If you want use proxy for replication, MUST enable proxy
-# for core and jobservice, and set `http_proxy` and `https_proxy`.
-# Add domain to the `no_proxy` field, when you want disable proxy
-# for some special registry.
-proxy:
-  http_proxy:
-  https_proxy:
-  no_proxy:
-  components:
-    - core
-    - jobservice
-    - trivy
-
-metric:
-  enabled: enabled
-  port: 3059
-  path: /metrics
-
-# Trace related config
-# only can enable one trace provider(jaeger or otel) at the same time,
-# and when using jaeger as provider, can only enable it with agent mode or collector mode.
-# if using jaeger collector mode, uncomment endpoint and uncomment username, password if needed
-# if using jaeger agetn mode uncomment agent_host and agent_port
-# trace:
-#   enabled: true
-#   # set sample_rate to 1 if you wanna sampling 100% of trace data; set 0.5 if you wanna sampling 50% of trace data, and so forth
-#   sample_rate: 1
-#   # # namespace used to differenciate different harbor services
-#   # namespace:
-#   # # attributes is a key value dict contains user defined attributes used to initialize trace provider
-#   # attributes:
-#   #   application: harbor
-#   # # jaeger should be 1.26 or newer.
-#   # jaeger:
-#   #   endpoint: http://hostname:14268/api/traces
-#   #   username:
-#   #   password:
-#   #   agent_host: hostname
-#   #   # export trace data by jaeger.thrift in compact mode
-#   #   agent_port: 6831
-#   # otel:
-#   #   endpoint: hostname:4318
-#   #   url_path: /v1/traces
-#   #   compression: false
-#   #   insecure: true
-#   #   timeout: 10s
-
-# Enable purge _upload directories
-upload_purging:
-  enabled: true
-  # remove files in _upload directories which exist for a period of time, default is one week.
-  age: 168h
-  # the interval of the purge operations
-  interval: 24h
-  dryrun: false
-
-# Cache layer configurations
-# If this feature enabled, harbor will cache the resource
-# `project/project_metadata/repository/artifact/manifest` in the redis
-# which can especially help to improve the performance of high concurrent
-# manifest pulling.
-# NOTICE
-# If you are deploying Harbor in HA mode, make sure that all the harbor
-# instances have the same behaviour, all with caching enabled or disabled,
-# otherwise it can lead to potential data inconsistency.
-cache:
-  # not enabled by default
-  enabled: false
-  # keep cache for one day by default
-  expire_hours: 24

harbor/install.sh

@@ -1,80 +0,0 @@
-#!/bin/bash
-
-set -e
-
-DIR="$(cd "$(dirname "$0")" && pwd)"
-source $DIR/common.sh
-
-set +o noglob
-
-usage=$'Please set hostname and other necessary attributes in harbor.yml first. DO NOT use localhost or 127.0.0.1 for hostname, because Harbor needs to be accessed by external clients.
-Please set --with-trivy if needs enable Trivy in Harbor.
-Please do NOT set --with-chartmuseum, as chartmusuem has been deprecated and removed.
-Please do NOT set --with-notary, as notary has been deprecated and removed.'
-item=0
-
-# clair is deprecated
-with_clair=$false
-# trivy is not enabled by default
-with_trivy=$false
-
-# flag to using docker compose v1 or v2, default would using v1 docker-compose
-DOCKER_COMPOSE=docker-compose
-
-while [ $# -gt 0 ]; do
-        case $1 in
-            --help)
-            note "$usage"
-            exit 0;;
-            --with-trivy)
-            with_trivy=true;;
-            *)
-            note "$usage"
-            exit 1;;
-        esac
-        shift || true
-done
-
-workdir="$( cd "$( dirname "${BASH_SOURCE[0]}" )" && pwd )"
-cd $workdir
-
-h2 "[Step $item]: checking if docker is installed ..."; let item+=1
-check_docker
-
-h2 "[Step $item]: checking docker-compose is installed ..."; let item+=1
-check_dockercompose
-
-if [ -f harbor*.tar.gz ]
-then
-    h2 "[Step $item]: loading Harbor images ..."; let item+=1
-    docker load -i ./harbor*.tar.gz
-fi
-echo ""
-
-h2 "[Step $item]: preparing environment ...";  let item+=1
-if [ -n "$host" ]
-then
-    sed "s/^hostname: .*/hostname: $host/g" -i ./harbor.yml
-fi
-
-h2 "[Step $item]: preparing harbor configs ...";  let item+=1
-prepare_para=
-if [ $with_trivy ]
-then
-    prepare_para="${prepare_para} --with-trivy"
-fi
-
-./prepare $prepare_para
-echo ""
-
-if [ -n "$DOCKER_COMPOSE ps -q"  ]
-    then
-        note "stopping existing Harbor instance ..." 
-        $DOCKER_COMPOSE down -v
-fi
-echo ""
-
-h2 "[Step $item]: starting Harbor ..."
-$DOCKER_COMPOSE up -d
-
-success $"----Harbor has been installed and started successfully.----"

harbor/prepare

@@ -1,64 +0,0 @@
-#!/bin/bash
-set -e
-
-# If compiling source code this dir is harbor's make dir.
-# If installing harbor via package, this dir is harbor's root dir.
-if [[ -n "$HARBOR_BUNDLE_DIR" ]]; then
-    harbor_prepare_path=$HARBOR_BUNDLE_DIR
-else
-    harbor_prepare_path="$( cd "$(dirname "$0")" ; pwd -P )"
-fi
-echo "prepare base dir is set to ${harbor_prepare_path}"
-
-# Clean up input dir
-rm -rf ${harbor_prepare_path}/input
-# Create a input dirs
-mkdir -p ${harbor_prepare_path}/input
-input_dir=${harbor_prepare_path}/input
-
-# Copy harbor.yml to input dir
-if [[ ! "$1" =~ ^\-\- ]] && [ -f "$1" ]
-then
-    cp $1 $input_dir/harbor.yml
-    shift
-else
-    if [ -f "${harbor_prepare_path}/harbor.yml" ];then
-        cp ${harbor_prepare_path}/harbor.yml $input_dir/harbor.yml
-    else
-        echo "no config file: ${harbor_prepare_path}/harbor.yml"
-        exit 1
-    fi
-fi
-
-data_path=$(grep '^[^#]*data_volume:' $input_dir/harbor.yml | awk '{print $NF}')
-
-# If previous secretkeys exist, move it to new location
-previous_secretkey_path=/data/secretkey
-previous_defaultalias_path=/data/defaultalias
-
-if [ -f $previous_secretkey_path ]; then
-    mkdir -p $data_path/secret/keys
-    mv $previous_secretkey_path $data_path/secret/keys
-fi
-if [ -f $previous_defaultalias_path ]; then
-    mkdir -p $data_path/secret/keys
-    mv $previous_defaultalias_path $data_path/secret/keys
-fi
-
-
-# Create secret dir
-secret_dir=${data_path}/secret
-config_dir=$harbor_prepare_path/common/config
-
-# Run prepare script
-docker run --rm -v $input_dir:/input \
-                    -v $data_path:/data \
-                    -v $harbor_prepare_path:/compose_location \
-                    -v $config_dir:/config \
-                    -v /:/hostfs \
-                    --privileged \
-                    goharbor/prepare:v2.9.0 prepare $@
-
-echo "Clean up the input dir"
-# Clean up input dir
-rm -rf ${harbor_prepare_path}/input