我正在 docker 環境中為我的公司運行一個自架的 Gitlab，並且我們想要託管我們自己的 docker 映像，所以我閱讀文件但我做不到docker login registry.mycompany-domain.tld，我總是得到unauthorized: HTTP Basic: Access denied
，當我去時，https://registry.mycompany-domain.tld我只得到一張空白頁。我不知道這是否正確，但我懷疑有些事情無法正常工作。
由於防火牆原因，我無法啟用 gitlab 映像自動取得讓我們加密憑證（我需要在不同的主機上執行此操作），因此我進行了以下設定：
- 我有一個
docker-compose.yml文件/opt/gitlab並公開這些連接埠：127.0.0.1:1443:443'22:22'
- 在
/etc/nginx/sites-enabled/gitlab我將網域配置gitlab.mycompany.tld為代理https://localhost:1443 - 主主機上的 nginx 使用 let's encrypt 證書，docker 容器上的 nginx 使用自簽名證書。
此設定有效，我可以透過 SSH 和 Web 介面存取 Gitalb，沒有任何問題。
我決定為註冊表使用單獨的網域：
registry.mycompany-domain.tld然後我在docker-compose.yml文件的 obminus 部分啟用註冊表。現在看起來像這樣（自簽名憑證位於/etc/CA）：
--
# generated using example from https://docs.gitlab.com/omnibus/docker/#install-gitlab-using-docker-compose
# GITLAB_HOME=/opt/gitlab/container
web:
image: 'gitlab/gitlab-ee:13.11.3-ee.0'
restart: always
hostname: gitlab.mycompany.tld
shm_size: 256m
environment:
GITLAB_OMNIBUS_CONFIG: |
external_url 'https://gitlab.mycompany.tld'
letsencrypt['enable'] = false
nginx['ssl_certificate'] = '/certificates/gitlab/gitlab.fullchain.crt'
nginx['ssl_certificate_key'] = '/certificates/gitlab/gitlab.key'
nginx['redirect_http_to_https'] = true
nginx['real_ip_header'] = 'X-Forwarded-For'
nginx['real_ip_recursive'] = 'on'
mattermost_nginx['redirect_http_to_https'] = true
registry_external_url 'https://registry.mycompany.tld'
registry['enable'] = true
registry_nginx['redirect_http_to_https'] = true
registry_nginx['ssl_certificate'] = '/certificates/gitlab/gitlab.fullchain.crt'
registry_nginx['ssl_certificate_key'] = '/certificates/gitlab/gitlab.key'
gitlab_rails['registry_enabled'] = true
gitlab_rails['registry_host'] = "registry.mycompany.tld"
gitlab_rails['smtp_enable'] = true
...
ports:
- '127.0.0.1:1443:443'
- '22:22'
volumes:
- '$GITLAB_HOME/config:/etc/gitlab'
- '$GITLAB_HOME/logs:/var/log/gitlab'
- '$GITLAB_HOME/data:/var/opt/gitlab'
- '/etc/CA:/certificates'
我的/etc/nginx/sites-enabled/registry文件如下所示：
server {
listen 80;
server_name registry.mycompany.tld;
access_log /var/log/nginx/registry.mycompany.tld-access.log;
error_log /var/log/nginx/registry.mycompany.tld-error.log;
location /.well-known {
root /var/certbot/acme-challenges;
}
location / {
return 301 https://$host$request_uri;
}
}
# see https://gitlab.com/gitlab-org/gitlab/blob/master/lib/support/nginx/registry-ssl
server {
listen 443 http2;
server_name registry.mycompany.tld;
access_log /var/log/nginx/ssl_registry.mycompany.tld-access.log;
error_log /var/log/nginx/ssl_registry.mycompany.tld-error.log;
client_max_body_size 0;
chunked_transfer_encoding on;
ssl on;
ssl_certificate /etc/letsencrypt/live/registry.mycompany.tld/fullchain.pem;
ssl_certificate_key /etc/letsencrypt/live/registry.mycompany.tld/privkey.pem;
ssl_prefer_server_ciphers on;
ssl_session_cache builtin:1000 shared:SSL:10m;
ssl_session_timeout 5m;
location /{
proxy_cache off;
proxy_pass https://localhost:1443;
proxy_ssl_certificate /etc/CA/gitlab/gitlab.fullchain.crt;
proxy_ssl_certificate_key /etc/CA/gitlab/gitlab.key;
proxy_ssl_trusted_certificate /etc/CA/CA.crt;
proxy_ssl_verify on;
proxy_ssl_session_reuse on;
include /etc/nginx/proxy_params;
proxy_read_timeout 3600;
}
}
如果我看一下/opt/gitlab/container/logs/registry/current我就能看到
2021-06-01_16:44:21.01934 time="2021-06-01T16:44:21Z" level=warning msg="error authorizing context: authorization token required" correlation_id=xxxx go_version=go1.15.8 root_repo=
2021-06-01_16:44:21.01966 {"content_type":"application/json","correlation_id":"xxxx","duration_ms":2,"host":"registry.mycompany.tld","level":"info","method":"GET","msg":"access","proto":"HTTP/1.1","referrer":"","remote_addr":"127.0.0.1:56368","remote_ip":"xxxx","status":401,"system":"http","time":"2021-06-01T16:44:21Z","ttfb_ms":2,"uri":"/v2/","user_agent":"Docker-Client/20.10.0-dev (linux)","written_bytes":87}
我真的不明白這意味著什麼。 Gitlab docker 容器自動建立了一個檔案（/opt/gitlab/container/data/registry/config.yml），所以我真的不知道該怎麼做。
我在這裡缺少什麼？