dockerauth

gistfile1.txt

# --- defaults for http auth ---

docker_registry_htpaswd_realm: "CORD Registry"

docker_registry_admin_user: "dockerreg@opencord.org"
docker_registry_admin_pass: "{{ lookup('password', credentials_dir ~ '/' ~ docker_registry_admin_user ~ ' chars=ascii_letters,digits,length=16') }}"

# see https://docs.docker.com/registry/recipes/mirror/
# docker_registry_proxy_remoteurl: "https://registry-1.docker.io"
#
# registry can't work in both proxy and target (push) mode
# To enable, add this to registry docker-compose.yml file:
#   REGISTRY_PROXY_REMOTEURL: {{ docker_registry_proxy_remoteurl }}

# list of docker registry users
docker_registry_users:
  - name: "{{ docker_registry_admin_user }}"
    password: "{{ docker_registry_admin_pass }}"

# --- role ---

# if using HTTP basic auth...
#
# need to set this in the environment section of the docker-compose.yml file
#
# REGISTRY_HTTP_SECRET: {{ docker_registry_http_secret }}
# REGISTRY_AUTH: htpasswd
# REGISTRY_AUTH_HTPASSWD_PATH: /auth/htpasswd
# REGISTRY_AUTH_HTPASSWD_REALM: {{ docker_registry_htpaswd_realm }}
#
# must use bcrypt as crypt_scheme as other hashes aren't supported
 - name: Create user accounts for docker registry
   htpasswd:
     path: /etc/docker/registry/auth/htpasswd
     create: yes
     crypt_scheme: bcrypt
     name: "{{ item.name }}"
     password: "{{ item.password }}"
     owner: root
     group: docker
     mode: 0640
   with_items: "{{ docker_registry_users }}"
   
   
--- for conf of docker daemon w/ssl auth ---


- name: Copy over dockerd SSL keys
  become: yes
  copy:
    src: "{{ item.src }}"
    dest:  "/etc/docker/{{ item.dest }}"
    mode: "{{ item.mode }}"
    owner: root
    group: root
  with_items:
    - src: "{{ pki_dir }}/root_ca/certs/ca_cert.pem"
      dest: "ca_cert.pem"
      mode: "0444"
    - src: "{{ pki_dir }}/{{ site_name }}_im_ca/certs/docker.{{ site_suffix }}_cert_chain.pem"
      dest: "docker_server.pem"
      mode: "0444"
    - src: "{{ pki_dir }}/{{ site_name }}_im_ca/private/docker.{{ site_suffix }}_key.pem"
      dest: "docker_server_key.pem"
      mode: "0400"
  notify:
    - docker-restart

- name: Create dockerd config that requires SSL auth
  become: yes
  template:
    src: "docker.j2"
    dest: "/etc/default/docker"
    owner: root
    group: root
    mode: 0644
  notify:
    - docker-restart

# only needed for http basic auth, not used
# - name: Login to the pod's docker registry
#   docker_login:
#     registry: "https://registry.{{ site_suffix }}:{{ docker_registry_ext_port }}"
#     tls_verify: yes
#     reauthorize: yes
#     username: "{{ docker_registry_admin_user }}"
#     password: "{{ docker_registry_admin_pass }}"