depot/third_party/nixpkgs/nixos/modules/services/misc/docker-registry.nix

180 lines
4.9 KiB
Nix

{ config, lib, pkgs, ... }:
let
cfg = config.services.dockerRegistry;
blobCache = if cfg.enableRedisCache
then "redis"
else "inmemory";
registryConfig = {
version = "0.1";
log.fields.service = "registry";
storage = {
cache.blobdescriptor = blobCache;
delete.enabled = cfg.enableDelete;
} // (lib.optionalAttrs (cfg.storagePath != null) { filesystem.rootdirectory = cfg.storagePath; });
http = {
addr = "${cfg.listenAddress}:${builtins.toString cfg.port}";
headers.X-Content-Type-Options = ["nosniff"];
};
health.storagedriver = {
enabled = true;
interval = "10s";
threshold = 3;
};
};
registryConfig.redis = lib.mkIf cfg.enableRedisCache {
addr = "${cfg.redisUrl}";
password = "${cfg.redisPassword}";
db = 0;
dialtimeout = "10ms";
readtimeout = "10ms";
writetimeout = "10ms";
pool = {
maxidle = 16;
maxactive = 64;
idletimeout = "300s";
};
};
configFile = cfg.configFile;
in {
options.services.dockerRegistry = {
enable = lib.mkEnableOption "Docker Registry";
package = lib.mkPackageOption pkgs "docker-distribution" {
example = "gitlab-container-registry";
};
listenAddress = lib.mkOption {
description = "Docker registry host or ip to bind to.";
default = "127.0.0.1";
type = lib.types.str;
};
port = lib.mkOption {
description = "Docker registry port to bind to.";
default = 5000;
type = lib.types.port;
};
openFirewall = lib.mkOption {
type = lib.types.bool;
default = false;
description = "Opens the port used by the firewall.";
};
storagePath = lib.mkOption {
type = lib.types.nullOr lib.types.path;
default = "/var/lib/docker-registry";
description = ''
Docker registry storage path for the filesystem storage backend. Set to
null to configure another backend via extraConfig.
'';
};
enableDelete = lib.mkOption {
type = lib.types.bool;
default = false;
description = "Enable delete for manifests and blobs.";
};
enableRedisCache = lib.mkEnableOption "redis as blob cache";
redisUrl = lib.mkOption {
type = lib.types.str;
default = "localhost:6379";
description = "Set redis host and port.";
};
redisPassword = lib.mkOption {
type = lib.types.str;
default = "";
description = "Set redis password.";
};
extraConfig = lib.mkOption {
description = ''
Docker extra registry configuration.
'';
example = lib.literalExpression ''
{
log.level = "debug";
}
'';
default = {};
type = lib.types.attrs;
};
configFile = lib.mkOption {
default = pkgs.writeText "docker-registry-config.yml" (builtins.toJSON (lib.recursiveUpdate registryConfig cfg.extraConfig));
defaultText = lib.literalExpression ''pkgs.writeText "docker-registry-config.yml" "# my custom docker-registry-config.yml ..."'';
description = ''
Path to CNCF distribution config file.
Setting this option will override any configuration applied by the extraConfig option.
'';
type = lib.types.path;
};
enableGarbageCollect = lib.mkEnableOption "garbage collect";
garbageCollectDates = lib.mkOption {
default = "daily";
type = lib.types.str;
description = ''
Specification (in the format described by
{manpage}`systemd.time(7)`) of the time at
which the garbage collect will occur.
'';
};
};
config = lib.mkIf cfg.enable {
systemd.services.docker-registry = {
description = "Docker Container Registry";
wantedBy = [ "multi-user.target" ];
after = [ "network.target" ];
script = ''
${cfg.package}/bin/registry serve ${configFile}
'';
serviceConfig = {
User = "docker-registry";
WorkingDirectory = cfg.storagePath;
AmbientCapabilities = lib.mkIf (cfg.port < 1024) "cap_net_bind_service";
};
};
systemd.services.docker-registry-garbage-collect = {
description = "Run Garbage Collection for docker registry";
restartIfChanged = false;
unitConfig.X-StopOnRemoval = false;
serviceConfig.Type = "oneshot";
script = ''
${cfg.package}/bin/registry garbage-collect ${configFile}
/run/current-system/systemd/bin/systemctl restart docker-registry.service
'';
startAt = lib.optional cfg.enableGarbageCollect cfg.garbageCollectDates;
};
users.users.docker-registry =
(lib.optionalAttrs (cfg.storagePath != null) {
createHome = true;
home = cfg.storagePath;
}) // {
group = "docker-registry";
isSystemUser = true;
};
users.groups.docker-registry = {};
networking.firewall = lib.mkIf cfg.openFirewall {
allowedTCPPorts = [ cfg.port ];
};
};
}