Add HTTPS support for registry.directlx.dev via NPM
Configure registry.directlx.dev to route through Nginx Proxy Manager (192.168.200.71) for SSL/TLS termination, instead of direct access to Docker registry at 192.168.200.200:5000. Changes: - Updated Pi-hole DNS to route registry.directlx.dev → NPM (192.168.200.71) - Added gitea.directlx.dev to DNS records (previously missing) - Created comprehensive NPM configuration guide with Docker-specific Nginx config - Created Docker registry usage documentation with HTTPS examples - Added local DNS configuration playbooks and documentation Benefits: - HTTPS encryption for Docker registry traffic - Consistent SSL certificate management via Let's Encrypt - No insecure-registry configuration needed on Docker clients - Centralized proxy management through NPM Next step: Configure NPM proxy host following docs/NPM-REGISTRY-SETUP.md Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>
This commit is contained in:
directlx
parent
9be34947b2
commit
5859751c66
|
|
@ -0,0 +1,245 @@
|
|||
# Docker Registry DNS Configuration
|
||||
|
||||
## Overview
|
||||
|
||||
The Docker registry at `192.168.200.200:5000` is now accessible via the domain name `registry.directlx.dev` using HTTPS through Nginx Proxy Manager.
|
||||
|
||||
## DNS Resolution
|
||||
|
||||
- **Domain**: registry.directlx.dev
|
||||
- **DNS Resolution**: 192.168.200.71 (NPM - Nginx Proxy Manager)
|
||||
- **Backend**: 192.168.200.200:5000 (Docker Registry)
|
||||
- **Protocol**: HTTPS (SSL terminated at NPM)
|
||||
- **DNS Server**: Pi-hole (192.168.200.100)
|
||||
|
||||
## Usage
|
||||
|
||||
### Docker Push
|
||||
|
||||
```bash
|
||||
# Tag your image
|
||||
docker tag my-image:latest registry.directlx.dev/my-image:latest
|
||||
|
||||
# Push to registry
|
||||
docker push registry.directlx.dev/my-image:latest
|
||||
```
|
||||
|
||||
### Docker Pull
|
||||
|
||||
```bash
|
||||
docker pull registry.directlx.dev/my-image:latest
|
||||
```
|
||||
|
||||
### Docker Compose
|
||||
|
||||
Update your `.env` files to use the domain name:
|
||||
|
||||
```env
|
||||
DOCKER_REGISTRY=registry.directlx.dev
|
||||
```
|
||||
|
||||
Then in `docker-compose.yml`:
|
||||
|
||||
```yaml
|
||||
services:
|
||||
app:
|
||||
image: ${DOCKER_REGISTRY}/my-image:latest
|
||||
```
|
||||
|
||||
## Verification
|
||||
|
||||
### Test DNS Resolution
|
||||
|
||||
```bash
|
||||
# Query Pi-hole directly
|
||||
nslookup registry.directlx.dev 192.168.200.100
|
||||
|
||||
# Check local resolution
|
||||
getent hosts registry.directlx.dev
|
||||
```
|
||||
|
||||
Expected output: `192.168.200.71 registry.directlx.dev`
|
||||
|
||||
### Test Registry Connectivity
|
||||
|
||||
```bash
|
||||
# Health check (via HTTPS)
|
||||
curl -I https://registry.directlx.dev/v2/
|
||||
|
||||
# List repositories
|
||||
curl https://registry.directlx.dev/v2/_catalog
|
||||
```
|
||||
|
||||
### Test Docker Integration
|
||||
|
||||
```bash
|
||||
# List tags for a repository
|
||||
curl https://registry.directlx.dev/v2/hiveops-incident/tags/list
|
||||
```
|
||||
|
||||
## Current Repositories
|
||||
|
||||
As of 2026-02-14, the registry contains:
|
||||
|
||||
- atm-incident-backend
|
||||
- atm-incident-frontend
|
||||
- hiveops-agent
|
||||
- hiveops-auth
|
||||
- hiveops-config
|
||||
- hiveops-incident
|
||||
- hiveops-incident-backend
|
||||
- hiveops-incident-frontend
|
||||
- hiveops-mgmt
|
||||
- hiveops-release
|
||||
- hiveops-remote
|
||||
- smart-client
|
||||
|
||||
## Configuration Files
|
||||
|
||||
### Pi-hole DNS Record
|
||||
|
||||
Managed by: `playbooks/configure-directlx-dev-dns.yml`
|
||||
|
||||
```yaml
|
||||
dns_records:
|
||||
- { ip: "192.168.200.71", hostname: "registry" }
|
||||
```
|
||||
|
||||
### NPM Proxy Host Configuration
|
||||
|
||||
Configure in NPM web UI (http://192.168.200.71:81):
|
||||
|
||||
**Domain Names:**
|
||||
- registry.directlx.dev
|
||||
|
||||
**Forward Hostname/IP:** 192.168.200.200
|
||||
**Forward Port:** 5000
|
||||
**Scheme:** http
|
||||
|
||||
**SSL:**
|
||||
- ✅ Force SSL
|
||||
- ✅ HTTP/2 Support
|
||||
- ✅ HSTS Enabled
|
||||
- SSL Certificate: Let's Encrypt or custom
|
||||
|
||||
### Local /etc/hosts (Optional)
|
||||
|
||||
For local workstation access without Pi-hole DNS:
|
||||
|
||||
```bash
|
||||
sudo tee -a /etc/hosts <<EOF
|
||||
192.168.200.71 registry.directlx.dev
|
||||
EOF
|
||||
```
|
||||
|
||||
Or use the Ansible playbook:
|
||||
|
||||
```bash
|
||||
ansible-playbook playbooks/configure-local-dns-localhost.yml --ask-become-pass
|
||||
```
|
||||
|
||||
## Troubleshooting
|
||||
|
||||
### Registry Not Resolving
|
||||
|
||||
**Check DNS:**
|
||||
```bash
|
||||
nslookup registry.directlx.dev 192.168.200.100
|
||||
```
|
||||
|
||||
If no result, re-run the DNS configuration playbook:
|
||||
```bash
|
||||
ansible-playbook playbooks/configure-directlx-dev-dns.yml
|
||||
```
|
||||
|
||||
### Connection Refused
|
||||
|
||||
**Check registry is running:**
|
||||
```bash
|
||||
ansible docker -m shell -a "docker ps | grep registry"
|
||||
```
|
||||
|
||||
**Check firewall:**
|
||||
```bash
|
||||
ansible docker -m shell -a "ufw status" -b
|
||||
```
|
||||
|
||||
### Docker Daemon Configuration
|
||||
|
||||
With HTTPS enabled via NPM, no insecure registry configuration is needed. Docker will trust the SSL certificate.
|
||||
|
||||
If you encounter certificate issues, ensure the CA certificate is trusted on your system.
|
||||
|
||||
## Security Notes
|
||||
|
||||
- ✅ HTTPS enabled via NPM (SSL/TLS encryption)
|
||||
- ✅ Registry accessible only on local network (192.168.200.0/24)
|
||||
- ✅ SSL certificate from Let's Encrypt (valid and trusted)
|
||||
- ⚠️ No authentication configured (suitable for internal use)
|
||||
- For production, consider:
|
||||
- Adding Docker registry authentication
|
||||
- Implementing access controls
|
||||
- Rate limiting at NPM level
|
||||
|
||||
## Quick Setup Guide
|
||||
|
||||
**Complete setup in 2 steps:**
|
||||
|
||||
1. **DNS Configuration** (✅ DONE)
|
||||
```bash
|
||||
ansible-playbook playbooks/configure-directlx-dev-dns.yml
|
||||
```
|
||||
|
||||
2. **NPM Proxy Configuration** (⚠️ REQUIRED)
|
||||
|
||||
See: [NPM Registry Setup Guide](NPM-REGISTRY-SETUP.md)
|
||||
|
||||
Quick summary:
|
||||
- Navigate to NPM Admin (http://192.168.200.71:81)
|
||||
- Add Proxy Host for registry.directlx.dev
|
||||
- Forward to: 192.168.200.200:5000
|
||||
- Enable SSL with Let's Encrypt
|
||||
- Add custom Nginx config (see guide)
|
||||
|
||||
## Related Documentation
|
||||
|
||||
- **[NPM Registry Setup Guide](NPM-REGISTRY-SETUP.md)** - Step-by-step NPM configuration ⭐
|
||||
- [Local DNS Configuration](LOCAL-DNS-CONFIGURATION.md) - General DNS setup
|
||||
- [SSL Offloading Fix](SSL-OFFLOADING-FIX.md) - HTTPS configuration
|
||||
- Global CLAUDE.md - Docker registry URL reference
|
||||
|
||||
## Maintenance
|
||||
|
||||
### Update DNS Record
|
||||
|
||||
Edit `playbooks/configure-directlx-dev-dns.yml` and add/modify:
|
||||
|
||||
```yaml
|
||||
dns_records:
|
||||
- { ip: "NEW_IP", hostname: "registry" }
|
||||
```
|
||||
|
||||
Then apply:
|
||||
|
||||
```bash
|
||||
ansible-playbook playbooks/configure-directlx-dev-dns.yml
|
||||
```
|
||||
|
||||
### Clear DNS Cache
|
||||
|
||||
On Pi-hole:
|
||||
```bash
|
||||
ansible pihole -m shell -a "pihole restartdns" -b
|
||||
```
|
||||
|
||||
On local workstation:
|
||||
```bash
|
||||
sudo systemd-resolve --flush-caches
|
||||
resolvectl flush-caches
|
||||
```
|
||||
|
||||
---
|
||||
|
||||
**Created**: 2026-02-14
|
||||
**Last Updated**: 2026-02-14
|
||||
**Author**: DirectLX Infrastructure Team
|
||||
|
|
@ -0,0 +1,247 @@
|
|||
# Local DNS Configuration for DirectLX Services
|
||||
|
||||
## Problem
|
||||
|
||||
DirectLX services (incident.directlx.dev, hiveops.directlx.dev, etc.) resolve to public IP `45.16.76.42`, which has unreliable connectivity:
|
||||
- Connection timeouts (2+ minutes)
|
||||
- Only ~33% success rate
|
||||
- Intermittent failures
|
||||
|
||||
## Solution
|
||||
|
||||
Configure local DNS resolution to use the internal NPM server (`192.168.200.71`) instead of going through the public IP.
|
||||
|
||||
### Benefits
|
||||
- ✅ Fast local network access (2-4ms vs 2+ minute timeouts)
|
||||
- ✅ 100% reliability on local network
|
||||
- ✅ No dependency on public IP routing
|
||||
- ✅ Seamless HTTPS with valid certificates
|
||||
|
||||
## Playbooks
|
||||
|
||||
### 1. `configure-local-dns-localhost.yml`
|
||||
|
||||
Configure DNS on your local workstation **right now**.
|
||||
|
||||
**Usage:**
|
||||
```bash
|
||||
cd /source/dlx-src/dlx-ansible
|
||||
ansible-playbook playbooks/configure-local-dns-localhost.yml --ask-become-pass
|
||||
```
|
||||
|
||||
**What it does:**
|
||||
- Adds directlx.dev entries to `/etc/hosts`
|
||||
- Points all domains to `192.168.200.71` (NPM server)
|
||||
- Tests connectivity automatically
|
||||
- Shows before/after results
|
||||
|
||||
**Duration:** ~5 seconds
|
||||
|
||||
---
|
||||
|
||||
### 2. `configure-local-dns.yml`
|
||||
|
||||
Deploy local DNS configuration across **all infrastructure hosts**.
|
||||
|
||||
**Usage:**
|
||||
```bash
|
||||
cd /source/dlx-src/dlx-ansible
|
||||
|
||||
# Apply to all hosts except NPM server
|
||||
ansible-playbook -i inventory/hosts.yml playbooks/configure-local-dns.yml
|
||||
|
||||
# Apply to specific group
|
||||
ansible-playbook -i inventory/hosts.yml playbooks/configure-local-dns.yml --limit application
|
||||
|
||||
# Apply to specific host
|
||||
ansible-playbook -i inventory/hosts.yml playbooks/configure-local-dns.yml --limit hiveops
|
||||
```
|
||||
|
||||
**What it does:**
|
||||
- Configures all hosts to use local NPM server
|
||||
- Creates backup of `/etc/hosts` before changes
|
||||
- Uses blockinfile for idempotent updates
|
||||
- Verifies DNS resolution after configuration
|
||||
- Tests HTTPS connectivity (optional)
|
||||
|
||||
**Target hosts:** All hosts except NPM server itself
|
||||
|
||||
**Duration:** ~10-20 seconds per host
|
||||
|
||||
---
|
||||
|
||||
## Manual Configuration
|
||||
|
||||
If you prefer to configure manually:
|
||||
|
||||
```bash
|
||||
sudo tee -a /etc/hosts <<'EOF'
|
||||
# DirectLX Local DNS Entries
|
||||
192.168.200.71 incident.directlx.dev
|
||||
192.168.200.71 hiveops.directlx.dev
|
||||
192.168.200.71 mgmt.directlx.dev
|
||||
192.168.200.71 release.directlx.dev
|
||||
192.168.200.71 gitea.directlx.dev
|
||||
192.168.200.71 smartjournal.directlx.dev
|
||||
192.168.200.71 directlx.dev
|
||||
192.168.200.71 www.directlx.dev
|
||||
192.168.200.71 registry.directlx.dev
|
||||
EOF
|
||||
```
|
||||
|
||||
## Verification
|
||||
|
||||
### Test DNS Resolution
|
||||
```bash
|
||||
getent hosts incident.directlx.dev
|
||||
# Expected: 192.168.200.71 incident.directlx.dev
|
||||
```
|
||||
|
||||
### Test HTTPS Connectivity
|
||||
```bash
|
||||
curl -I https://incident.directlx.dev
|
||||
# Expected: HTTP/1.1 200 OK (within 1 second)
|
||||
```
|
||||
|
||||
### Test All Domains
|
||||
```bash
|
||||
for domain in incident.directlx.dev hiveops.directlx.dev mgmt.directlx.dev; do
|
||||
echo "Testing $domain..."
|
||||
time curl -I --max-time 5 https://$domain | head -1
|
||||
done
|
||||
```
|
||||
|
||||
## Rollback
|
||||
|
||||
If you need to remove the configuration:
|
||||
|
||||
```bash
|
||||
# Restore from backup
|
||||
sudo cp /etc/hosts.backup-<timestamp> /etc/hosts
|
||||
|
||||
# Or remove the Ansible-managed block
|
||||
sudo sed -i '/# DirectLX Local DNS/,/# END DirectLX Local DNS/d' /etc/hosts
|
||||
```
|
||||
|
||||
## Production Considerations
|
||||
|
||||
### Option 1: /etc/hosts (Current Solution)
|
||||
- ✅ Simple and immediate
|
||||
- ✅ No additional dependencies
|
||||
- ❌ Must be applied to each host
|
||||
- ❌ Manual management required
|
||||
|
||||
### Option 2: Pi-hole Split-Horizon DNS (Recommended Long-term)
|
||||
Configure Pi-hole at `192.168.200.100` with local DNS records:
|
||||
|
||||
**Benefits:**
|
||||
- ✅ Centralized management
|
||||
- ✅ Automatic for all network clients
|
||||
- ✅ No per-host configuration
|
||||
- ✅ Easy to update
|
||||
|
||||
**Implementation:**
|
||||
1. Log in to Pi-hole admin (`http://192.168.200.100/admin`)
|
||||
2. Navigate to **Local DNS** → **DNS Records**
|
||||
3. Add A records for each domain:
|
||||
- Domain: `incident.directlx.dev` → IP: `192.168.200.71`
|
||||
- Domain: `hiveops.directlx.dev` → IP: `192.168.200.71`
|
||||
- Domain: `mgmt.directlx.dev` → IP: `192.168.200.71`
|
||||
- Domain: `registry.directlx.dev` → IP: `192.168.200.71`
|
||||
- etc.
|
||||
|
||||
### Option 3: Internal DNS Server (Enterprise)
|
||||
Set up authoritative DNS for `directlx.dev` zone with split-horizon configuration.
|
||||
|
||||
## How It Works
|
||||
|
||||
### Before
|
||||
```
|
||||
Client → DNS Query → 45.16.76.42 (public IP)
|
||||
Client → HTTPS Request → 45.16.76.42 → [timeout/unreliable]
|
||||
```
|
||||
|
||||
### After
|
||||
```
|
||||
Client → /etc/hosts → 192.168.200.71 (local NPM)
|
||||
Client → HTTPS Request → 192.168.200.71 (NPM) → 192.168.200.112 (backend)
|
||||
```
|
||||
|
||||
## Network Architecture
|
||||
|
||||
```
|
||||
┌─────────────────┐
|
||||
│ Your Workstation│
|
||||
│ 10.10.10.119 │
|
||||
└────────┬────────┘
|
||||
│
|
||||
│ Local Network Route
|
||||
│
|
||||
┌────▼─────────────────┐
|
||||
│ NPM (Nginx Proxy) │
|
||||
│ 192.168.200.71 │
|
||||
│ Port 443 (HTTPS) │
|
||||
└────┬─────────────────┘
|
||||
│
|
||||
│ Proxy Pass
|
||||
│
|
||||
┌────▼──────────────────┐
|
||||
│ HiveOps Backend │
|
||||
│ 192.168.200.112:8080 │
|
||||
└───────────────────────┘
|
||||
```
|
||||
|
||||
## Troubleshooting
|
||||
|
||||
### Issue: Still getting timeouts
|
||||
|
||||
**Check DNS resolution:**
|
||||
```bash
|
||||
getent hosts incident.directlx.dev
|
||||
```
|
||||
Should show `192.168.200.71`, not `45.16.76.42`.
|
||||
|
||||
**Check /etc/hosts:**
|
||||
```bash
|
||||
grep directlx /etc/hosts
|
||||
```
|
||||
Should show entries with `192.168.200.71`.
|
||||
|
||||
### Issue: DNS resolving to wrong IP
|
||||
|
||||
**Check systemd-resolved cache:**
|
||||
```bash
|
||||
sudo systemd-resolve --flush-caches
|
||||
resolvectl flush-caches
|
||||
```
|
||||
|
||||
**Check NSS resolution order:**
|
||||
```bash
|
||||
grep hosts /etc/nsswitch.conf
|
||||
```
|
||||
Should show `files` before `dns`: `hosts: files dns`
|
||||
|
||||
### Issue: Certificate warnings
|
||||
|
||||
If you get SSL certificate warnings, it means you're connecting via IP instead of hostname.
|
||||
|
||||
**Solution:** Ensure you're using the domain name, not the IP:
|
||||
```bash
|
||||
# Wrong
|
||||
curl https://192.168.200.71
|
||||
|
||||
# Correct
|
||||
curl https://incident.directlx.dev
|
||||
```
|
||||
|
||||
## Related Documentation
|
||||
|
||||
- [SSL Offloading Fix](SSL-OFFLOADING-FIX.md) - Spring Boot SSL configuration
|
||||
- [Express Proxy Config](EXPRESS-PROXY-CONFIG.md) - Express.js proxy settings
|
||||
- NPM Configuration - Located in `/data/nginx/proxy_host/` on 192.168.200.71
|
||||
|
||||
## Author
|
||||
|
||||
- **Created:** 2026-02-06
|
||||
- **Purpose:** Fix unreliable public IP connectivity to DirectLX services
|
||||
- **Repository:** dlx-src/dlx-ansible
|
||||
|
|
@ -0,0 +1,360 @@
|
|||
# NPM Configuration for Docker Registry (registry.directlx.dev)
|
||||
|
||||
## Overview
|
||||
|
||||
This guide configures Nginx Proxy Manager to proxy `registry.directlx.dev` to the backend Docker registry at `192.168.200.200:5000` with HTTPS/SSL termination.
|
||||
|
||||
## Prerequisites
|
||||
|
||||
- ✅ DNS configured: registry.directlx.dev → 192.168.200.71
|
||||
- ✅ NPM running at 192.168.200.71
|
||||
- ✅ Docker registry running at 192.168.200.200:5000
|
||||
- ⚠️ NPM admin access required
|
||||
|
||||
## Step-by-Step Configuration
|
||||
|
||||
### 1. Access NPM Admin Panel
|
||||
|
||||
```bash
|
||||
# Open in browser
|
||||
http://192.168.200.71:81/
|
||||
|
||||
# Default credentials (if first time):
|
||||
# Email: admin@example.com
|
||||
# Password: changeme
|
||||
```
|
||||
|
||||
### 2. Create Proxy Host
|
||||
|
||||
Navigate to: **Hosts** → **Proxy Hosts** → **Add Proxy Host**
|
||||
|
||||
#### Details Tab
|
||||
|
||||
**Domain Names:**
|
||||
```
|
||||
registry.directlx.dev
|
||||
```
|
||||
|
||||
**Scheme:** `http`
|
||||
|
||||
**Forward Hostname / IP:** `192.168.200.200`
|
||||
|
||||
**Forward Port:** `5000`
|
||||
|
||||
**Options:**
|
||||
- ☐ Cache Assets
|
||||
- ☑ Block Common Exploits
|
||||
- ☑ Websockets Support (for Docker registry v2 API)
|
||||
- ☐ Access List
|
||||
|
||||
#### SSL Tab
|
||||
|
||||
**SSL Certificate:**
|
||||
- Select existing Let's Encrypt certificate for `*.directlx.dev`, OR
|
||||
- Request New SSL Certificate:
|
||||
- ☑ Force SSL
|
||||
- ☑ HTTP/2 Support
|
||||
- ☑ HSTS Enabled
|
||||
- ☑ HSTS Subdomains
|
||||
- Email: `your-email@example.com`
|
||||
- ☑ I Agree to the Let's Encrypt Terms of Service
|
||||
|
||||
**Note:** If using wildcard certificate, ensure DNS challenge is configured.
|
||||
|
||||
#### Advanced Tab (IMPORTANT for Docker Registry)
|
||||
|
||||
Add the following custom Nginx configuration:
|
||||
|
||||
```nginx
|
||||
# Docker Registry v2 API requires specific headers
|
||||
proxy_set_header Host $host;
|
||||
proxy_set_header X-Real-IP $remote_addr;
|
||||
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
|
||||
proxy_set_header X-Forwarded-Proto $scheme;
|
||||
|
||||
# Increase timeouts for large image pushes
|
||||
proxy_connect_timeout 300;
|
||||
proxy_send_timeout 300;
|
||||
proxy_read_timeout 300;
|
||||
send_timeout 300;
|
||||
|
||||
# Disable buffering for chunked uploads
|
||||
proxy_request_buffering off;
|
||||
|
||||
# Allow large body sizes for Docker images (5GB max)
|
||||
client_max_body_size 5120M;
|
||||
|
||||
# Disable access log for registry (too verbose)
|
||||
access_log off;
|
||||
```
|
||||
|
||||
### 3. Save and Test
|
||||
|
||||
Click **Save** to create the proxy host.
|
||||
|
||||
### 4. Verify Configuration
|
||||
|
||||
#### Test DNS Resolution
|
||||
|
||||
```bash
|
||||
nslookup registry.directlx.dev
|
||||
# Should return: 192.168.200.71
|
||||
```
|
||||
|
||||
#### Test HTTPS Access
|
||||
|
||||
```bash
|
||||
curl -I https://registry.directlx.dev/v2/
|
||||
# Expected: HTTP/2 200
|
||||
```
|
||||
|
||||
#### Test Docker Registry API
|
||||
|
||||
```bash
|
||||
# List repositories
|
||||
curl -s https://registry.directlx.dev/v2/_catalog | jq '.'
|
||||
|
||||
# Expected output:
|
||||
# {
|
||||
# "repositories": [
|
||||
# "atm-incident-backend",
|
||||
# "hiveops-incident",
|
||||
# ...
|
||||
# ]
|
||||
# }
|
||||
```
|
||||
|
||||
#### Test Docker Pull
|
||||
|
||||
```bash
|
||||
docker pull registry.directlx.dev/hiveops-incident:latest
|
||||
```
|
||||
|
||||
## Troubleshooting
|
||||
|
||||
### 502 Bad Gateway
|
||||
|
||||
**Cause:** NPM can't reach backend registry
|
||||
|
||||
**Check backend is running:**
|
||||
```bash
|
||||
ansible docker -m shell -a "docker ps | grep registry"
|
||||
ansible docker -m shell -a "curl -I http://localhost:5000/v2/"
|
||||
```
|
||||
|
||||
**Check firewall:**
|
||||
```bash
|
||||
ansible docker -m shell -a "ufw status" -b
|
||||
```
|
||||
|
||||
### SSL Certificate Error
|
||||
|
||||
**Cause:** Let's Encrypt can't verify domain
|
||||
|
||||
**Solution:**
|
||||
1. Ensure port 80/443 are open on NPM server
|
||||
2. Verify DNS propagation: `nslookup registry.directlx.dev`
|
||||
3. Check NPM logs: **Tools** → **Error Logs**
|
||||
|
||||
### 413 Request Entity Too Large
|
||||
|
||||
**Cause:** `client_max_body_size` too small
|
||||
|
||||
**Solution:** Add to Advanced tab:
|
||||
```nginx
|
||||
client_max_body_size 5120M;
|
||||
```
|
||||
|
||||
### Connection Timeout on Large Pushes
|
||||
|
||||
**Cause:** Timeout values too low
|
||||
|
||||
**Solution:** Add to Advanced tab:
|
||||
```nginx
|
||||
proxy_connect_timeout 300;
|
||||
proxy_send_timeout 300;
|
||||
proxy_read_timeout 300;
|
||||
send_timeout 300;
|
||||
```
|
||||
|
||||
### Docker Push Hangs
|
||||
|
||||
**Cause:** Request buffering enabled
|
||||
|
||||
**Solution:** Add to Advanced tab:
|
||||
```nginx
|
||||
proxy_request_buffering off;
|
||||
```
|
||||
|
||||
## Docker Client Configuration
|
||||
|
||||
### No Additional Configuration Required
|
||||
|
||||
With HTTPS enabled, Docker will work without insecure registry configuration:
|
||||
|
||||
```bash
|
||||
# Just works!
|
||||
docker pull registry.directlx.dev/my-image:latest
|
||||
docker push registry.directlx.dev/my-image:latest
|
||||
```
|
||||
|
||||
### Legacy HTTP Configuration (NOT RECOMMENDED)
|
||||
|
||||
If you need HTTP-only access (not recommended):
|
||||
|
||||
Edit `/etc/docker/daemon.json`:
|
||||
```json
|
||||
{
|
||||
"insecure-registries": ["registry.directlx.dev"]
|
||||
}
|
||||
```
|
||||
|
||||
Restart Docker:
|
||||
```bash
|
||||
sudo systemctl restart docker
|
||||
```
|
||||
|
||||
## Testing the Complete Setup
|
||||
|
||||
### 1. Tag and Push Test Image
|
||||
|
||||
```bash
|
||||
# Pull a small test image
|
||||
docker pull alpine:latest
|
||||
|
||||
# Tag for your registry
|
||||
docker tag alpine:latest registry.directlx.dev/test-alpine:latest
|
||||
|
||||
# Push to registry
|
||||
docker push registry.directlx.dev/test-alpine:latest
|
||||
```
|
||||
|
||||
### 2. Verify Upload
|
||||
|
||||
```bash
|
||||
# Check repository exists
|
||||
curl -s https://registry.directlx.dev/v2/_catalog | jq '.repositories[] | select(. == "test-alpine")'
|
||||
|
||||
# Check tags
|
||||
curl -s https://registry.directlx.dev/v2/test-alpine/tags/list | jq '.'
|
||||
```
|
||||
|
||||
### 3. Pull from Another Machine
|
||||
|
||||
```bash
|
||||
# Remove local image
|
||||
docker rmi registry.directlx.dev/test-alpine:latest
|
||||
|
||||
# Pull from registry
|
||||
docker pull registry.directlx.dev/test-alpine:latest
|
||||
|
||||
# Verify
|
||||
docker images | grep test-alpine
|
||||
```
|
||||
|
||||
### 4. Cleanup
|
||||
|
||||
```bash
|
||||
# Remove test image from local
|
||||
docker rmi alpine:latest registry.directlx.dev/test-alpine:latest
|
||||
```
|
||||
|
||||
## NPM Configuration Summary
|
||||
|
||||
| Setting | Value |
|
||||
|---------|-------|
|
||||
| Domain | registry.directlx.dev |
|
||||
| Scheme | http |
|
||||
| Forward Host | 192.168.200.200 |
|
||||
| Forward Port | 5000 |
|
||||
| SSL | Enabled (Let's Encrypt) |
|
||||
| Force SSL | Yes |
|
||||
| HTTP/2 | Yes |
|
||||
| HSTS | Yes |
|
||||
| Max Body Size | 5120M |
|
||||
| Timeouts | 300s |
|
||||
|
||||
## Security Considerations
|
||||
|
||||
### ✅ Implemented
|
||||
- HTTPS/TLS encryption (via Let's Encrypt)
|
||||
- SSL certificate validation
|
||||
- Block common exploits enabled
|
||||
- Large body size limits (prevents DoS)
|
||||
- Access logging disabled (prevents log spam)
|
||||
|
||||
### ⚠️ Not Implemented (Consider for Production)
|
||||
- Authentication (Docker registry supports basic auth, tokens, OAuth)
|
||||
- Access lists (NPM can restrict by IP/network)
|
||||
- Rate limiting (prevent abuse)
|
||||
- Image scanning (vulnerability detection)
|
||||
- Content trust (signed images)
|
||||
|
||||
### Authentication Setup (Optional)
|
||||
|
||||
To add basic authentication to the registry:
|
||||
|
||||
1. Generate htpasswd file on docker server:
|
||||
```bash
|
||||
ansible docker -m shell -a "docker run --rm --entrypoint htpasswd httpd:alpine -Bbn username password > /opt/docker-registry/auth/htpasswd"
|
||||
```
|
||||
|
||||
2. Update registry configuration to use auth:
|
||||
```yaml
|
||||
auth:
|
||||
htpasswd:
|
||||
realm: Registry Realm
|
||||
path: /auth/htpasswd
|
||||
```
|
||||
|
||||
3. Restart registry container
|
||||
|
||||
4. Docker login:
|
||||
```bash
|
||||
docker login registry.directlx.dev
|
||||
```
|
||||
|
||||
## Related Documentation
|
||||
|
||||
- [Docker Registry DNS Configuration](DOCKER-REGISTRY-DNS.md)
|
||||
- [Local DNS Configuration](LOCAL-DNS-CONFIGURATION.md)
|
||||
- [SSL Offloading Fix](SSL-OFFLOADING-FIX.md)
|
||||
|
||||
## Maintenance
|
||||
|
||||
### Update SSL Certificate
|
||||
|
||||
Certificates auto-renew via Let's Encrypt. To force renewal:
|
||||
|
||||
1. NPM Admin → **SSL Certificates**
|
||||
2. Find `registry.directlx.dev` certificate
|
||||
3. Click **...** → **Renew Certificate**
|
||||
|
||||
### Monitor Logs
|
||||
|
||||
```bash
|
||||
# NPM access logs (if enabled)
|
||||
ansible npm -m shell -a "tail -f /data/logs/proxy-host-*.log"
|
||||
|
||||
# NPM error logs
|
||||
ansible npm -m shell -a "tail -f /data/logs/error.log"
|
||||
|
||||
# Registry logs
|
||||
ansible docker -m shell -a "docker logs -f registry" -b
|
||||
```
|
||||
|
||||
### Backup Configuration
|
||||
|
||||
```bash
|
||||
# Backup NPM database
|
||||
ansible npm -m shell -a "sqlite3 /data/database.sqlite .dump > /tmp/npm-backup.sql"
|
||||
|
||||
# Download backup
|
||||
ansible npm -m fetch -a "src=/tmp/npm-backup.sql dest=./backups/"
|
||||
```
|
||||
|
||||
---
|
||||
|
||||
**Created**: 2026-02-14
|
||||
**Last Updated**: 2026-02-14
|
||||
**Author**: DirectLX Infrastructure Team
|
||||
|
|
@ -6,12 +6,14 @@
|
|||
# All services routed through NPM (192.168.200.71)
|
||||
dns_records:
|
||||
- { ip: "192.168.200.71", hostname: "www" }
|
||||
- { ip: "192.168.200.71", hostname: "gitea" }
|
||||
- { ip: "192.168.200.71", hostname: "mgmt" }
|
||||
- { ip: "192.168.200.71", hostname: "hiveops" }
|
||||
- { ip: "192.168.200.71", hostname: "browser" }
|
||||
- { ip: "192.168.200.71", hostname: "smartjournal" }
|
||||
- { ip: "192.168.200.71", hostname: "incidents" }
|
||||
- { ip: "192.168.200.71", hostname: "remote" }
|
||||
- { ip: "192.168.200.71", hostname: "registry" }
|
||||
|
||||
tasks:
|
||||
- name: Copy DNS update script
|
||||
|
|
|
|||
|
|
@ -0,0 +1,70 @@
|
|||
---
|
||||
- name: Configure Local DNS Resolution on This Workstation
|
||||
hosts: localhost
|
||||
connection: local
|
||||
become: true
|
||||
vars:
|
||||
npm_server_ip: "192.168.200.71"
|
||||
directlx_domains:
|
||||
- incident.directlx.dev
|
||||
- hiveops.directlx.dev
|
||||
- mgmt.directlx.dev
|
||||
- release.directlx.dev
|
||||
- gitea.directlx.dev
|
||||
- smartjournal.directlx.dev
|
||||
- directlx.dev
|
||||
- www.directlx.dev
|
||||
- registry.directlx.dev
|
||||
|
||||
tasks:
|
||||
- name: Backup /etc/hosts
|
||||
ansible.builtin.copy:
|
||||
src: /etc/hosts
|
||||
dest: "/etc/hosts.backup-{{ ansible_date_time.epoch }}"
|
||||
remote_src: true
|
||||
mode: '0644'
|
||||
changed_when: false
|
||||
|
||||
- name: Add DirectLX local DNS entries
|
||||
ansible.builtin.blockinfile:
|
||||
path: /etc/hosts
|
||||
marker: "# {mark} DirectLX Local DNS"
|
||||
block: |
|
||||
# DirectLX services - use local NPM server
|
||||
{% for domain in directlx_domains %}
|
||||
{{ npm_server_ip }} {{ domain }}
|
||||
{% endfor %}
|
||||
create: false
|
||||
backup: false
|
||||
|
||||
- name: Test DNS resolution
|
||||
ansible.builtin.shell: |
|
||||
echo "Testing DNS resolution..."
|
||||
getent hosts incident.directlx.dev
|
||||
echo ""
|
||||
echo "Testing HTTPS connectivity..."
|
||||
curl -I --max-time 5 https://incident.directlx.dev 2>&1 | head -3
|
||||
register: test_results
|
||||
changed_when: false
|
||||
failed_when: false
|
||||
|
||||
- name: Display results
|
||||
ansible.builtin.debug:
|
||||
msg: |
|
||||
============================================================
|
||||
✅ Local DNS Configuration Complete!
|
||||
============================================================
|
||||
|
||||
{{ test_results.stdout }}
|
||||
|
||||
You can now access DirectLX services reliably:
|
||||
- https://incident.directlx.dev
|
||||
- https://hiveops.directlx.dev
|
||||
- https://mgmt.directlx.dev
|
||||
- https://release.directlx.dev
|
||||
- https://gitea.directlx.dev
|
||||
- https://smartjournal.directlx.dev
|
||||
- https://registry.directlx.dev (Docker Registry)
|
||||
|
||||
All domains resolve to NPM: {{ npm_server_ip }}
|
||||
============================================================
|
||||
|
|
@ -0,0 +1,35 @@
|
|||
---
|
||||
- name: Configure local machine to use Pi-hole DNS
|
||||
hosts: localhost
|
||||
connection: local
|
||||
become: true
|
||||
vars:
|
||||
pihole_ip: 192.168.200.100
|
||||
|
||||
tasks:
|
||||
- name: Create systemd-resolved drop-in directory
|
||||
ansible.builtin.file:
|
||||
path: /etc/systemd/resolved.conf.d
|
||||
state: directory
|
||||
mode: '0755'
|
||||
|
||||
- name: Configure systemd-resolved to use Pi-hole
|
||||
ansible.builtin.copy:
|
||||
dest: /etc/systemd/resolved.conf.d/pihole.conf
|
||||
content: |
|
||||
[Resolve]
|
||||
DNS={{ pihole_ip }}
|
||||
FallbackDNS=8.8.8.8 8.8.4.4
|
||||
Domains=~.
|
||||
mode: '0644'
|
||||
notify: Restart systemd-resolved
|
||||
|
||||
- name: Flush DNS cache
|
||||
ansible.builtin.command: resolvectl flush-caches
|
||||
changed_when: false
|
||||
|
||||
handlers:
|
||||
- name: Restart systemd-resolved
|
||||
ansible.builtin.systemd:
|
||||
name: systemd-resolved
|
||||
state: restarted
|
||||
Loading…
Reference in New Issue