Add docker-registry-asg stack

docker-registry-asg/README.md

@@ -0,0 +1,111 @@
+# Docker Registry with ASG
+
+## Prerequisites
+
+* Create an EC2 Key Pair:
+
+```bash
+./docker-registry-asg/create-key-pair.sh <key-name>
+```
+
+**Note**: Your private key file must be protected from read and write operations from any other users. If your private key can be read or written to by anyone but you, then SSH ignores your key. For this reason, the private key is given `400` permissions.
+
+The key name should also be updated in `docker-registry-asg/parameters.json` or `docker-registry-asg/parameters.properties`.
+
+* Set a CloudFormation stack name:
+
+```bash
+STACK_NAME=<stack-name>
+```
+
+## Validation
+
+```bash
+aws cloudformation validate-template \
+--template-body file://docker-registry-asg/template.yaml
+```
+
+## Deployment
+
+```bash
+aws cloudformation create-stack \
+--stack-name $STACK_NAME \
+--template-body file://docker-registry-asg/template.yaml \
+--parameters file://docker-registry-asg/parameters.json
+```
+
+Alternatively, using `deploy`:
+
+```bash
+aws cloudformation deploy \
+--stack-name $STACK_NAME \
+--template-file docker-registry-asg/template.yaml \
+--parameter-overrides $(cat docker-registry-asg/parameters.properties)
+```
+
+## Testing
+
+* Testing SSH:
+
+```bash
+ASG_ID=$(aws cloudformation describe-stacks \
+--stack-name $STACK_NAME \
+--query 'Stacks[0].Outputs[?OutputKey==`ASGId`].OutputValue' \
+| grep -o -E "[a-zA-Z0-9\.\-]+")
+```
+
+```bash
+EC2_INSTANCES=($(aws autoscaling describe-auto-scaling-groups \
+--auto-scaling-group-names $ASG_ID \
+--query 'AutoScalingGroups[0].Instances[*].InstanceId' \
+| grep -o -E "[a-zA-Z0-9\.\-]+"))
+```
+
+```
+EC2_PUBLIC_DNS=()
+for i in $EC2_INSTANCES; do
+  EC2_PUBLIC_DNS+=($(aws ec2 describe-instances \
+  --instance-ids $i \
+  --query 'Reservations[0].Instances[0].NetworkInterfaces[0].Association.PublicDnsName' \
+  | grep -o -E "[a-zA-Z0-9\.\-]+"))
+done
+```
+
+```bash
+ssh -i docker-registry-asg/docker-registry-asg.pem ec2-user@$EC2_PUBLIC_DNS[1]
+```
+
+```bash
+ssh -i docker-registry-asg/docker-registry-asg.pem ec2-user@$EC2_PUBLIC_DNS[2]
+```
+
+```bash
+ssh -i docker-registry-asg/docker-registry-asg.pem ec2-user@$EC2_PUBLIC_DNS[...]
+```
+
+**Note**: To become root, execute `sudo -i`.
+
+* Testing the Docker Registry:
+
+In order to log in to the Docker Registry, you will need to add the registry to your list of insecure registries.
+
+To do this, go **Preference** > **Daemon** > and add `<alb-public-dns:port>` to **Insecure registries:**.
+
+**Example**: `docke-Elast-18NDH1RQVI5LH-1208128074.us-east-1.elb.amazonaws.com:80`
+
+```bash
+ALB_PUBLIC_DNS=$(aws cloudformation describe-stacks \
+--stack-name $STACK_NAME \
+--query 'Stacks[0].Outputs[?OutputKey==`ALBPublicDNS`].OutputValue' \
+| grep -o -E "[a-zA-Z0-9\:\/\.\-]+")
+```
+
+```bash
+docker login $ALB_PUBLIC_DNS:80
+echo "FROM alpine" > Dockerfile
+docker build -t alpine:latest .
+docker tag alpine $ALB_PUBLIC_DNS:80/alpine
+docker push $ALB_PUBLIC_DNS:80/alpine
+docker pull $ALB_PUBLIC_DNS:80/alpine
+rm Dockerfile
+```

docker-registry-asg/create-key-pair.sh

@@ -0,0 +1,19 @@
+#!/usr/bin/env bash
+
+usage() {
+  echo "usage: create-key-pair.sh <key-name>"
+}
+
+key_name="$1"
+
+if [ -z "$key_name" ]; then
+  usage
+  echo -en "\033[0;31m" # display red
+  echo "Error: Provide a key name."
+  echo -en "\033[0m"
+  exit 1
+fi
+
+aws ec2 create-key-pair --key-name $key_name --query 'KeyMaterial' --output text > $key_name.pem
+
+chmod 400 $key_name.pem

docker-registry-asg/files/docker-compose.yml

@@ -0,0 +1,19 @@
+nginx:
+  # Note: Only nginx:alpine supports bcrypt.
+  # If you don't need to use bcrypt, you can use a different tag.
+  # Ref: https://github.com/nginxinc/docker-nginx/issues/29
+  image: "nginx:alpine"
+  ports:
+    - 5043:443
+  links:
+    - registry:registry
+  volumes:
+    - ./auth:/etc/nginx/conf.d
+    - ./nginx.conf:/etc/nginx/nginx.conf:ro
+
+registry:
+  image: registry:2
+  ports:
+    - 127.0.0.1:5000:5000
+  volumes:
+    - ./data:/var/lib/registry

docker-registry-asg/files/nginx.conf

@@ -0,0 +1,80 @@
+events {
+    worker_connections  1024;
+}
+
+http {
+
+  upstream docker-registry {
+    server registry:5000;
+  }
+
+  ## Set a variable to help us decide if we need to add the
+  ## 'Docker-Distribution-Api-Version' header.
+  ## The registry always sets this header.
+  ## In the case of nginx performing auth, the header is unset
+  ## since nginx is auth-ing before proxying.
+  map $upstream_http_docker_distribution_api_version $docker_distribution_api_version {
+    '' 'registry/2.0';
+  }
+
+  server {
+    listen 443 ssl;
+    server_name localhost;
+
+    # SSL
+    ssl_certificate /etc/nginx/conf.d/domain.crt;
+    ssl_certificate_key /etc/nginx/conf.d/domain.key;
+
+    # Recommendations from https://raymii.org/s/tutorials/Strong_SSL_Security_On_nginx.html
+    ssl_protocols TLSv1.1 TLSv1.2;
+    ssl_ciphers 'EECDH+AESGCM:EDH+AESGCM:AES256+EECDH:AES256+EDH';
+    ssl_prefer_server_ciphers on;
+    ssl_session_cache shared:SSL:10m;
+
+    # disable any limits to avoid HTTP 413 for large image uploads
+    client_max_body_size 0;
+
+    # required to avoid HTTP 411: see Issue #1486 (https://github.com/moby/moby/issues/1486)
+    chunked_transfer_encoding on;
+
+    location /v2/ {
+      # Do not allow connections from docker 1.5 and earlier
+      # docker pre-1.6.0 did not properly set the user agent on ping, catch "Go *" user agents
+      if ($http_user_agent ~ "^(docker\/1\.(3|4|5(?!\.[0-9]-dev))|Go ).*$" ) {
+        return 404;
+      }
+
+      # To add basic authentication to v2 use auth_basic setting.
+      # auth_basic "Registry realm";
+      # auth_basic_user_file /etc/nginx/conf.d/nginx.htpasswd;
+
+      ## If $docker_distribution_api_version is empty, the header is not added.
+      ## See the map directive above where this variable is defined.
+      add_header 'Docker-Distribution-Api-Version' $docker_distribution_api_version always;
+
+      # Amazon's Elastic Load Balancer (ELB) in HTTPS mode already sets the
+      # following client header:
+      #
+      #   X-Real-IP
+      #   X-Forwarded-For
+      #   X-Forwarded-Proto
+      #
+      # If you have an NGINX instance sitting behind it, remove the following
+      # lines from the NGINX config below:
+      #
+      #   proxy_set_header  X-Real-IP         $remote_addr;
+      #   proxy_set_header  X-Forwarded-For   $proxy_add_x_forwarded_for;
+      #   proxy_set_header  X-Forwarded-Proto $scheme;
+
+      # set the HTTP protocol version for proxying to 1.1
+      proxy_http_version 1.1;
+
+      proxy_pass                          http://docker-registry;
+      proxy_set_header  Host              $http_host;   # required for docker client's sake
+      # proxy_set_header  X-Real-IP         $remote_addr; # pass on real client's IP
+      # proxy_set_header  X-Forwarded-For   $proxy_add_x_forwarded_for;
+      # proxy_set_header  X-Forwarded-Proto $scheme;
+      proxy_read_timeout                  900;
+    }
+  }
+}

docker-registry-asg/files/run.sh

@@ -0,0 +1,37 @@
+#!/usr/bin/env bash
+
+###############################################################################
+# run.sh is executed on the host and is used to start the Docker Compose
+# service.
+###############################################################################
+
+# set path to Docker Registry
+DOCKER_REGISTRY='/docker-registry'
+
+# start Docker Daemon
+service docker start
+
+# create required directories
+mkdir -p $DOCKER_REGISTRY/auth $DOCKER_REGISTRY/data
+
+# create certificate pair
+openssl req \
+  -x509 \
+  -nodes \
+  -days 365 \
+  -newkey rsa:2048 \
+  -sha256 \
+  -keyout $DOCKER_REGISTRY/auth/domain.key \
+  -out $DOCKER_REGISTRY/auth/domain.crt \
+  -subj "/C=US/ST=Iowa/L=Ames/O=Nickolas Kraus/CN=*.compute-1.amazonaws.com"
+
+# update trusted certificate store
+cp $DOCKER_REGISTRY/auth/domain.crt /etc/pki/ca-trust/source/anchors/domain.crt
+update-ca-trust
+service docker restart
+
+# start Docker Registry service
+docker-compose \
+  -f $DOCKER_REGISTRY/docker-compose.yml \
+  -p docker-registry \
+  up

docker-registry-asg/parameters.json

@@ -0,0 +1,18 @@
+[
+  {
+    "ParameterKey": "InstanceType",
+    "ParameterValue": "t2.small"
+  },
+  {
+    "ParameterKey": "KeyName",
+    "ParameterValue": "docker-registry-asg"
+  },
+  {
+    "ParameterKey": "Subnets",
+    "ParameterValue": "subnet-94bae6df,subnet-5e8b0103,subnet-8df9ace9"
+  },
+  {
+    "ParameterKey": "VpcId",
+    "ParameterValue": "vpc-75f0c50d"
+  }
+]

docker-registry-asg/parameters.properties

@@ -0,0 +1,4 @@
+InstanceType=t2.small
+KeyName=docker-registry-asg
+Subnets=subnet-94bae6df,subnet-5e8b0103,subnet-8df9ace9
+VpcId=vpc-75f0c50d