Only allow containerbuild to push to the registry

Signed-off-by: Patrick Uiterwijk <puiterwijk@redhat.com>

roles/fedora-web/registry/files/paswd

@@ -0,0 +1 @@
+/C=US/ST=North Carolina/O=Fedora Project/OU=Fedora Builders/CN=containerbuild/emailAddress=buildsys@fedoraproject.org:xxj31ZMTZzkVA

roles/fedora-web/registry/tasks/main.yml

@@ -6,3 +6,12 @@
   tags:
   - fedora-web
   - fedora-web/registry
+
+- name: Copy over the registry passwd
+  copy: src=passwd dest=/etc/httpd/conf.d/registry.fedoraproject.org/passwd
+        owner=root group=root mode=0644
+  notify:
+  - reload httpd
+  tags:
+  - fedora-web
+  - fedora-web/registry

roles/httpd/reverseproxy/templates/reversepassproxy.registry.conf

@@ -9,3 +9,24 @@ ProxyPassReverse {{ localpath }} {{ proxyurl }}{{remotepath}}
 SSLVerifyClient optional
 SSLVerifyDepth 1
 SSLCACertificateFile /etc/pki/httpd/fedora-server-ca.cert
+SSLOptions +FakeBasicAuth
+AuthUserFile /etc/httpd/conf.d/register.fedoraproject.org/passwd
+
+
+<Location /v2>
+  Order deny,allow
+  Allow from all
+  AuthName "Registry Authentication"
+  AuthType Basic
+
+  # Anyone can read
+  <Limit GET HEAD>
+    Require all granted
+  </Limit>
+
+  # Write access to docker-deployer only
+  <Limit POST PUT DELETE>
+    Require valid-user
+  </Limit>
+
+</Location>