Infrastructure/ansible
3
0
Fork 0
Code Issues Pull requests 6 Projects Releases Packages Wiki Activity Actions

docker-registry-proxy: fix up vhost template

Browse source 
Signed-off-by: Adam Miller <admiller@redhat.com>
This commit is contained in:
Adam Miller 2016-04-11 20:30:48 +00:00
parent 7f33a1326c
commit 6270866530
1 changed files with 23 additions and 16 deletions
Download patch file Download diff file Expand all files Collapse all files

39
roles/docker-distribution-proxy/templates/docker-registry-vhost.conf.j2
View file

@ -1,3 +1,4 @@
Listen 443
<VirtualHost *:443> <VirtualHost *:443>
ServerName {{ servername }} ServerName {{ servername }}
@ -30,19 +31,15 @@
ProxyPass /v2 http://localhost:5000/v2 ProxyPass /v2 http://localhost:5000/v2
ProxyPassReverse /v2 http://localhost:5000/v2 ProxyPassReverse /v2 http://localhost:5000/v2
ProxyPass /_ping http://localhost:5000/_ping
ProxyPassReverse /_ping http://localhost:5000/_ping
# Allow ping to run unauthenticated.
<Location /_ping>
Satisfy any
Allow from all
</Location>
{% if auth.type == "ssl" %} {% if auth.type == "ssl" %}
SSLVerifyClient none SSLVerifyClient optional
SSLCACertificateFile {{ auth.ssl.destdir }}/{{ auth.ssl.authca_dest }} SSLVerifyDepth 1
SSLCACertificateFile {{ auth.ssl.destdir}}/{{ auth.ssl.clientca_dest }}
SSLOptions +StdEnvVars
SSLVerifyClient none
SSLCACertificateFile {{ auth.ssl.destdir }}/{{ auth.ssl.authca_dest }}
{% endif %} {% endif %}
<Location /v2> <Location /v2>
Order deny,allow Order deny,allow
Allow from all Allow from all
@ -50,11 +47,6 @@
AuthName "Registry Authentication" AuthName "Registry Authentication"
AuthType basic AuthType basic
AuthUserFile {{ auth.basic.destdir }}/{{ auth.basic.userfile_dest }} AuthUserFile {{ auth.basic.destdir }}/{{ auth.basic.userfile_dest }}
{% endif %}
{% if auth.type == "ssl" %}
SSLVerifyClient require
SSLVerifyDepth 1
{% endif %}
## Read access to authentified users ## Read access to authentified users
#<Limit GET HEAD> #<Limit GET HEAD>
@ -65,7 +57,22 @@
<Limit POST PUT DELETE PATCH> <Limit POST PUT DELETE PATCH>
Require valid-user Require valid-user
</Limit> </Limit>
{% endif %}
{% if auth.type == "ssl" %}
SSLVerifyClient require
SSLVerifyDepth 1
## Read access to authentified users
#<Limit GET HEAD>
# Require valid-user
#</Limit>
# Write access restricted
<Limit POST PUT DELETE PATCH>
Require expr %{SSL_CLIENT_VERIFY} == "SUCCESS"
</Limit>
{% endif %}
</Location> </Location>
</VirtualHost> </VirtualHost>