Deploy the registry multi-tenant in staging

Signed-off-by: Patrick Uiterwijk <patrick@puiterwijk.org>

playbooks/include/proxies-reverseproxy.yml

@@ -545,7 +545,14 @@
 
   - role: httpd/reverseproxy
     website: registry.fedoraproject.org
-    destname: registry
+    destname: registry-fedora
+    # proxyurl in this one is totally ignored, because Docker.
+    # (turns out it uses PATCH requests that Varnish cannot deal with)
+    proxyurl: "{{ varnish_url }}"
+
+  - role: httpd/reverseproxy
+    website: registry.centos.org
+    destname: registry-centos
     # proxyurl in this one is totally ignored, because Docker.
     # (turns out it uses PATCH requests that Varnish cannot deal with)
     proxyurl: "{{ varnish_url }}"

playbooks/include/proxies-websites.yml

@@ -568,6 +568,12 @@
     sslonly: true
     cert_name: "{{wildcard_cert_name}}"
 
+  - role: httpd/website
+    name: registry.centos.org
+    server_aliases: [registry.stg.centos.org]
+    sslonly: true
+    cert_name: "{{wildcard_cert_name}}"
+
   - role: httpd/website
     name: candidate-registry.fedoraproject.org
     server_aliases: [candidate-registry.stg.fedoraproject.org]

roles/httpd/reverseproxy/templates/reversepassproxy.registry-fedora.conf

@@ -0,0 +1,33 @@
+RewriteEngine on
+
+RewriteRule ^/v2/latest/(.*) /v2/f27/$1 [R,L]
+
+{% if env == "staging" %}
+RewriteRule ^/v2/(.*) /v2/fedora/$1
+{% endif %}
+
+RewriteRule ^/signatures/(.*) /srv/web/registry-signatures/$1 [L]
+
+<Directory /srv/web/registry-signatures>
+    Require all granted
+</Directory>
+
+{% include './reversepassproxy.registry-generic.conf' %}
+
+# Write access to docker-deployer only
+{% if env == "staging" %}
+  <Location /v2/fedora>
+    <LimitExcept GET HEAD>
+      Require user docker-registry-internal-stg
+    </LimitExcept>
+  </Location>
+  <Location /v2/centos>
+    Require all denied
+  </Location>
+
+{% else %}
+
+  <Location /v2>
+    require valid-user
+  </Location>
+{% endif %}

roles/httpd/reverseproxy/templates/reversepassproxy.registry-generic.conf

@@ -0,0 +1,34 @@
+RequestHeader set X-Forwarded-Scheme https early
+RequestHeader set X-Scheme https early
+RequestHeader set X-Forwarded-Proto https early
+ProxyPreserveHost On
+
+
+{% if env == "production" %}
+RewriteCond %{HTTP:VIA} !cdn77
+RewriteCond %{REQUEST_METHOD} !^(PATCH|POST|PUT|DELETE|HEAD)$
+RewriteRule ^/v2/(.*)/blobs/([a-zA-Z0-9:]*) https://cdn.registry.fedoraproject.org/v2/$1/blobs/$2 [R]
+{% endif %}
+
+# This is terible, but Docker.
+RewriteCond %{REQUEST_METHOD} ^(PATCH|POST|PUT|DELETE)$
+RewriteRule ^/v2/(.*)$ http://docker-registry02:5000/v2/$1 [P,L]
+RewriteRule ^/v2/(.*)$ http://localhost:6081/v2/$1 [P,L]
+
+DocumentRoot /srv/web/registry-index/
+
+<Directory /srv/web/registry-index>
+    Require all granted
+</Directory>
+
+SSLVerifyClient optional
+SSLVerifyDepth 1
+SSLCACertificateFile /etc/pki/httpd/registry-ca-{{env}}.cert
+SSLOptions +FakeBasicAuth
+
+
+<Location /v2>
+  AuthName "Registry Authentication"
+  AuthType Basic
+  AuthUserFile /etc/httpd/conf.d/registry.fedoraproject.org/passwd
+</Location>

roles/httpd/reverseproxy/templates/reversepassproxy.registry.conf

@@ -1,80 +0,0 @@
-RequestHeader set X-Forwarded-Scheme https early
-RequestHeader set X-Scheme https early
-RequestHeader set X-Forwarded-Proto https early
-ProxyPreserveHost On
-
-RewriteEngine on
-RewriteRule ^/signatures/(.*) /srv/web/registry-signatures/$1 [L]
-
-{% if env == "staging" %}
-RewriteCond %{HTTP_HOST} "registry{{env_suffix}}.fedoraproject.org"
-RewriteRule ^/v2/(.*) /v2/fedora/$1
-
-RewriteCond %{HTTP_HOST} "registry{{env_suffix}}.centos.org"
-RewriteRule ^/v2/(.*) /v2/centos/$1
-{% endif %}
-
-
-RewriteRule ^/v2/fedora/latest/(.*) /v2/fedora/f27/$1 [R,L]
-
-{% if env == "production" %}
-RewriteCond %{HTTP:VIA} !cdn77
-RewriteCond %{REQUEST_METHOD} !^(PATCH|POST|PUT|DELETE|HEAD)$
-RewriteRule ^/v2/(.*)/blobs/([a-zA-Z0-9:]*) https://cdn.registry.fedoraproject.org/v2/$1/blobs/$2 [R]
-{% endif %}
-
-# This is terible, but Docker.
-RewriteCond %{REQUEST_METHOD} ^(PATCH|POST|PUT|DELETE)$
-RewriteRule ^/v2/(.*)$ http://docker-registry02:5000/v2/$1 [P,L]
-RewriteRule ^/v2/(.*)$ http://localhost:6081/v2/$1 [P,L]
-
-DocumentRoot /srv/web/registry-index/
-
-<Directory /srv/web/registry-index>
-    Require all granted
-</Directory>
-
-SSLVerifyClient optional
-SSLVerifyDepth 1
-SSLCACertificateFile /etc/pki/httpd/registry-ca-{{env}}.cert
-SSLOptions +FakeBasicAuth
-
-<Directory /srv/web/registry-signatures>
-    Require all granted
-</Directory>
-
-
-<Location /v2>
-  Order deny,allow
-  Allow from all
-  AuthName "Registry Authentication"
-  AuthType Basic
-  AuthUserFile /etc/httpd/conf.d/registry.fedoraproject.org/passwd
-
-  # Anyone can read
-  <Limit GET HEAD>
-    Require all granted
-  </Limit>
-</Location>
-
-# Write access to docker-deployer only
-{% if env == "staging" %}
-  <Location /v2/fedora>
-    <Limit POST PUT DELETE>
-      Require user docker-registry-internal-stg
-    </Limit>
-  </Location>
-
-  <Location /v2/centos>
-    <Limit POST PUT DELETE>
-      Require user docker-registry-centos-stg
-    </Limit>
-  </Location>
-  <Location /v2>
-    Require all denied
-  </Location>
-{% else %}
-  <Location /v2>
-    require valid-user
-  </Location>
-{% endif %}