harbor和docker配置https访问

如果配置了科学上网代理，一定要做免代理的配置，不然https访问会失败。

免代理配置

Docker免代理配置

[root@node1 harbor]#cat /etc/systemd/system/docker.service.d/http-proxy.conf
[Service]
Environment="HTTP_PROXY=http://10.0.0.1:7897"
Environment="HTTPS_PROXY=http://10.0.0.1:7897"
Environment="NO_PROXY=localhost,127.0.0.1,10.0.0.101,qazwsx.wsxedc.com"

重启docker

systemctl daemon-reload
systemctl restart docker

windows科学上网免代理配置

生成自签证书

#!/bin/bashopenssl genrsa -out ca.key 4096
openssl req -x509 -new -nodes -sha512 -days 3650 \-subj "/C=CN/ST=Beijing/L=Beijing/O=example/OU=Personal/CN=RootCA" \-key ca.key \-out ca.crt
openssl genrsa -out qazwsx.wsxedc.com.key 4096
openssl req -sha512 -new \-subj "/C=CN/ST=Beijing/L=Beijing/O=example/OU=Personal/CN=qazwsx.wsxedc.com" \-key qazwsx.wsxedc.com.key \-out qazwsx.wsxedc.com.csr
cat > v3.ext <<-EOF
authorityKeyIdentifier=keyid,issuer
basicConstraints=CA:FALSE
keyUsage = digitalSignature, nonRepudiation, keyEncipherment, dataEncipherment
extendedKeyUsage = serverAuth
subjectAltName = @alt_names[alt_names]
DNS.1=qazwsx.wsxedc.com
EOF
openssl x509 -req -sha512 -days 3650 \-extfile v3.ext \-CA ca.crt -CAkey ca.key -CAcreateserial \-in qazwsx.wsxedc.com.csr \-out qazwsx.wsxedc.com.crt

直接运行上述脚本，ca证书和服务器证书都会生成在当前目录下

Harbor

修改Harbor配置

将harbor的证书配置指向上面刚生成的服务器端证书。

harbor关键配置如下：

# Configuration file of Harbor# The IP address or hostname to access admin UI and registry service.
# DO NOT use localhost or 127.0.0.1, because Harbor needs to be accessed by external clients.
hostname: qazwsx.wsxedc.com# http related config
http:# port for http, default is 80. If https enabled, this port will redirect to https portport: 80# https related config
https:# https port for harbor, default is 443port: 443# The path of cert and key files for nginxcertificate: /root/certificate/qazwsx.wsxedc.com.crtprivate_key: /root/certificate/qazwsx.wsxedc.com.key# enable strong ssl ciphers (default: false)# strong_ssl_ciphers: false

重启harbor

./prepare
docker compose down -v
docker compose up -d

Docker

配置CA证书

创建目录，目录名字有特定要求，必须以域名命令，如果不是443端口还需要加上端口号，默认是443端口，所以一般不需要加。

/etc/docker/certs.d/└── yourdomain.com:port├── yourdomain.com.cert  <-- 客户端证书，用于双向认证中的客户端认证├── yourdomain.com.key   <-- 客户端私钥，用于双向认证中的客户端认证└── ca.crt               <-- CA证书

这里使用的是单项认证，客户端的认证其实已经通过用户名，密码的方式认证了，配置案例如下：

[root@node1 harbor]#ls /etc/docker/certs.d/qazwsx.wsxedc.com/
ca.crt

docker默认会自动加载上述路径中的CA证书。

重启docker

systemctl daemon-reload
systemctl restart docker