1
sudo apt update && sudo apt install -y openssl
2
vim harbor_cert.cnf

1
# 生成私钥 + 自签名证书（有效期 10 年）
2
openssl req -x509 \
3
  -newkey rsa:4096 \
4
  -sha256 \
5
  -days 3650 \
6
  -nodes \
7
  -keyout harbor.key \
8
  -out harbor.crt \
9
  -config harbor_cert.cnf \
10
  -extensions v3_req
11

12
# Docker 客户端信任证书
13
sudo mkdir -p /etc/docker/certs.d/harbor.example.com/
14
sudo cp harbor.crt /etc/docker/certs.d/harbor.example.com/ca.crt

1
cp harbor.yml.tmpl harbor.yml
2
vim harbor.yml

1
./install.sh

1
./prepare
2
docker-compose down
3
docker-compose up -d

1
192.168.2.21 harbor.local

1
# 登录
2
docker login harbor.example.com
3

4
# 打标签
5
docker tag myapp:latest harbor.example.com/myproject/myapp:v1.0.0
6

7
# 推送
8
docker push harbor.example.com/myproject/myapp:v1.0.0
9

10
# 拉取
11
docker pull harbor.example.com/myproject/myapp:v1.0.0

1
upstream harbor_backend {
2
    server 127.0.0.1:5443;
3
    keepalive 32;
4
}
5

6
server {
7
    listen 443 ssl http2;
8
    server_name harbor.local;
9

10
    ssl_certificate     /opt/harbor/crt/harbor.crt;
11
    ssl_certificate_key /opt/harbor/crt/harbor.key;
12
    ssl_protocols       TLSv1.2 TLSv1.3;
13
    ssl_ciphers         ECDHE-RSA-AES128-GCM-SHA256:ECDHE-RSA-AES256-GCM-SHA384;
14

15
    client_max_body_size 0;
16

17
    location / {
18
        proxy_pass https://harbor_backend;
19
        proxy_set_header Host $host;
20
        proxy_set_header X-Real-IP $remote_addr;
21
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
22
        proxy_set_header X-Forwarded-Proto $scheme;
23
        proxy_buffering off;
24
        proxy_request_buffering off;
25
        proxy_connect_timeout 90s;
26
        proxy_send_timeout    90s;
27
        proxy_read_timeout    90s;
28
    }
29
}
30

31
server {
32
    listen 80;
33
    server_name harbor.local;
34
    return 301 https://$host$request_uri;
35
}

1
{
2
  "insecure-registries": ["harbor.example.com"]
3
}

1
systemctl restart docker