查看“︁K8s:搭建镜像加速”︁的源代码

= 生成证书 =
建一个空的网站，指向registry.riguz.com,然后更新证书:

<syntaxhighlight lang="bash">
sudo certbot --apache
</syntaxhighlight>

= 安装Docker =

<syntaxhighlight lang="bash">
sudo apt-get install     ca-certificates     curl     gnupg     lsb-release
curl -fsSL https://download.docker.com/linux/ubuntu/gpg | sudo gpg --dearmor -o /usr/share/keyrings/docker-archive-keyring.gpg
 echo   "deb [arch=$(dpkg --print-architecture) signed-by=/usr/share/keyrings/docker-archive-keyring.gpg] https://download.docker.com/linux/ubuntu \
  $(lsb_release -cs) stable" | sudo tee /etc/apt/sources.list.d/docker.list > /dev/null
sudo apt-get update
sudo apt-get install docker-ce docker-ce-cli containerd.io
</syntaxhighlight>

= 启动镜像 =
<syntaxhighlight lang="bash">
htpasswd -Bbn user xxxxxxxxx> auth/htpasswd
</syntaxhighlight>

<syntaxhighlight lang="yaml">
version: 0.1
log:
  fields:
    service: registry
storage:
  cache:
    blobdescriptor: inmemory
  filesystem:
    rootdirectory: /var/lib/registry
http:
  addr: :5000
  headers:
    X-Content-Type-Options: [nosniff]
health:
  storagedriver:
    enabled: true
    interval: 10s
    threshold: 3
proxy:
  remoteurl : https://gcr.io
</syntaxhighlight>

<syntaxhighlight lang="bash">
docker run -d -p 5000:443 \
    --restart always \
    --name registry  \
    -v /etc/letsencrypt/archive/riguz.com:/certs \
    -v "$(pwd)"/auth:/auth \
    -v "$(pwd)"/config.yml:/etc/docker/registry/config.yml \
    -e "REGISTRY_AUTH=htpasswd" \
    -e "REGISTRY_AUTH_HTPASSWD_REALM=Registry Realm" \
    -e REGISTRY_AUTH_HTPASSWD_PATH=/auth/htpasswd \
    -e REGISTRY_HTTP_ADDR=0.0.0.0:443 \
    -e REGISTRY_HTTP_TLS_CERTIFICATE=/certs/fullchain3.pem \
    -e REGISTRY_HTTP_TLS_KEY=/certs/privkey3.pem \
    registry:latest 
</syntaxhighlight>

= apache 代理 =
<syntaxhighlight lang="bash">
sudo a2enmod proxy
sudo a2enmod proxy_http
</syntaxhighlight>

<pre>
<IfModule mod_ssl.c>
<VirtualHost *:443>
        ServerName registry.riguz.com

        ServerAdmin webmaster@localhost
        DocumentRoot /var/www/registry

        ErrorLog ${APACHE_LOG_DIR}/error.log
        CustomLog ${APACHE_LOG_DIR}/access.log combined

        ProxyPreserveHost On

        SSLProxyEngine on
        ProxyPass / https://127.0.0.1:5000/
        ProxyPassReverse / https://127.0.0.1:5000/
</VirtualHost>
</IfModule>
</pre>

= k3s 使用代理 =
/etc/rancher/k3s/registries.yaml（没有的话自行创建）
<syntaxhighlight lang="yaml">
mirrors:
  gcr.io:
    endpoint:
      - "https://registry.riguz.com/v2"
configs:
  "registry.riguz.com":
    auth:
      username: xxx
      password: xxxxx
</syntaxhighlight>

<syntaxhighlight lang="bash">
sudo systemctl restart k3s.service
sudo systemctl restart k3s-agent.service
</syntaxhighlight>