build image

2025-11-29 19:51:15 +01:00
parent c688eefe0b
commit a4b7d3c738
177 changed files with 2018 additions and 23366 deletions
--- a/scripts/generate-registry-cert.sh
+++ b/scripts/generate-registry-cert.sh
@@ -0,0 +1,145 @@
+#!/bin/bash
+# generate-registry-cert.sh
+# Script per generare certificati self-signed corretti per Docker Registry
+# con Subject Alternative Names (SANs)
+
+set -e
+
+# Parametri
+REGISTRY_IP=${1:-"192.168.1.204"}
+REGISTRY_HOSTNAME=${2:-"registry.local"}
+CERT_DIR=${3:-"/opt/docker-registry/certs"}
+CERT_DAYS=${4:-365}
+
+# Colors
+RED='\033[0;31m'
+GREEN='\033[0;32m'
+YELLOW='\033[1;33m'
+BLUE='\033[0;34m'
+NC='\033[0m'
+
+print_success() { echo -e "${GREEN}✓ $1${NC}"; }
+print_error() { echo -e "${RED}✗ $1${NC}"; }
+print_info() { echo -e "${BLUE}ℹ $1${NC}"; }
+
+if [ "$#" -eq 0 ]; then
+    echo "Uso: $0 [registry_ip] [registry_hostname] [cert_dir] [days]"
+    echo ""
+    echo "Parametri opzionali:"
+    echo "  registry_ip       - IP del registry (default: 192.168.1.204)"
+    echo "  registry_hostname - Hostname del registry (default: registry.local)"
+    echo "  cert_dir          - Directory certificati (default: /opt/docker-registry/certs)"
+    echo "  days              - Validità in giorni (default: 365)"
+    echo ""
+    echo "Esempio:"
+    echo "  $0 192.168.1.204 registry.local"
+    exit 0
+fi
+
+print_info "Generazione certificato self-signed per Docker Registry"
+echo ""
+print_info "Configurazione:"
+print_info "  IP: $REGISTRY_IP"
+print_info "  Hostname: $REGISTRY_HOSTNAME"
+print_info "  Directory: $CERT_DIR"
+print_info "  Validità: $CERT_DAYS giorni"
+echo ""
+
+# Crea directory se non esiste
+mkdir -p "$CERT_DIR"
+
+# File di output
+KEY_FILE="$CERT_DIR/domain.key"
+CERT_FILE="$CERT_DIR/domain.crt"
+CSR_FILE="$CERT_DIR/domain.csr"
+CNF_FILE="$CERT_DIR/openssl.cnf"
+
+# Crea file di configurazione OpenSSL con SANs
+cat > "$CNF_FILE" << EOF
+[req]
+default_bits       = 4096
+distinguished_name = req_distinguished_name
+req_extensions     = req_ext
+x509_extensions    = v3_ca
+prompt             = no
+
+[req_distinguished_name]
+C  = IT
+ST = Italy
+L  = City
+O  = Docker Registry
+OU = IT Department
+CN = $REGISTRY_HOSTNAME
+
+[req_ext]
+subjectAltName = @alt_names
+
+[v3_ca]
+subjectAltName = @alt_names
+basicConstraints = critical, CA:TRUE
+keyUsage = critical, digitalSignature, keyEncipherment, keyCertSign
+extendedKeyUsage = serverAuth
+
+[alt_names]
+DNS.1 = $REGISTRY_HOSTNAME
+DNS.2 = localhost
+IP.1  = $REGISTRY_IP
+IP.2  = 127.0.0.1
+EOF
+
+print_info "File di configurazione creato: $CNF_FILE"
+
+# Genera chiave privata e certificato
+print_info "Generazione chiave privata e certificato..."
+
+openssl req -newkey rsa:4096 \
+    -nodes \
+    -sha256 \
+    -keyout "$KEY_FILE" \
+    -x509 \
+    -days "$CERT_DAYS" \
+    -config "$CNF_FILE" \
+    -out "$CERT_FILE"
+
+print_success "Certificato generato con successo!"
+echo ""
+
+# Verifica certificato
+print_info "Verifica certificato:"
+openssl x509 -in "$CERT_FILE" -text -noout | grep -A 3 "Subject Alternative Name"
+
+echo ""
+print_info "File generati:"
+print_info "  Chiave privata: $KEY_FILE"
+print_info "  Certificato:    $CERT_FILE"
+print_info "  Config OpenSSL: $CNF_FILE"
+echo ""
+
+print_info "Prossimi passi:"
+print_info ""
+print_info "1. Riavvia il registry Docker con i nuovi certificati:"
+echo "   docker stop registry && docker rm registry"
+echo "   docker run -d \\"
+echo "     -p 5000:5000 \\"
+echo "     --name registry \\"
+echo "     --restart=always \\"
+echo "     -v $CERT_DIR:/certs \\"
+echo "     -v /opt/docker-registry/data:/var/lib/registry \\"
+echo "     -e REGISTRY_HTTP_TLS_CERTIFICATE=/certs/domain.crt \\"
+echo "     -e REGISTRY_HTTP_TLS_KEY=/certs/domain.key \\"
+echo "     registry:2"
+echo ""
+
+print_info "2. Installa il certificato sui client Docker:"
+echo "   # Su ogni VM che deve accedere al registry:"
+echo "   sudo mkdir -p /etc/docker/certs.d/$REGISTRY_IP:5000"
+echo "   sudo scp root@$REGISTRY_IP:$CERT_FILE /etc/docker/certs.d/$REGISTRY_IP:5000/ca.crt"
+echo "   sudo systemctl restart docker"
+echo ""
+
+print_info "3. (Opzionale) Installa nel sistema per curl/wget:"
+echo "   sudo cp $CERT_FILE /usr/local/share/ca-certificates/registry.crt"
+echo "   sudo update-ca-certificates"
+echo ""
+
+print_success "Setup completato!"