forked from Accenture/adop-nginx
-
Notifications
You must be signed in to change notification settings - Fork 0
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
Created nginx registry config file to have ability use trusted Docker…
… registry inside the Core.
- Loading branch information
root
authored and
neb0t
committed
May 27, 2016
1 parent
8a02e3a
commit 50b604d
Showing
1 changed file
with
42 additions
and
0 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Original file line number | Diff line number | Diff line change |
---|---|---|
@@ -0,0 +1,42 @@ | ||
server { | ||
listen 443; | ||
server_name ~^registry*; | ||
server_tokens off; | ||
|
||
auth_ldap "Forbidden"; | ||
auth_ldap_servers adop; | ||
|
||
client_max_body_size 0; | ||
|
||
ssl on; | ||
ssl_certificate /etc/nginx/ssl/fullchain.pem; | ||
ssl_certificate_key /etc/nginx/ssl/privkey.pem; | ||
|
||
ssl_ciphers "ECDHE-RSA-AES256-GCM-SHA384:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-RSA-AES256-SHA384:ECDHE-RSA-AES128-SHA256:ECDHE-RSA-AES256-SHA:ECDHE-RSA-AES128-SHA:ECDHE-RSA-DES-CBC3-SHA:AES256-GCM-SHA384:AES128-GCM-SHA256:AES256-SHA256:AES128-SHA256:AES256-SHA:AES128-SHA:DES-CBC3-SHA:!aNULL:!eNULL:!EXPORT:!DES:!MD5:!PSK:!RC4"; | ||
ssl_protocols TLSv1 TLSv1.1 TLSv1.2; | ||
ssl_prefer_server_ciphers on; | ||
ssl_session_cache shared:SSL:10m; | ||
ssl_session_timeout 5m; | ||
|
||
access_log /var/log/nginx/registry_access.log; | ||
error_log /var/log/nginx/registry_error.log; | ||
|
||
|
||
location / { | ||
gzip off; | ||
|
||
proxy_read_timeout 300; | ||
proxy_connect_timeout 300; | ||
proxy_redirect off; | ||
|
||
proxy_set_header Host $http_host; | ||
proxy_set_header X-Real-IP $remote_addr; | ||
proxy_set_header X-Forwarded-Ssl on; | ||
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; | ||
proxy_set_header X-Forwarded-Proto $scheme; | ||
proxy_set_header X-Frame-Options SAMEORIGIN; | ||
|
||
proxy_pass https://registry:5000; | ||
} | ||
|
||
} |