# Harbor搭建私有鏡像庫服務器(CentOS 7)
## 一、安裝harbor
### docker install
> 在docker上安裝harbor，網上教程非常多，在此不做說明
### kubernetes install
>
## 二、harbor配置Https
### 獲取CA證書
```
openssl req -x509 -new -nodes -sha512 -days 3650 \
-subj "/C=CN/ST=Shanxi/L=XIan/O=webber/OU=Personal/CN=webebr.harbor.com" \
-key ca.key \
-out ca.crt
```
### 獲得服務器證書
- **創建自己的私鑰：**
```
openssl genrsa -out yourdomain.com.key 4096
```
- **生成證書簽名請求:**
```
openssl req -sha512 -new \
-subj "/C=CN/ST=Shanxi/L=XIan/O=webber/OU=Personal/CN=webebr.harbor.com" \
-key webber.harbor.com.key \
-out webber.harbor.com.csr
```
- **生成注冊表主機的證書：**
```
cat > v3.ext <<-EOF
authorityKeyIdentifier=keyid,issuer
basicConstraints=CA:FALSE
keyUsage = digitalSignature, nonRepudiation, keyEncipherment, dataEncipherment
extendedKeyUsage = serverAuth
subjectAltName = @alt_names
[alt_names]
DNS.1=webber.harbor.com
DNS.2=webber.harbor
DNS.3=k8s.harbor
EOF
```
```
openssl x509 -req -sha512 -days 3650 \
-extfile v3.ext \
-CA ca.crt -CAkey ca.key -CAcreateserial \
-in yourdomain.com.csr \
-out yourdomain.com.crt
```
### harbor服務端配置
- 編輯文件`harbor.cfg`，更新主機名和協議，并更新屬性`ssl_cert`和`ssl_cert_key`：
```
#set hostname
hostname = yourdomain.com:port
#set ui_url_protocol
ui_url_protocol = https
......
#The path of cert and key files for nginx, they are applied only the protocol is set to https
ssl_cert = /data/cert/yourdomain.com.crt
ssl_cert_key = /data/cert/yourdomain.com.key
```
- 為Harbor生成配置文件：
~~~
./prepare
~~~
- 如果Harbor已在運行，請停止并刪除現有實例,并重新啟動
~~~
docker-compose down -v
docker-compose up -d
~~~
## 三、docker客戶端配置
### 從服務端復制證書到客戶端
```
mkdir -p /etc/docker/certs.d/yourdomain.com/
cp yourdomain.com.cert /etc/docker/certs.d/yourdomain.com/
cp yourdomain.com.key /etc/docker/certs.d/yourdomain.com/
cp ca.crt /etc/docker/certs.d/yourdomain.com/
```
```
cp yourdomain.com.crt /etc/pki/ca-trust/source/anchors/yourdomain.com.crt
update-ca-trust
systemctl restart docker
```
## 參考：
1. [官方文檔](https://github.com/goharbor/harbor/blob/master/docs/configure_https.md#Troubleshooting)
