Hi all,
This is my first time using Caddy, my apologies if I’m missing something simple.
I’m trying to host a Docker Registry, exposing it to the internet through a Caddy reverse proxy and letting Caddy take care of the TLS.
When testing it locally, I am able to log in to the registry through Caddy if I don’t configure TLS but unable to log in if I set tls self_signed.
I’m using @abiosoft’s Docker image, version 0.11.0-no-stats. You can demo my setup like this:
docker-compose.yml
version: '3'
services:
registry:
image: "registry:2"
environment:
REGISTRY_AUTH: "htpasswd"
REGISTRY_AUTH_HTPASSWD_REALM: "registry"
REGISTRY_AUTH_HTPASSWD_PATH: "/auth/htpasswd"
expose:
- "5000"
volumes:
- "./htpasswd:/auth/htpasswd"
caddy:
image: "abiosoft/caddy:0.11.1-no-stats"
ports:
- "5000:5000"
volumes:
- "./Caddyfile:/etc/Caddyfile"
htpasswd (username is username, password is password)
username:$2y$05$FxK7/4gaE44qBir2fOaG.eDjD/LQ2qCkxMQN2E4tYQbi1Ffoqux2.
Caddyfile
127.0.0.1:5000 {
proxy /v2 registry:5000 {
transparent
}
tls self_signed
}
After bringing everything up with $ docker-compose up -d I see:
$ docker login 127.0.0.1:5000
Authenticating with existing credentials...
Login did not succeed, error: Error response from daemon: Get http://127.0.0.1:5000/v2/: net/http: HTTP/1.x transport connection broken: malformed HTTP response "\x15\x03\x01\x00\x02\x02"
Username (username): username
Password:
Error response from daemon: Get http://127.0.0.1:5000/v2/: net/http: HTTP/1.x transport connection broken: malformed HTTP response "\x15\x03\x01\x00\x02\x02"
$ docker-compose logs
Attaching to caddy-docker-self-signed_caddy_1, caddy-docker-self-signed_registry_1
caddy_1 | Activating privacy features... done.
caddy_1 | https://127.0.0.1:5000
caddy_1 | 2019/03/26 02:52:36 https://127.0.0.1:5000
caddy_1 | 2019/03/26 02:52:42 http: TLS handshake error from 172.28.0.1:47604: tls: no certificates configured
caddy_1 | 2019/03/26 02:52:42 http: TLS handshake error from 172.28.0.1:47608: tls: first record does not look like a TLS handshake
caddy_1 | 2019/03/26 02:52:45 http: TLS handshake error from 172.28.0.1:47612: tls: no certificates configured
caddy_1 | 2019/03/26 02:52:45 http: TLS handshake error from 172.28.0.1:47616: tls: first record does not look like a TLS handshake
registry_1 | time="2019-03-26T02:52:36.511882389Z" level=warning msg="No HTTP secret provided - generated random secret. This may cause problems with uploads if multiple registries are behind a load-balancer. To provide a shared secret, fill in http.secret in the configuration file or set the REGISTRY_HTTP_SECRET environment variable." go.version=go1.11.2 instance.id=9a0dc0e1-a5af-46c4-b85f-aa57777a60c2 service=registry version=v2.7.1
registry_1 | time="2019-03-26T02:52:36.512079129Z" level=info msg="redis not configured" go.version=go1.11.2 instance.id=9a0dc0e1-a5af-46c4-b85f-aa57777a60c2 service=registry version=v2.7.1
registry_1 | time="2019-03-26T02:52:36.512162748Z" level=info msg="Starting upload purge in 57m0s" go.version=go1.11.2 instance.id=9a0dc0e1-a5af-46c4-b85f-aa57777a60c2 service=registry version=v2.7.1
registry_1 | time="2019-03-26T02:52:36.523217223Z" level=info msg="using inmemory blob descriptor cache" go.version=go1.11.2 instance.id=9a0dc0e1-a5af-46c4-b85f-aa57777a60c2 service=registry version=v2.7.1
registry_1 | time="2019-03-26T02:52:36.523505487Z" level=info msg="listening on [::]:5000" go.version=go1.11.2 instance.id=9a0dc0e1-a5af-46c4-b85f-aa57777a60c2 service=registry version=v2.7.1
However, if I remove the tls self_signed line logging in to the registry works fine.
I’ve tried different variations on specifying https:// or http:// in the login command, label, and proxy statement without any luck. My configuration looks almost identical to this post’s solution - is it perhaps the difference of using self_signed that’s breaking it for me? That I’m using Docker Registry’s auth? That it’s running on localhost?
Any advice is appreciated. Thanks!
