bf9d98a0d5
- Upgrade registry to 3.0.0 (new config path, redis addrs) - Generate htpasswd with bcrypt cost 5; cost 12 added ~350ms per request - Route /v2 straight to the registry instead of through the UI's nginx Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
31 lines
1.0 KiB
YAML
31 lines
1.0 KiB
YAML
---
|
|
- name: 'Copy config for "{{ service }}"'
|
|
template:
|
|
src: "{{ service_path }}/config/config.yml"
|
|
dest: "{{ remote_service_path }}/config/config.yml"
|
|
register: registry_config
|
|
tags:
|
|
- config
|
|
|
|
# Registry checks the bcrypt hash on every request, so a low cost keeps it fast.
|
|
# Salt is derived from the user name to keep the file stable between runs.
|
|
- name: 'Generate passwords file for "{{ service }}"'
|
|
ansible.builtin.copy:
|
|
dest: "{{ remote_service_path }}/config/htpasswd"
|
|
content: |
|
|
{% for registry_user in registry_users %}
|
|
{{ registry_user.name }}:{{ registry_user.password | password_hash('bcrypt', salt=((service ~ ':' ~ registry_user.name) | hash('sha256'))[:22], rounds=registry_bcrypt_rounds) }}
|
|
{% endfor %}
|
|
mode: "0600"
|
|
no_log: true
|
|
tags:
|
|
- config
|
|
|
|
- name: 'Compute config hash for passwords file of "{{ service }}"'
|
|
ansible.builtin.stat:
|
|
path: "{{ remote_service_path }}/config/htpasswd"
|
|
get_mime: no
|
|
get_attributes: no
|
|
get_checksum: yes
|
|
register: registry_htpasswd
|