#!/bin/bash
set -e
# === Functions ===
function get_input() {
local PROMPT="$1"
local VARIABLE_NAME="$2"
local OUTPUT
read -r -p "$PROMPT " OUTPUT
eval "$VARIABLE_NAME='$OUTPUT'"
}
# === Variables ===
get_input "Enter the registry host IP address" "REGISTRY_HOST"
get_input "Enter the registry domain" "REGISTRY_DOMAIN"
get_input "Enter the username" "USERNAME"
get_input "Enter the password" "PASSWORD"
CERT_DIR="$HOME/certs"
AUTH_DIR="$HOME/auth"
DATA_DIR="$HOME/registry-data"
OPENSSL_CONF="$CERT_DIR/openssl.conf"
echo "[INFO] Using registry password: $PASSWORD"
echo "[Step 1] Installing dependencies..."
sudo apt update && sudo apt -y install docker.io jq apache2-utils
sudo chown "$USER" /var/run/docker.sock
echo "[Step 2] Creating certs directory..."
mkdir -p "$CERT_DIR"
cd "$CERT_DIR"
echo "[Step 2.1] Writing OpenSSL config..."
cat << EOF > "$OPENSSL_CONF"
[req]
distinguished_name = req_distinguished_name
prompt = no
x509_extensions = ca_x509_extensions
[ca_x509_extensions]
basicConstraints = CA:TRUE
keyUsage = cRLSign, keyCertSign
[req_distinguished_name]
C = US
ST = Washington
L = Seattle
CN = CA
[registry]
distinguished_name = registry_distinguished_name
prompt = no
req_extensions = registry_req_extensions
[registry_distinguished_name]
C = US
ST = Washington
L = Seattle
CN = $REGISTRY_DOMAIN
[registry_req_extensions]
basicConstraints = CA:FALSE
extendedKeyUsage = clientAuth, serverAuth
keyUsage = critical, digitalSignature, keyEncipherment
nsCertType = client, server
nsComment = "Docker Registry Certificate"
subjectAltName = DNS:$REGISTRY_DOMAIN
subjectKeyIdentifier = hash
EOF
echo "[Step 2.2] Generating CA key and cert..."
openssl genrsa -out ca.key 4096
openssl req -x509 -new -sha512 -noenc -key ca.key -days 3653 -config "$OPENSSL_CONF" -out ca.crt
echo "[Step 2.3] Generating registry key and cert signed by CA..."
openssl genrsa -out registry.key 4096
openssl req -new -key registry.key -sha256 -config "$OPENSSL_CONF" -section registry -out registry.csr
openssl x509 -req -days 3653 -in registry.csr -copy_extensions copyall -sha256 \
-CA ca.crt -CAkey ca.key -CAcreateserial -out registry.crt
cd ~
echo "[Step 3] Setting up authentication..."
mkdir -p "$AUTH_DIR"
htpasswd -Bc "$AUTH_DIR/htpasswd" "$USERNAME" <<< "$PASSWORD"
echo "[Step 4] Creating data directory..."
mkdir -p "$DATA_DIR"
echo "[Step 5] Running Docker registry..."
docker rm -f registry || true
docker run -d \
--restart=always \
--name registry \
-v "$CERT_DIR:/certs" \
-v "$AUTH_DIR:/auth" \
-v "$DATA_DIR:/var/lib/registry" \
-e REGISTRY_AUTH=htpasswd \
-e REGISTRY_AUTH_HTPASSWD_REALM="Registry Realm" \
-e REGISTRY_AUTH_HTPASSWD_PATH=/auth/htpasswd \
-e REGISTRY_HTTP_ADDR=0.0.0.0:443 \
-e REGISTRY_HTTP_TLS_CERTIFICATE=/certs/registry.crt \
-e REGISTRY_HTTP_TLS_KEY=/certs/registry.key \
-p 443:443 \
registry:2
echo "[Step 6] Adding CA cert to system trust..."
sudo cp "$CERT_DIR/ca.crt" /usr/local/share/ca-certificates
sudo update-ca-certificates
echo "[Step 7] Verifying registry..."
sleep 3
curl -u "$USERNAME:$PASSWORD" "https://$REGISTRY_DOMAIN/v2/_catalog" || true
echo "✅ Private Docker Registry setup complete!"
echo " URL: https://$REGISTRY_DOMAIN"
echo " User: $USERNAME"
echo " Password: $PASSWORD"
