前面我介绍了如何使用Cloudflare Workpage构建docker hub代理，那么CF是有请求限制的，如果是个人使用应该还够，如果是公司使用(应该也够)…那么今天的话我就使用Nginx对docker hub进行反代
部署准备
- 国外服务器一台，静态公网IPV4或者NAT都行
- 域名可有可无
部署步骤
安装nginx和docker这边就省流了
1
2
3
4
5
|
sudo apt update && sudo apt install nginx docker.io -y
sudo yum install docker-ce nginx -y
|
制作证书（可有可无）
1
2
3
4
5
6
7
8
9
10
11
12
13
| mkdir /certs && cd /certs
openssl genrsa -out you.key 2048
openssl req -new -key you.key -out you.csr -subj "/C=CN/ST=State/L=City/O=Organization/OU=Department/CN=*.alybaba.top"
openssl x509 -req -in you.csr -signkey you.key -out you.crt -days 3650
|
完事后你的当前目录下就会有证书和key了,下面是Nginx的配置，可以根据自己实际情况进行修改
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
| server {
listen 443 ssl;
server_name registry.alybaba.top;
ssl_certificate /you/path/you.crt;
ssl_certificate_key /you/path/you.key;
root /var/www/html;
index index.html;
location /v2/ {
proxy_pass https://registry-1.docker.io;
proxy_set_header Host registry-1.docker.io;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Proto $scheme;
proxy_buffering off;
proxy_set_header Authorization $http_authorization;
proxy_pass_header Authorization;
proxy_hide_header www-authenticate;
add_header www-authenticate 'Bearer realm="https://registry.alybaba.top/token",service="registry.docker.io"' always;
proxy_intercept_errors on;
recursive_error_pages on;
error_page 301 302 307 = @handle_redirect;
}
location /token {
resolver 1.1.1.1 valid=600s;
proxy_pass https://auth.docker.io;
proxy_set_header Host auth.docker.io;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Proto $scheme;
proxy_set_header Authorization $http_authorization;
proxy_pass_header Authorization;
proxy_buffering off;
}
location @handle_redirect {
resolver 1.1.1.1;
set $saved_redirect_location '$upstream_http_location';
proxy_pass $saved_redirect_location;
}
}
|
同时由于是自签证书需要添加受信任
1
2
3
4
5
6
| sudo tee /etc/docker/daemon.json << EOF
{
"registry-mirrors": ["https://registry.alybaba.top"]
"insecure-registries": ["registry.alybaba.top"]
}
EOF
|
ok，那么到这里，就已经部署完毕了，需要注意的是，如果你不打算加证书，请把相关配置中的https修改成http，IP同理，之后开启对应防火墙的端口即可愉快的进行拉取镜像了，
1
2
3
4
5
6
7
8
9
10
11
|
sudo iptables -IINPUT -p tcp --dport YOU_PORT -j ACCEPT
sudo ufw allow YOU_PORT && ufw reload
sudo nft add table inet filter
sudo nft add chain inet filter input { type filter hook input priority 0 \; }
sudo nft add rule inet filter input tcp dport YOU_PORT accept
sudo firewall-cmd --zone=public --add-port=YOU_PORT/tcp --permanent
sudo firewall-cmd --reload
|
那么经测试，这台圣保罗的机器速度大概10-20m左右…相比于4G的带宽确实有点慢了，不过考虑到圣保罗都在南美了，可以用就ok了，后续我有空再换美国，或者欧洲机器试试
