Skip to content
This repository has been archived by the owner on Sep 12, 2018. It is now read-only.

Serve a TLS endpoint if REGISTRY_TLS_VERIFY is set and GUNICORN_OPTS is not #693

Open
wants to merge 1 commit into
base: master
Choose a base branch
from
Open

Serve a TLS endpoint if REGISTRY_TLS_VERIFY is set and GUNICORN_OPTS is not #693

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
16 changes: 15 additions & 1 deletion docker_registry/run.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -8,6 +8,7 @@
import getpass
import logging
import os
import ssl
import sys

from .server import env
Expand Down Expand Up @@ -84,7 +85,20 @@ def run_gunicorn():
else:
logger.warn('You asked we drop priviledges, but we are not root!')

args += env.source('GUNICORN_OPTS')
gunicorn_opts = env.source('GUNICORN_OPTS')
if not gunicorn_opts and env.source('REGISTRY_TLS_VERIFY'):
gunicorn_opts = ['--ssl-version', ssl.PROTOCOL_TLSv1]
for k, v in {
'--certfile': '/ssl/registry.cert',
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I don't see the benefit of enforcing these non-standard, default directory paths when simply adding them to GUNICORN_OPTS would suffice and actually provides more flexibility. Otherwise, I'd say make an environment variable for each path.

Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

the same discussion was posted above: #693 (comment)

Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Apologies for the repetition. Let's figure out whether or not we want to break these out so this PR can get merged.

'--keyfile': '/ssl/registry.key',
'--ca-certs': '/ssl/ca.crt'
}.iteritems():
if not os.path.isfile(v):
print("could not find %s" % (v))
sys.exit(1)
gunicorn_opts.append(k, v)

args += gunicorn_opts
args.append('docker_registry.wsgi:application')
# Stringify all args and call
os.execl(*[str(v) for v in args])