Nexus3 的 group
仓库推送镜像功能属于 Pro 版本权限。为实现私有镜像管理,我们可以通过 Docker API 请求类型区分来转发请求,借助 Nginx 实现不同请求的转发至相应仓库。
仓库配置
以下为仓库配置截图:
nginx配置
client_max_body_size 1G;
proxy_send_timeout 120;
proxy_read_timeout 300;
proxy_buffering off;
proxy_request_buffering off;
tcp_nodelay on;
map $request_method $backend {
default http://nexus/repository/docker-group;
PUT http://nexus/repository/docker-hosted;
}
server {
listen 80;
server_name _;
# 强制HTTPS
return 301 https://$host$request_uri;
}
server {
keepalive_timeout 5 5;
listen 443 ssl;
server_name repo.niconi.cn;
ssl_certificate /etc/nginx/ssl/cert.pem;
ssl_certificate_key /etc/nginx/ssl/key.pem;
ssl_protocols TLSv1.2 TLSv1.3;
ssl_ciphers 'ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384';
ssl_prefer_server_ciphers on;
ssl_session_cache shared:SSL:10m;
ssl_session_timeout 10m;
# 匹配上传请求
location ~ ^/v2/.+/blobs/uploads/ {
proxy_set_header Host $host:$server_port;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Proto "https";
proxy_pass http://nexus/repository/docker-hosted$request_uri;
}
location /v2 {
proxy_set_header Host $host:$server_port;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Proto "https";
proxy_pass $backend$request_uri;
}
location /v1 {
proxy_set_header Host $host:$server_port;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Proto "https";
proxy_pass $backend$request_uri;
}
# Regular Nexus requests
location / {
proxy_set_header Host $host:$server_port;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Proto "https";
proxy_pass http://nexus/;
}
}
说明
- 请求类型映射:通过
$request_method
将 PUT 请求定向至docker-hosted
仓库,其他请求则转发至docker-group
仓库。、 - SSL 配置:采用 TLSv1.2 和 TLSv1.3 协议,使用高强度加密算法,提高传输安全性。
- 特定请求路径:
/v2/.+/blobs/uploads/
匹配 Docker 上传请求,并将其转发至docker-hosted
仓库,以保证镜像上传的稳定性。 - 一般请求:其他所有请求默认转发至 Nexus。