mirror of
https://github.com/kevinveenbirkenbach/computer-playbook.git
synced 2026-11-11 21:26:44 +00:00
kevinveenbirkenbachandClaude Opus 4.7
1dd8d3f5c0
Introduces a `registry-cache` service (rpardini/docker-registry-proxy) in the `ci` profile that MITM-caches every outbound docker registry pull made by `infinito`'s inner dockerd, drastically cutting bandwidth on re-deploys, parallel CI shards, and local fresh-purges. Wiring (all bind-mounted via compose.yml, no Dockerfile or entry.sh staging, so edits hot-reload on next container start): - CA bundle at /opt/registry-cache-ca (read-only), - systemd drop-in at /etc/systemd/system/docker.service.d/registry-cache-proxy.conf, - registry-cache-ca.sh at /usr/local/bin/registry-cache-ca.sh. The drop-in registers registry-cache-ca.sh as ExecStartPre. Compose gates `infinito` on `registry-cache` `service_healthy` so the CA is on disk before dockerd boots; the install script supports both Debian (`update-ca-certificates`) and Arch/Fedora (`update-ca-trust extract`) trust stores, detected by command availability. Also reorganizes compose/ into per-service subdirectories (compose/coredns/, compose/registry-cache/) with README.md per directory following the documentation guidelines, adds scripts/docker/README.md, and nests the registry-cache host paths under /tmp/infinito/core/ (mirror/ for blobs, ca/ for the MITM CA bundle). Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
17 lines
854 B
Plaintext
17 lines
854 B
Plaintext
[Service]
|
|
# Route every outbound docker registry pull through the registry-cache
|
|
# MITM proxy (see compose.yml `registry-cache` service). The proxy
|
|
# performs SSL bumping; the CA cert must be installed first by
|
|
# registry-cache-ca.sh (ExecStartPre below).
|
|
#
|
|
# Catch-all by design: rpardini/docker-registry-proxy intercepts traffic
|
|
# to any registry the inner dockerd pulls from (docker.io, ghcr.io,
|
|
# quay.io, …) and caches blobs/manifests so re-deploys, parallel CI
|
|
# shards, and local fresh-purges do not trigger live registry round-trips.
|
|
#
|
|
# Pulls only — pushes are not intercepted by rpardini's proxy.
|
|
Environment="HTTP_PROXY=http://infinito-registry-cache:3128"
|
|
Environment="HTTPS_PROXY=http://infinito-registry-cache:3128"
|
|
Environment="NO_PROXY=localhost,127.0.0.1,::1,infinito-registry-cache"
|
|
ExecStartPre=/usr/local/bin/registry-cache-ca.sh
|