DASTAGG.com (Posts about devops)

Setup Docker Registry on RPi

dastagg — Tue, 07 Dec 2021 05:00:00 GMT

The goal: Set up a local Docker Registry so that when the GitLab CI does it's thing, it is not constantly downloading the images over the Internet saving time and bandwidth.

Overview:

Server:

Raspberry Pi Model 3B+
Raspberry OS (2021-10-30-raspios-bullseye-armhf-lite)
hostname = dhub so hostname -f = dhub.example.com
using "pi" as the user
Note: using example.com as domain, change that to the correct domain where needed

Computer:

In this case: OS is ArcoLinux
Docker is already installed and working

Setup the Server:

Install Raspberry OS (search for instructions on internet)

sudo apt install vim

Update to use static IP instead of DHCP (search for instructions on internet) (hint: sudo vim /etc/dhcpcd.conf)

Since I am using PiHole for the DNS server, ssh into PiHole and add DNS entry to /etc/pihole/custom.list and restart DNS

Install and setup Docker Registry.

Install Docker:

curl -fsSL get.docker.com -o get-docker.sh

sh get-docker.sh

sudo usermod -aG docker pi

logout/login

Check if it works:

docker ps

and/or

docker images

Both should display just the report header.

Setup a more secure system:

At $HOME

Create a directory to hold the certificates:

mkdir certs

Create a cert:

openssl req \
  -newkey rsa:4096 -nodes -sha256 -keyout certs/domain.key \
  -addext "subjectAltName = DNS:dhub.example.com" \
  -x509 -days 365 -out certs/domain.crt

Answer the questions it will ask.

Note: the cert will expire in 365 days! Will need to renew in a year.

Start Docker Registry with a run command: (This will pull the Registry image from Docker Hub and start it)

docker run -d \
  --restart=always \
  --name registry \
  -v "$(pwd)"/certs:/certs \
  -e REGISTRY_PROXY_REMOTEURL="https://registry-1.docker.io" \
  -e REGISTRY_HTTP_ADDR=0.0.0.0:443 \
  -e REGISTRY_HTTP_TLS_CERTIFICATE=/certs/domain.crt \
  -e REGISTRY_HTTP_TLS_KEY=/certs/domain.key \
  -p 443:443 \
  registry:2

The certs on Server and Computer must match.

(Again, for this example, the computer is running Arch Linux, there may be a different process for other OS's.)

Copy the domain.crt from $HOME/certs on Server to Computer.

On Computer: copy domain.crt to /etc/ca-certificates/trust-source/anchors/ and it must have a .crt extension.

sudo trust extract-compat

Also on Computer:

sudo vim /etc/docker/daemon.json

Add the following line:

{
  "registry-mirrors": ["https://dhub.example.com"]
}

Restart docker on Computer.

sudo systemctl restart docker

And then test it.

run:

curl https://dhub.example.com/v2/_catalog

Since this is the first time, it should be an empty list.

Select an image from Docker Hub and pull it:

docker pull <new image>

curl https://dhub.example.com/v2/_catalog

should display the new image stored on Server.

Install Fossil-SCM on a Raspberry Pi

dastagg — Tue, 07 Jan 2020 21:25:22 GMT

There is a Tutorial for this.

The instructions might be useful on a different OS but this tutorial uses Raspian(Debian) and Apache for the webserver.

Use PiHole as LAN DNS Server

dastagg — Sun, 05 Jan 2020 21:03:31 GMT

UPDATED: 2020-08-04.

With the update to V5, there is a file already installed to accept domain/ip addresses.

It is located at /etc/pihole/custom.list.

Be careful when adding entries. NO TABS or Multiple spaces or just the hostname.

Normally, a hosts file would look like:

192.168.1.100 ctrl.example.com ctrl

But in the custom.list file, it MUST look like:

192.168.0.100 ctrl.example.com

When they are entered correctly, well... they work but they will also display in the Web Interface.

If you don't see them there, you didn't enter them correctly.

Ignore the instructions below this line. They are no longer needed.

I copied these instructions from somewhere (I really don't remember) but they do work.

ssh into PiHole

echo "addn-hosts=/etc/pihole/lan.list" | sudo tee /etc/dnsmasq.d/02-lan.conf

Create a “hosts file” in /etc/pihole/lan.list with the format ipaddress fqdn hostname.

ipaddress

fqdn

hostname

192.168.1.40

marvin.your.lan

marvin

192.168.1.41

eddie.your.lan

eddie

192.168.1.42

hactar.your.lan

hactar

ipaddress	fqdn	hostname
192.168.1.40	marvin.your.lan	marvin
192.168.1.41	eddie.your.lan	eddie
192.168.1.42	hactar.your.lan	hactar

substituting “your.lan” for whatever you want your domain name to be.

And remember, thanks to Google buying the ".dev" TLD, you can't use that for your local domains anymore.

sudo pihole restartdns to restart the DNS server.

Raspberry Pi Initial Setup

dastagg — Sun, 05 Jan 2020 16:21:23 GMT

So I don't forget: In this example, the 2019-09-26-raspbian-buster-lite distribution will be installed.

This is for a Linux system. It should work on MacOS. I don't know about Windows.

Except for the dd command, all the commands can be run as a normal user.

Open terminal
Find out what disks are attached to the computer:
```
lsblk -p
```
Insert SD card or USB stick
Find out the name of the new device:
```
lsblk -p
```
Note the name of the device. Could be /dev/sdb or sdc or /dev/mmcblk0.
cd into the directory where the iso is.
Here be Dragons, make sure the "of=" device is correct!. Run the dd command to copy the image onto the device:
```
sudo dd bs=4M if=2019-09-26-raspbian-buster-lite.img of=/dev/sdc conv=fsync status=progress
```
After it is done. mount boot partition of the device.
cd to the partition
Enable ssh ability by adding an empty file called "ssh" to the boot partition.
Unmount (or eject) the SD card/USB stick.
Run nmap to see what is currently on the network. (ie: nmap -sP 192.168.0.0/24)
Insert it into the Raspberry Pi and turn it on.
Run nmap again to see whats new.
ssh into the RPI using pi@xxx.xxx.xxx.xxx that you got from nmap.