Not sure if the category is correct
Basically i want to use my API as authentication for docker login remote
here is my docker compose:
version: '3'
services:
registry:
restart: always
image: registry:2
ports:
- "5000:5000"
environment:
REGISTRY_STORAGE_FILESYSTEM_ROOTDIRECTORY: /data
REGISTRY_HTTP_ADDR: 127.0.0.1:5000
# REGISTRY_HTTP_TLS_CERTIFICATE: /etc/letsencrypt/live/dockerhub.thechemicalworkshop.com/fullchain.pem
# REGISTRY_HTTP_TLS_KEY: /etc/letsencrypt/live/dockerhub.thechemicalworkshop.com/privkey.pem
volumes:
- ./data:/data
network_mode: host
as you can see im hosting this on localhost port 5000
then im using nginx as reverse proxy, ssl and some other stuff
server {
client_max_body_size 2000m;
proxy_pass_request_headers on;
server_name dockerhub.thechemicalworkshop.com;
auth_request /auth;
location / {
# Do not allow connections from docker 1.5 and earlier
# docker pre-1.6.0 did not properly set the user agent on ping, catch "Go *" user agents
if ($http_user_agent ~ "^(docker\/1\.(3|4|5(?!\.[0-9]-dev))|Go ).*$" ) {
return 404;
}
proxy_pass http://127.0.0.1:5000;
proxy_set_header Host $http_host; # required for docker client's sake
proxy_set_header X-Real-IP $remote_addr; # pass on real client's IP
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Proto $scheme;
proxy_read_timeout 900;
proxy_pass_request_headers on;
}
location = /auth {
proxy_pass_request_headers on;
proxy_pass http://localhost:8080/api/authorize_docker;
proxy_pass_header token;
proxy_set_header Authorization $http_authorization;
proxy_pass_header Authorization;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-Proto $scheme;
}
listen [::]:443 ssl; # managed by Certbot
listen 443 ssl; # managed by Certbot
ssl_certificate /etc/letsencrypt/live/dockerhub.thechemicalworkshop.com/fullchain.pem; # managed by Certbot
ssl_certificate_key /etc/letsencrypt/live/dockerhub.thechemicalworkshop.com/privkey.pem; # managed by Certbot
include /etc/letsencrypt/options-ssl-nginx.conf; # managed by Certbot
ssl_dhparam /etc/letsencrypt/ssl-dhparams.pem; # managed by Certbot
}
i hope this config is correct, basically im passing bunch of stuff to http://localhost:8080/api/authorize_docker which is running this script:
@app.route("/api/authorize_docker")
async def authorize_docker():
data = await request.data
data2 = await request.get_data()
js = await request.json
js2 = await request.get_json()
form = await request.form
files = await request.files
values = await request.values
# stream = await request.stream
print(request.authorization)
print(await request.get_data())
print(request.headers)
if matti_check(request.headers["X-Real-Ip"]):
return "Welcome_Matti"
else:
print(request.headers)
return "ERROR", 500
ignore the print statements, they are for debugging
basically this is a very simple IP whitelist (which works)
i’d also like to impement oauth or whatever docker login uses
inside my api so i can use combination of login/password, ip but also generally have better control over my docker repository as every request will go thru the API
here is my problem:
I dont see the login/password anywhere ?
here is what i run:
Powershell Windows 10
docker login https://dockerhub.thechemicalworkshop.com/
Username: user
Password:
Login Succeeded
username and password can be anything, will still pass because it’s comming from my IP (see python code above)
i wiresharked my pc (no user/pass found)
python logs, also no user/pass found
python logs:
4|TCW-API | None
4|TCW-API | b''
4|TCW-API | Remote-Addr: 127.0.0.1
4|TCW-API | X-Real-Ip: REDACTED
4|TCW-API | X-Forwarded-Proto: https
4|TCW-API | Host: localhost:8080
4|TCW-API | Connection: close
4|TCW-API | User-Agent: docker/20.10.14 go/go1.16.15 git-commit/87a90dc kernel/5.10.104-linuxkit os/linux arch/amd64 UpstreamClient(Docker-Client/20.10.14 \(windows\))
4|TCW-API | Accept-Encoding: gzip
4|TCW-API |
4|TCW-API | [2022-04-29 22:28:14,748] 127.0.0.1:39722 GET /api/authorize_docker 1.0 200 13 32601
4|TCW-API | None
4|TCW-API | b''
4|TCW-API | Remote-Addr: 127.0.0.1
4|TCW-API | X-Real-Ip: REDACTED
4|TCW-API | X-Forwarded-Proto: https
4|TCW-API | Host: localhost:8080
4|TCW-API | Connection: close
4|TCW-API | User-Agent: docker/20.10.14 go/go1.16.15 git-commit/87a90dc kernel/5.10.104-linuxkit os/linux arch/amd64 UpstreamClient(Docker-Client/20.10.14 \(windows\))
4|TCW-API | Accept-Encoding: gzip
4|TCW-API |
4|TCW-API | [2022-04-29 22:28:15,865] 127.0.0.1:39730 GET /api/authorize_docker 1.0 200 13 21546
why is it requesting twice tho?
How do i fetch the login/password inside my script so i can well, authenticate user (or not)?
how does EXACTLY docker login adress work, i’d like a full explanation on authentication
Thanks !