什麼是 Harbor？
harbor 是 VMware 公司開源的企業級 DockerRegistry 項目，項目位址為 https://github.com/vmware/harbor。其目标是幫助使用者迅速搭建一個企業級的 Docker registry 服務。它以 Docker 公司開源的 registry 為基礎，提供了管理UI，基于角色的通路控制(Role Based Access Control)，AD/LDAP內建、以及審計日志(Auditlogging) 等企業使用者需求的功能，同時還原生支援中文。Harbor 的每個元件都是以 Docker 容器的形式建構的，使用 Docker Compose 來對它進行部署。
環境準備
1、騰訊雲伺服器（CentOS7.4）
2、Docker 版本：1.13.1
3、Docker-compose：1.17.0
4、Harbor：1.1.2
一：安裝docker
直接yum 安裝即可
yum -y install docker
systemctl start docker (啟動docker) 複制
二：安裝docker-compose
下載下傳指定版本的docker-compose
sudo curl -L https://github.com/docker/compose/releases/download/1.17.0/docker-compose-`uname -s`-`uname -m` -o /usr/local/bin/docker-compose
對二進制檔案賦可執行權限
chmod +x /usr/local/bin/docker-compose
測試下docker-compose是否安裝成功
docker-compose --version
出現如下
docker-compose version 1.17.1, build 6d101fb
複制
三：安裝 Harbor
wget https://github.com/vmware/harbor/releases/download/v1.1.2/harbor-offline-installer-v1.1.2.tgz
ps：線上安裝版（精簡版）wget https://storage.googleapis.com/harbor-releases/release-1.7.0/harbor-online-installer-v1.7.5.tgz
tar -zxvf harbor-offline-installer-v1.1.2.tgz
複制
解壓縮之後，進入目錄下會看到 harbor.cfg 檔案，該檔案就是 Harbor 的配置檔案。
## Configuration file of Harbor
# hostname設定通路位址，可以使用ip、域名，不可以設定為127.0.0.1或localhost
hostname = abc.lengxiaofeng.cn #這裡我先配置我的域名（已添加到主機的解析）
# 通路協定，預設是http，也可以設定https，如果設定https，則nginx ssl需要設定on
ui_url_protocol = https #這裡使用https協定
# mysql資料庫root使用者預設密碼root123，實際使用時修改下
db_password = root123
#Maximum number of job workers in job service
max_job_workers = 3
#Determine whether or not to generate certificate for the registry's token.
#If the value is on, the prepare script creates new root cert and private key
#for generating token to access the registry. If the value is off the default key/cert will be used.
#This flag also controls the creation of the notary signer's cert.
customize_crt = on
#The path of cert and key files for nginx, they are applied only the protocol is set to https
ssl_cert = /data/abc/abc.lengxiaofeng.cn.crt #容器中使用nginx作為前端，是以這裡使用nginx證書
ssl_cert_key = /data/abc/abc.lengxiaofeng.cn.key
#The path of secretkey storage
secretkey_path = /data
#Admiral's url, comment this attribute, or set its value to NA when Harbor is standalone
admiral_url = NA
#NOTES: The properties between BEGIN INITIAL PROPERTIES and END INITIAL PROPERTIES
#only take effect in the first boot, the subsequent changes of these properties
#should be performed on web ui
#************************BEGIN INITIAL PROPERTIES************************
#Email account settings for sending out password resetting emails.
#Email server uses the given username and password to authenticate on TLS connections to host and act as identity.
#Identity left blank to act as username.
email_identity =
email_server = smtp.mydomain.com
email_server_port = 25
email_username = [email protected]
email_password = abc
email_from = admin <[email protected]>
email_ssl = false
##The initial password of Harbor admin, only works for the first time when Harbor starts.
#It has no effect after the first launch of Harbor.
# 啟動Harbor後，管理者UI登入的密碼，預設是Harbor12345
harbor_admin_password = Harbor12345 #根據自己的需求修改
# 認證方式，這裡支援多種認證方式，如LADP、本次存儲、資料庫認證。預設是db_auth，mysql資料庫認證
auth_mode = db_auth
#The url for an ldap endpoint.
ldap_url = ldaps://ldap.mydomain.com
#A user's DN who has the permission to search the LDAP/AD server.
#If your LDAP/AD server does not support anonymous search, you should configure this DN and ldap_search_pwd.
#ldap_searchdn = uid=searchuser,ou=people,dc=mydomain,dc=com
#the password of the ldap_searchdn
#ldap_search_pwd = password
#The base DN from which to look up a user in LDAP/AD
ldap_basedn = ou=people,dc=mydomain,dc=com
#Search filter for LDAP/AD, make sure the syntax of the filter is correct.
#ldap_filter = (objectClass=person)
# The attribute used in a search to match a user, it could be uid, cn, email, sAMAccountName or other attributes de
pending on your LDAP/AD ldap_uid = uid
#the scope to search for users, 1-LDAP_SCOPE_BASE, 2-LDAP_SCOPE_ONELEVEL, 3-LDAP_SCOPE_SUBTREE
ldap_scope = 3
#Timeout (in seconds) when connecting to an LDAP Server. The default value (and most reasonable) is 5 seconds.
ldap_timeout = 5
# 是否開啟自注冊
self_registration = on
# Token有效時間，預設30分鐘
token_expiration = 30
# 使用者建立項目權限控制，預設是everyone（所有人），也可以設定為adminonly（隻能管理者）
project_creation_restriction = everyone
#Determine whether the job service should verify the ssl cert when it connects to a remote registry.
#Set this flag to off when the remote registry uses a self-signed or untrusted certificate.
verify_remote_cert = on
#************************END INITIAL PROPERTIES************************ 複制
注：主要修改hostname ui_url_protocol ssl_cert ssl_cert_key harbor_admin_password 這幾個字段，如果使用http 協定，可以不配置證書。
啟動 harbor，修改完配置檔案後，在的目前目錄執行./install.sh，Harbor服務就會根據當期目錄下的docker-compose.yml開始下載下傳依賴的鏡像，檢測并按照順序依次啟動各個服務。
使用者名預設admin 密碼就是配置檔案中設定的密碼
四：停止和啟動harbor
如果需要修改Harbor的配置檔案harbor.cfg，因為Harbor是基于docker-compose服務編排的，我們可以使用docker-compose指令重新開機Harbor。不修改配置檔案，重新開機Harbor指令：docker-compose start | stop | restart
1、停止Harbo
$ docker-compose down -v
Stopping nginx ... done
Stopping harbor-jobservice ... done
......
Removing harbor-log ... done
Removing network harbor_harbo
2、啟動Harbo
$ docker-compose up -d
Creating network "harbor_harbor" with the default drive
Creating harbor-log ...
......
Creating nginx
Creating harbor-jobservice ... done
--------------------- 複制
注：如果中途遇到某些容器異常退出，導緻倉庫無法正常通路，也可以使用docker-compose 指令來重新開機服務。
容器中的nginx配置檔案中是配置了80端口自動重定向到443端口的，是以即使http請求也會自動跳轉到https
