1
sudo apt update && sudo apt install -y openssl

1
# 创建证书配置文件
2
vim harbor_cert.cnf
3
# 填入下面内容

1
[req]
2
distinguished_name = req_distinguished_name
3
x509_extensions = v3_req
4
prompt = no
5

6
[req_distinguished_name]
7
C = CN          # 国家（按需修改）
8
ST = Beijing    # 省份
9
L = Beijing     # 城市
10
O = MyOrg       # 组织
11
OU = DevOps     # 部门
12
CN = harbor.example.com  # ← 替换为你的 Harbor 域名或 IP！
13

14
[v3_req]
15
keyUsage = keyEncipherment, dataEncipherment, digitalSignature
16
extendedKeyUsage = serverAuth
17
subjectAltName = @alt_names
18

19
[alt_names]
20
DNS.1 = harbor.example.com   # ← 主域名
21
DNS.2 = *.example.com        # 可选：泛域名
22
IP.1 = 192.168.2.11          # ← 如果用 IP 访问，必须加上！

1
# 生成私钥 + 自签名证书（有效期 3650 天 ≈ 10 年）
2
openssl req -x509 \
3
  -newkey rsa:4096 \
4
  -sha256 \
5
  -days 3650 \
6
  -nodes \
7
  -keyout harbor.key \
8
  -out harbor.crt \
9
  -config harbor_cert.cnf \
10
  -extensions v3_req

1
sudo mkdir -p /etc/docker/certs.d/harbor.example.com/
2
sudo cp harbor.crt /etc/docker/certs.d/harbor.example.com/ca.crt

1
cp harbor.yml.tmpl harbor.yml

1
# 执行安装命令
2
./install.sh

1
# 重新生成配置
2
./prepare
3
# 停止容器
4
docker-compose down
5
# 开启容器
6
docker-compose up -d

1
192.168.2.21 harbor.local

1
docker login <registry_url>

1
docker tag myapp:latest registry.example.com/myproject/myapp:v1.0.0

1
docker push registry.example.com/myproject/myapp:v1.0.0

1
"insecure-registries": ["私有仓库HostName/IP"]
2
# 然后重启docker服务
3
systemctl restart docker

1
upstream harbor_backend {
2
    server 127.0.0.1:5443;  # 转发到 Harbor 的 HTTPS 端口
3
    keepalive 32;
4
}
5

6
server {
7
    listen 443 ssl http2;
8

9
    # 替换为你的实际域名或 IP
10
    server_name harbor.local 192.168.2.21;
11

12
    # 使用 Harbor 的证书
13
    ssl_certificate     /opt/harbor/harbor/crt/harbor.crt;
14
    ssl_certificate_key /opt/harbor/harbor/crt/harbor.key;
15

16
    ssl_protocols       TLSv1.2 TLSv1.3;
17
    ssl_ciphers         ECDHE-RSA-AES128-GCM-SHA256:ECDHE-RSA-AES256-GCM-SHA384;
18
    ssl_prefer_server_ciphers off;
19

20
    client_max_body_size 0;  # 允许大镜像上传
21

22
    location / {
23
        proxy_pass https://harbor_backend;
24
        proxy_set_header Host $host;
25
        proxy_set_header X-Real-IP $remote_addr;
26
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
27
        proxy_set_header X-Forwarded-Proto $scheme;
28

29
        # 必须关闭缓冲，否则大镜像 push/pull 会卡住
30
        proxy_buffering off;
31
        proxy_request_buffering off;
32

33
        # 超时设置（重要！）
34
        proxy_connect_timeout 90s;
35
        proxy_send_timeout 90s;
36
        proxy_read_timeout 90s;
37
    }
38
}
39

40
# 可选：HTTP 自动跳转 HTTPS
41
server {
42
    listen 80;
43
    server_name harbor.local 192.168.2.21;
44

45
    return 301 https://$host$request_uri;
46
}