docs: 添加 Harbor 外网访问配置完整总结
This commit is contained in:
@@ -0,0 +1,331 @@
|
||||
# Harbor 外网访问配置总结
|
||||
|
||||
## 配置完成状态
|
||||
|
||||
✅ **Harbor 已成功配置外网访问**
|
||||
|
||||
- 域名：`harbor.omniverseai.net:8443`
|
||||
- SSL 证书：Let's Encrypt（有效期 90 天）
|
||||
- 访问模式：DNS only（直接解析到公网 IP）
|
||||
- 证书颁发者：Let's Encrypt
|
||||
- 证书有效期：2026-02-27 至 2026-05-28
|
||||
|
||||
## 关键配置
|
||||
|
||||
### 1. SSL 证书配置
|
||||
|
||||
**证书位置：**
|
||||
- 证书文件：`/Users/brunogao/ops/data/harbor/secret/cert/server.crt`
|
||||
- 私钥文件：`/Users/brunogao/ops/data/harbor/secret/cert/server.key`
|
||||
- 备份位置：`/Users/brunogao/certs/harbor.omniverseai.net.pem`
|
||||
|
||||
**认证方式：**
|
||||
- Cloudflare API Key + Email（DNS-01 验证）
|
||||
- 凭证文件：`~/.secrets/cloudflare.ini`
|
||||
|
||||
**自动续期：**
|
||||
- 续期脚本：`/usr/local/bin/renew-harbor-cert.sh`
|
||||
- 续期时间：每月 1 号和 15 号凌晨 2 点
|
||||
- 续期日志：`/var/log/harbor-cert-renew.log`
|
||||
|
||||
### 2. Harbor 配置
|
||||
|
||||
**harbor.yml 关键配置：**
|
||||
```yaml
|
||||
hostname: harbor.omniverseai.net
|
||||
http:
|
||||
port: 8080
|
||||
https:
|
||||
port: 8443
|
||||
certificate: /Users/brunogao/certs/harbor.omniverseai.net.pem
|
||||
private_key: /Users/brunogao/certs/harbor.omniverseai.net-key.pem
|
||||
external_url: https://harbor.omniverseai.net:8443
|
||||
```
|
||||
|
||||
**重要：EXT_ENDPOINT 配置**
|
||||
|
||||
Harbor 内部服务需要正确的 `EXT_ENDPOINT` 环境变量才能返回正确的 token service URL。
|
||||
|
||||
配置文件：`common/config/core/env`
|
||||
```bash
|
||||
EXT_ENDPOINT=https://harbor.omniverseai.net:8443
|
||||
```
|
||||
|
||||
⚠️ **注意**：`common/config` 目录被 gitignore 忽略，重新部署时需要手动修改此文件。
|
||||
|
||||
### 3. 网络配置
|
||||
|
||||
**DNS 模式：**
|
||||
- DNS only（不通过 Cloudflare 代理）
|
||||
- 原因：避免 Cloudflare 100MB 文件大小限制
|
||||
|
||||
**DNS 解析：**
|
||||
```
|
||||
harbor.omniverseai.net → 14.127.218.144:8443
|
||||
```
|
||||
|
||||
**端口转发（路由器配置）：**
|
||||
- 外部端口：8443 → 内部 IP：192.168.1.83:8443
|
||||
- 外部端口：8080 → 内部 IP：192.168.1.83:8080（可选）
|
||||
|
||||
## 使用方法
|
||||
|
||||
### Docker Login
|
||||
|
||||
```bash
|
||||
# 从外网登录
|
||||
docker login harbor.omniverseai.net:8443
|
||||
|
||||
# 推送镜像
|
||||
docker tag myimage:latest harbor.omniverseai.net:8443/library/myimage:latest
|
||||
docker push harbor.omniverseai.net:8443/library/myimage:latest
|
||||
|
||||
# 拉取镜像
|
||||
docker pull harbor.omniverseai.net:8443/library/myimage:latest
|
||||
```
|
||||
|
||||
### Web 访问
|
||||
|
||||
```bash
|
||||
# 浏览器访问
|
||||
https://harbor.omniverseai.net:8443
|
||||
|
||||
# 默认账号
|
||||
用户名：admin
|
||||
密码：admin123
|
||||
```
|
||||
|
||||
## 维护命令
|
||||
|
||||
### 证书管理
|
||||
|
||||
```bash
|
||||
# 查看证书状态
|
||||
sudo certbot certificates
|
||||
|
||||
# 查看证书详情
|
||||
openssl x509 -in /Users/brunogao/certs/harbor.omniverseai.net.pem -noout -text
|
||||
|
||||
# 测试续期（不实际续期）
|
||||
sudo certbot renew --dry-run
|
||||
|
||||
# 手动续期
|
||||
sudo /usr/local/bin/renew-harbor-cert.sh
|
||||
|
||||
# 查看续期日志
|
||||
tail -f /var/log/harbor-cert-renew.log
|
||||
```
|
||||
|
||||
### Harbor 服务管理
|
||||
|
||||
```bash
|
||||
# 重启 Harbor
|
||||
cd /Users/brunogao/work/codes/tools/macos/harbor
|
||||
docker-compose down
|
||||
docker-compose up -d
|
||||
|
||||
# 查看服务状态
|
||||
docker-compose ps
|
||||
|
||||
# 查看日志
|
||||
docker-compose logs -f
|
||||
|
||||
# 重启 nginx（证书更新后）
|
||||
docker restart nginx
|
||||
```
|
||||
|
||||
### 验证配置
|
||||
|
||||
```bash
|
||||
# 验证 SSL 证书
|
||||
openssl s_client -connect harbor.omniverseai.net:8443 -servername harbor.omniverseai.net < /dev/null 2>/dev/null | openssl x509 -noout -subject -issuer -dates
|
||||
|
||||
# 验证 EXT_ENDPOINT
|
||||
docker exec harbor-core env | grep EXT_ENDPOINT
|
||||
|
||||
# 测试 HTTP 访问
|
||||
curl -I http://127.0.0.1:8080
|
||||
|
||||
# 测试 HTTPS 访问
|
||||
curl -Ik https://127.0.0.1:8443
|
||||
|
||||
# 从外网测试
|
||||
curl -Ik https://harbor.omniverseai.net:8443
|
||||
```
|
||||
|
||||
## 故障排查
|
||||
|
||||
### 问题 1：Docker login 超时
|
||||
|
||||
**症状：**
|
||||
```
|
||||
Error response from daemon: Get "https://harbor.omniverseai.net/service/token...": context deadline exceeded
|
||||
```
|
||||
|
||||
**原因：**
|
||||
- `EXT_ENDPOINT` 环境变量缺少端口号
|
||||
- Harbor 返回的 token service URL 不正确
|
||||
|
||||
**解决方案：**
|
||||
1. 检查 `common/config/core/env` 中的 `EXT_ENDPOINT`
|
||||
2. 确保包含端口号：`EXT_ENDPOINT=https://harbor.omniverseai.net:8443`
|
||||
3. 重启 Harbor：`docker-compose down && docker-compose up -d`
|
||||
4. 验证：`docker exec harbor-core env | grep EXT_ENDPOINT`
|
||||
|
||||
### 问题 2：证书验证失败
|
||||
|
||||
**症状：**
|
||||
```
|
||||
x509: certificate signed by unknown authority
|
||||
```
|
||||
|
||||
**原因：**
|
||||
- Harbor 使用的是旧的自签名证书
|
||||
- 证书文件没有正确复制到 Harbor 目录
|
||||
|
||||
**解决方案：**
|
||||
1. 检查证书文件：
|
||||
```bash
|
||||
ls -lh /Users/brunogao/ops/data/harbor/secret/cert/
|
||||
openssl x509 -in /Users/brunogao/ops/data/harbor/secret/cert/server.crt -noout -issuer
|
||||
```
|
||||
2. 如果证书不正确，重新复制：
|
||||
```bash
|
||||
cp /Users/brunogao/certs/harbor.omniverseai.net.pem /Users/brunogao/ops/data/harbor/secret/cert/server.crt
|
||||
cp /Users/brunogao/certs/harbor.omniverseai.net-key.pem /Users/brunogao/ops/data/harbor/secret/cert/server.key
|
||||
docker restart nginx
|
||||
```
|
||||
|
||||
### 问题 3：外网无法访问
|
||||
|
||||
**症状：**
|
||||
```
|
||||
curl: (28) Failed to connect to harbor.omniverseai.net port 8443: Connection timed out
|
||||
```
|
||||
|
||||
**原因：**
|
||||
- 路由器端口转发未配置
|
||||
- 防火墙阻止端口
|
||||
- DNS 解析错误
|
||||
|
||||
**解决方案：**
|
||||
1. 检查 DNS 解析：
|
||||
```bash
|
||||
nslookup harbor.omniverseai.net
|
||||
# 应该返回：14.127.218.144
|
||||
```
|
||||
2. 检查本地服务：
|
||||
```bash
|
||||
curl -Ik https://127.0.0.1:8443
|
||||
# 应该返回 200 OK
|
||||
```
|
||||
3. 检查路由器端口转发配置
|
||||
4. 检查防火墙规则
|
||||
|
||||
## 重要提醒
|
||||
|
||||
1. **证书续期**
|
||||
- Let's Encrypt 证书有效期 90 天
|
||||
- 已配置自动续期（每月 1 号和 15 号）
|
||||
- 建议每月检查续期日志
|
||||
|
||||
2. **备份**
|
||||
- 定期备份 Harbor 数据
|
||||
- 备份 Cloudflare API 凭证
|
||||
- 备份 harbor.yml 配置文件
|
||||
|
||||
3. **安全**
|
||||
- 修改默认管理员密码
|
||||
- 定期更新 Harbor 版本
|
||||
- 监控访问日志
|
||||
|
||||
4. **DNS only 模式**
|
||||
- 必须保持 DNS only 模式（不启用 Cloudflare 代理）
|
||||
- 原因：避免 Cloudflare 100MB 文件大小限制
|
||||
- 大型 Docker 镜像无法通过 Cloudflare 代理上传
|
||||
|
||||
## 配置文件位置
|
||||
|
||||
```
|
||||
/Users/brunogao/work/codes/tools/macos/harbor/
|
||||
├── harbor.yml # Harbor 主配置文件
|
||||
├── docker-compose.yml # Docker Compose 配置
|
||||
├── common/config/core/env # Harbor Core 环境变量（包含 EXT_ENDPOINT）
|
||||
├── setup-letsencrypt-dns-only.sh # SSL 证书配置脚本
|
||||
├── SSL-CERTIFICATE-DNS-ONLY-GUIDE.md # SSL 证书配置指南
|
||||
└── SSL-SETUP-SUMMARY.md # SSL 配置快速总结
|
||||
|
||||
/Users/brunogao/certs/
|
||||
├── harbor.omniverseai.net.pem # SSL 证书（备份）
|
||||
└── harbor.omniverseai.net-key.pem # SSL 私钥（备份）
|
||||
|
||||
/Users/brunogao/ops/data/harbor/secret/cert/
|
||||
├── server.crt # Harbor 使用的 SSL 证书
|
||||
└── server.key # Harbor 使用的 SSL 私钥
|
||||
|
||||
/Users/brunogao/.secrets/
|
||||
└── cloudflare.ini # Cloudflare API 凭证
|
||||
|
||||
/usr/local/bin/
|
||||
└── renew-harbor-cert.sh # 证书自动续期脚本
|
||||
```
|
||||
|
||||
## 测试结果
|
||||
|
||||
✅ **本地访问测试**
|
||||
```bash
|
||||
curl -I http://127.0.0.1:8080
|
||||
# HTTP/1.1 200 OK
|
||||
|
||||
curl -Ik https://127.0.0.1:8443
|
||||
# HTTP/1.1 200 OK
|
||||
```
|
||||
|
||||
✅ **外网访问测试**
|
||||
```bash
|
||||
curl -Ik https://harbor.omniverseai.net:8443
|
||||
# HTTP/1.1 200 OK
|
||||
```
|
||||
|
||||
✅ **Docker Login 测试**
|
||||
```bash
|
||||
docker login harbor.omniverseai.net:8443
|
||||
# Login Succeeded
|
||||
```
|
||||
|
||||
✅ **SSL 证书验证**
|
||||
```bash
|
||||
openssl s_client -connect harbor.omniverseai.net:8443 -servername harbor.omniverseai.net
|
||||
# subject=CN=harbor.omniverseai.net
|
||||
# issuer=C=US, O=Let's Encrypt, CN=E8
|
||||
# notBefore=Feb 27 04:23:00 2026 GMT
|
||||
# notAfter=May 28 04:22:59 2026 GMT
|
||||
```
|
||||
|
||||
## 下一步建议
|
||||
|
||||
1. **修改默认密码**
|
||||
```bash
|
||||
# 登录 Web 界面修改 admin 密码
|
||||
https://harbor.omniverseai.net:8443
|
||||
```
|
||||
|
||||
2. **创建项目和用户**
|
||||
- 创建项目（如 library, production, staging）
|
||||
- 创建用户并分配权限
|
||||
- 配置镜像扫描策略
|
||||
|
||||
3. **配置镜像同步**
|
||||
- 配置 Docker Hub 代理
|
||||
- 配置其他 Registry 同步
|
||||
|
||||
4. **监控和日志**
|
||||
- 配置日志收集
|
||||
- 设置告警规则
|
||||
- 监控磁盘使用情况
|
||||
|
||||
---
|
||||
|
||||
**配置完成时间：** 2026-02-27
|
||||
**配置人员：** Claude Code
|
||||
**Git 仓库：** http://192.168.1.83:33000/gao/ljwx-harbor.git
|
||||
Reference in New Issue
Block a user