macos-tools/harbor/setup-letsencrypt.sh

#!/bin/bash

# Harbor Let's Encrypt证书配置脚本
# 用途：为harbor.omniverseai.net配置Let's Encrypt证书

set -e

DOMAIN="harbor.omniverseai.net"
CERT_DIR="/Users/brunogao/certs"
HARBOR_DIR="/Users/brunogao/work/codes/tools/macos/harbor"

echo "=========================================="
echo "Harbor Let's Encrypt 证书配置"
echo "=========================================="
echo "域名: $DOMAIN"
echo "证书目录: $CERT_DIR"
echo ""

# 颜色定义
RED='\033[0;31m'
GREEN='\033[0;32m'
YELLOW='\033[1;33m'
NC='\033[0m' # No Color

# 检查Homebrew和certbot
if ! command -v brew &> /dev/null; then
    echo -e "${RED}❌ Homebrew未安装，请先安装Homebrew${NC}"
    exit 1
fi

# 安装certbot（如果未安装）
if ! command -v certbot &> /dev/null; then
    echo -e "${YELLOW}📦 正在安装certbot...${NC}"
    brew install certbot
fi

echo -e "${YELLOW}⚠️  重要说明：${NC}"
echo "由于域名 $DOMAIN 通过云端服务器转发到本机，"
echo "您需要在云端服务器上运行以下命令来获取证书："
echo ""
echo -e "${GREEN}# 在云端服务器上执行：${NC}"
echo "sudo certbot certonly --standalone -d $DOMAIN --preferred-challenges http"
echo ""
echo "获取证书后，将以下文件复制到本机的 $CERT_DIR 目录："
echo "  1. /etc/letsencrypt/live/$DOMAIN/fullchain.pem -> $DOMAIN.crt"
echo "  2. /etc/letsencrypt/live/$DOMAIN/privkey.pem -> $DOMAIN.key"
echo ""
echo -e "${GREEN}复制命令示例（在云端服务器上）：${NC}"
echo "sudo cat /etc/letsencrypt/live/$DOMAIN/fullchain.pem > ~/fullchain.pem"
echo "sudo cat /etc/letsencrypt/live/$DOMAIN/privkey.pem > ~/privkey.pem"
echo ""
echo -e "${GREEN}然后在本机执行（替换YOUR_SERVER为云端服务器地址）：${NC}"
echo "scp YOUR_SERVER:~/fullchain.pem $CERT_DIR/$DOMAIN.crt"
echo "scp YOUR_SERVER:~/privkey.pem $CERT_DIR/$DOMAIN.key"
echo ""
echo -e "${YELLOW}按Enter继续（如果您已经有证书文件），或Ctrl+C退出...${NC}"
read

# 检查证书文件是否存在
if [ ! -f "$CERT_DIR/$DOMAIN.crt" ] || [ ! -f "$CERT_DIR/$DOMAIN.key" ]; then
    echo -e "${RED}❌ 证书文件不存在！${NC}"
    echo "请确保以下文件存在："
    echo "  - $CERT_DIR/$DOMAIN.crt"
    echo "  - $CERT_DIR/$DOMAIN.key"
    exit 1
fi

echo -e "${GREEN}✅ 证书文件已找到${NC}"

# 验证证书
echo ""
echo "📋 验证证书信息..."
openssl x509 -in "$CERT_DIR/$DOMAIN.crt" -noout -subject -dates -issuer

# 设置正确的权限
echo ""
echo "🔐 设置证书文件权限..."
chmod 644 "$CERT_DIR/$DOMAIN.crt"
chmod 600 "$CERT_DIR/$DOMAIN.key"

echo -e "${GREEN}✅ 证书权限已设置${NC}"

# 更新harbor.yml配置
echo ""
echo "📝 更新harbor.yml配置..."

cd "$HARBOR_DIR"

# 备份原配置
cp harbor.yml harbor.yml.backup.$(date +%Y%m%d_%H%M%S)

# 更新配置
cat > harbor.yml.new << EOF
# Configuration file of Harbor

# The IP address or hostname to access admin UI and registry service.
hostname: $DOMAIN

# http related config
http:
  # port for http, default is 80. If https enabled, this port will redirect to https port
  port: 8080

# https related config
https:
  # https port for harbor, default is 443
  port: 8443
  # The path of cert and key files for nginx
  certificate: $CERT_DIR/$DOMAIN.crt
  private_key: $CERT_DIR/$DOMAIN.key

# The initial password of Harbor admin
harbor_admin_password: admin123

# Harbor DB configuration
database:
  password: root123
  max_idle_conns: 100
  max_open_conns: 900
  conn_max_lifetime: 5m
  conn_max_idle_time: 0

# The default data volume
data_volume: /Users/brunogao/ops/data/harbor

# Trivy configuration
trivy:
  ignore_unfixed: false
  skip_update: false
  skip_java_db_update: false
  offline_scan: false
  security_check: vuln
  insecure: false
  timeout: 5m0s

jobservice:
  max_job_workers: 10
  job_loggers:
    - STD_OUTPUT
    - FILE
  logger_sweeper_duration: 1

notification:
  webhook_job_max_retry: 3
  webhook_job_http_client_timeout: 3

# Log configurations
log:
  level: info
  local:
    rotate_count: 50
    rotate_size: 200M
    location: /var/log/harbor

#This attribute is for migrator to detect the version of the .cfg file, DO NOT MODIFY!
_version: 2.11.0

# Global proxy
proxy:
  http_proxy:
  https_proxy:
  no_proxy:
  components:
    - core
    - jobservice
    - trivy

# Enable purge _upload directories
upload_purging:
  enabled: true
  age: 168h
  interval: 24h
  dryrun: false

# Cache layer configurations
cache:
  enabled: false
  expire_hours: 24
EOF

mv harbor.yml.new harbor.yml

echo -e "${GREEN}✅ harbor.yml配置已更新${NC}"

# 准备Harbor
echo ""
echo "🔧 准备Harbor配置..."
./prepare

echo -e "${GREEN}✅ Harbor配置准备完成${NC}"

# 重启Harbor
echo ""
echo "🔄 重启Harbor服务..."
docker-compose down
docker-compose up -d

echo ""
echo "⏳ 等待Harbor服务启动..."
sleep 10

# 检查服务状态
echo ""
echo "📊 Harbor服务状态："
docker-compose ps

echo ""
echo -e "${GREEN}=========================================="
echo "✅ Harbor Let's Encrypt配置完成！"
echo "==========================================${NC}"
echo ""
echo "访问地址："
echo "  - HTTPS: https://$DOMAIN:8443"
echo "  - HTTP:  http://$DOMAIN:8080 (会重定向到HTTPS)"
echo ""
echo "登录信息："
echo "  - 用户名: admin"
echo "  - 密码: admin123"
echo ""
echo "证书自动续期："
echo "  在云端服务器上设置cron任务："
echo "  0 0 1 * * certbot renew --quiet && systemctl reload nginx"
echo ""
echo -e "${YELLOW}⚠️  重要提醒：${NC}"
echo "1. Let's Encrypt证书有效期为90天，需要定期续期"
echo "2. 续期后需要重新复制证书到本机并重启Harbor"
echo "3. 确保云端服务器的WireGuard转发正常工作"
echo ""