首先需要准备好 Docker + Docker-Compose 环境，Docker 在 CentOS 7.x 的安装教程请参考 这篇文章，后续文章假设你已经安装好了上述环境。

首先从 Harbor 的官方 GitHub Relase 下载最新的安装包，Harbor 本身的运行也是依赖于 Docker Compose ，整个压缩包本质上就是一系列离线镜像，执行安装脚本就是执行 docker load 命令将需要的镜像直接加载。

  1. 下载安装包，请访问 https://github.com/goharbor/harbor/releases/tag/v2.1.2 下载 tgz 压缩包。

  2. 将文件移动到安装文件夹，这里我建立了一个 /opt/harbor 文件夹。

  3. 运行 tar -xvf harbor-offline-installer-v1.10.1.tgz 解压文件包。

  4. 移动到解压完成的文件夹，编辑对应的 harbor.yml 文件，设置域名、SSL 证书等信息。

    注意⚠️:

    这一步的证书文件必须是全链证书(fullchain)，否则后续 docker login 的时候会提示 X509 错误。

  5. 执行 ./install.sh --with-clair 开始安装 Harbor。

完成上述步骤以后 Harbor 就安装成功了。

在我们的环境当中，NGINX 容器是单独存在的，并且使用的是 docker nework create 创建的外部网络。这个时候就不能够使用 Harbor 安装脚本内提供的 NGINX，需要变更 Harbor 的 Docker Compose 文件。

  1. 执行 docker-compose down 命令，停止所有 Harbor 容器。

  2. 编辑 Harbor 的 docker-compose.yml 文件，引入外部网络，这里我以 internal-network 为例，下面是变更好的 YAML 文件。

    1. version: \'2.3\'
    2. services:
    3.   log:
    4.     image: goharbor/harbor-log:v2.1.2
    5.     container_name: harbor-log
    6.     restart: always
    7.     dns_search: .
    8.     cap_drop:
    9.       - ALL
    10.     cap_add:
    11.       - CHOWN
    12.       - DAC_OVERRIDE
    13.       - SETGID
    14.       - SETUID
    15.     volumes:
    16.       - /var/log/harbor/:/var/log/docker/:z
    17.       - type: bind
    18.         source: ./common/config/log/logrotate.conf
    19.         target: /etc/logrotate.d/logrotate.conf
    20.       - type: bind
    21.         source: ./common/config/log/rsyslog_docker.conf
    22.         target: /etc/rsyslog.d/rsyslog_docker.conf
    23.     ports:
    24.       - 127.0.0.1:1514:10514
    25.     networks:
    26.       - harbor
    27.       - internal-network
    28.   registry:
    29.     image: goharbor/registry-photon:v2.1.2
    30.     container_name: registry
    31.     restart: always
    32.     cap_drop:
    33.       - ALL
    34.     cap_add:
    35.       - CHOWN
    36.       - SETGID
    37.       - SETUID
    38.     volumes:
    39.       - /data/registry:/storage:z
    40.       - ./common/config/registry/:/etc/registry/:z
    41.       - type: bind
    42.         source: /data/secret/registry/root.crt
    43.         target: /etc/registry/root.crt
    44.       - type: bind
    45.         source: ./common/config/shared/trust-certificates
    46.         target: /harbor_cust_cert
    47.     networks:
    48.       - harbor
    49.       - internal-network
    50.     dns_search: .
    51.     depends_on:
    52.       - log
    53.     logging:
    54.       driver: "syslog"
    55.       options:
    56.         syslog-address: "tcp://127.0.0.1:1514"
    57.         tag: "registry"
    58.   registryctl:
    59.     image: goharbor/harbor-registryctl:v2.1.2
    60.     container_name: registryctl
    61.     env_file:
    62.       - ./common/config/registryctl/env
    63.     restart: always
    64.     cap_drop:
    65.       - ALL
    66.     cap_add:
    67.       - CHOWN
    68.       - SETGID
    69.       - SETUID
    70.     volumes:
    71.       - /data/registry:/storage:z
    72.       - ./common/config/registry/:/etc/registry/:z
    73.       - type: bind
    74.         source: ./common/config/registryctl/config.yml
    75.         target: /etc/registryctl/config.yml
    76.       - type: bind
    77.         source: ./common/config/shared/trust-certificates
    78.         target: /harbor_cust_cert
    79.     networks:
    80.       - harbor
    81.       - internal-network
    82.     dns_search: .
    83.     depends_on:
    84.       - log
    85.     logging:
    86.       driver: "syslog"
    87.       options:
    88.         syslog-address: "tcp://127.0.0.1:1514"
    89.         tag: "registryctl"
    90.   postgresql:
    91.     image: goharbor/harbor-db:v2.1.2
    92.     container_name: harbor-db
    93.     restart: always
    94.     cap_drop:
    95.       - ALL
    96.     cap_add:
    97.       - CHOWN
    98.       - DAC_OVERRIDE
    99.       - SETGID
    100.       - SETUID
    101.     volumes:
    102.       - /data/database:/var/lib/postgresql/data:z
    103.     networks:
    104.       harbor:
    105.     dns_search: .
    106.     env_file:
    107.       - ./common/config/db/env
    108.     depends_on:
    109.       - log
    110.     logging:
    111.       driver: "syslog"
    112.       options:
    113.         syslog-address: "tcp://127.0.0.1:1514"
    114.         tag: "postgresql"
    115.   core:
    116.     image: goharbor/harbor-core:v2.1.2
    117.     container_name: harbor-core
    118.     env_file:
    119.       - ./common/config/core/env
    120.     restart: always
    121.     cap_drop:
    122.       - ALL
    123.     cap_add:
    124.       - SETGID
    125.       - SETUID
    126.     volumes:
    127.       - /data/ca_download/:/etc/core/ca/:z
    128.       - /data/:/data/:z
    129.       - ./common/config/core/certificates/:/etc/core/certificates/:z
    130.       - type: bind
    131.         source: ./common/config/core/app.conf
    132.         target: /etc/core/app.conf
    133.       - type: bind
    134.         source: /data/secret/core/private_key.pem
    135.         target: /etc/core/private_key.pem
    136.       - type: bind
    137.         source: /data/secret/keys/secretkey
    138.         target: /etc/core/key
    139.       - type: bind
    140.         source: ./common/config/shared/trust-certificates
    141.         target: /harbor_cust_cert
    142.     networks:
    143.       - harbor
    144.       - internal-network
    145.     dns_search: .
    146.     depends_on:
    147.       - log
    148.       - registry
    149.       - redis
    150.       - postgresql
    151.     logging:
    152.       driver: "syslog"
    153.       options:
    154.         syslog-address: "tcp://127.0.0.1:1514"
    155.         tag: "core"
    156.   portal:
    157.     image: goharbor/harbor-portal:v2.1.2
    158.     container_name: harbor-portal
    159.     restart: always
    160.     cap_drop:
    161.       - ALL
    162.     cap_add:
    163.       - CHOWN
    164.       - SETGID
    165.       - SETUID
    166.       - NET_BIND_SERVICE
    167.     volumes:
    168.       - type: bind
    169.         source: ./common/config/portal/nginx.conf
    170.         target: /etc/nginx/nginx.conf
    171.     networks:
    172.       - harbor
    173.       - internal-network
    174.     dns_search: .
    175.     depends_on:
    176.       - log
    177.     logging:
    178.       driver: "syslog"
    179.       options:
    180.         syslog-address: "tcp://127.0.0.1:1514"
    181.         tag: "portal"
    183.   jobservice:
    184.     image: goharbor/harbor-jobservice:v2.1.2
    185.     container_name: harbor-jobservice
    186.     env_file:
    187.       - ./common/config/jobservice/env
    188.     restart: always
    189.     cap_drop:
    190.       - ALL
    191.     cap_add:
    192.       - CHOWN
    193.       - SETGID
    194.       - SETUID
    195.     volumes:
    196.       - /data/job_logs:/var/log/jobs:z
    197.       - type: bind
    198.         source: ./common/config/jobservice/config.yml
    199.         target: /etc/jobservice/config.yml
    200.       - type: bind
    201.         source: ./common/config/shared/trust-certificates
    202.         target: /harbor_cust_cert
    203.     networks:
    204.       - harbor
    205.       - internal-network
    206.     dns_search: .
    207.     depends_on:
    208.       - core
    209.     logging:
    210.       driver: "syslog"
    211.       options:
    212.         syslog-address: "tcp://127.0.0.1:1514"
    213.         tag: "jobservice"
    214.   redis:
    215.     image: goharbor/redis-photon:v2.1.2
    216.     container_name: redis
    217.     restart: always
    218.     cap_drop:
    219.       - ALL
    220.     cap_add:
    221.       - CHOWN
    222.       - SETGID
    223.       - SETUID
    224.     volumes:
    225.       - /data/redis:/var/lib/redis
    226.     networks:
    227.       harbor:
    228.     dns_search: .
    229.     depends_on:
    230.       - log
    231.     logging:
    232.       driver: "syslog"
    233.       options:
    234.         syslog-address: "tcp://127.0.0.1:1514"
    235.         tag: "redis"
    237. networks:
    238.   harbor:
    239.     external: false
    240.   internal-network:
    241.     external: true

  3. 在独立的 NGINX 中创建对应的配置文件，在上一步的 YAML 文件内部，我为每个容器指定了 container_name，确保容器名字唯一不会因为外部原因而变动。这个配置文件我是从之前 Harbor 内部的 NGINX 拷贝出来的，直接拿去改吧改吧就能用。

    1. server{
    2.     listen 80;
    3.     server_name 你的域名;
    4.     return 301 https://你的域名$request_uri;
    5. }
    7. server{
    8.     listen 443 ssl;
    9.     server_name 你的域名;
    11.     # disable any limits to avoid HTTP 413 for large image uploads
    12.     client_max_body_size 0;
    14.     # required to avoid HTTP 411: see Issue #1486 (https://github.com/docker/docker/issues/1486)
    15.     chunked_transfer_encoding on;
    17.     # Add extra headers
    18.     add_header Strict-Transport-Security "max-age=31536000; includeSubdomains; preload";
    19.     add_header X-Frame-Options DENY;
    20.     add_header Content-Security-Policy "frame-ancestors \'none\'";
    22.     ssl_certificate   /etc/nginx/ssl/你的域名/full.pem;      # SSL 证书文件的存放路径
    23.     ssl_certificate_key  /etc/nginx/ssl/你的域名/key.pem;   # SSL 密钥文件的存放路径
    25.     ssl_protocols TLSv1.2;
    26.     ssl_ciphers \'!aNULL:kECDH+AESGCM:ECDH+AESGCM:RSA+AESGCM:kECDH+AES:ECDH+AES:RSA+AES:\';
    27.     ssl_prefer_server_ciphers on;
    28.     ssl_session_cache shared:SSL:10m;
    30.     location / {
    31.       proxy_pass http://harbor-portal:8080/;
    32.       proxy_set_header Host $http_host;
    33.       proxy_set_header X-Real-IP $remote_addr;
    34.       proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
    36.       # When setting up Harbor behind other proxy, such as an Nginx instance, remove the below line if the proxy already has similar settings.
    37.       proxy_set_header X-Forwarded-Proto $scheme;
    39.       proxy_cookie_path / "/; HttpOnly; Secure";
    41.       proxy_buffering off;
    42.       proxy_request_buffering off;
    43.     }
    45.     location /c/ {
    46.       proxy_pass http://harbor-core:8080/c/;
    47.       proxy_set_header Host $host;
    48.       proxy_set_header X-Real-IP $remote_addr;
    49.       proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
    51.       # When setting up Harbor behind other proxy, such as an Nginx instance, remove the below line if the proxy already has similar settings.
    52.       proxy_set_header X-Forwarded-Proto $scheme;
    54.       proxy_cookie_path / "/; Secure";
    56.       proxy_buffering off;
    57.       proxy_request_buffering off;
    58.     }
    60.     location /api/ {
    61.       proxy_pass http://harbor-core:8080/api/;
    62.       proxy_set_header Host $host;
    63.       proxy_set_header X-Real-IP $remote_addr;
    64.       proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
    66.       # When setting up Harbor behind other proxy, such as an Nginx instance, remove the below line if the proxy already has similar settings.
    67.       proxy_set_header X-Forwarded-Proto $scheme;
    69.       proxy_cookie_path / "/; Secure";
    71.       proxy_buffering off;
    72.       proxy_request_buffering off;
    73.     }
    75.     location /chartrepo/ {
    76.       proxy_pass http://harbor-core:8080/chartrepo/;
    77.       proxy_set_header Host $host;
    78.       proxy_set_header X-Real-IP $remote_addr;
    79.       proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
    81.       # When setting up Harbor behind other proxy, such as an Nginx instance, remove the below line if the proxy already has similar settings.
    82.       proxy_set_header X-Forwarded-Proto $scheme;
    84.       proxy_cookie_path / "/; Secure";
    86.       proxy_buffering off;
    87.       proxy_request_buffering off;
    88.     }
    90.     location /v1/ {
    91.       return 404;
    92.     }
    94.     location /v2/ {
    95.       proxy_pass http://harbor-core:8080/v2/;
    96.       proxy_set_header Host $http_host;
    97.       proxy_set_header X-Real-IP $remote_addr;
    98.       proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
    100.       # When setting up Harbor behind other proxy, such as an Nginx instance, remove the below line if the proxy already has similar settings.
    101.       proxy_set_header X-Forwarded-Proto $scheme;
    102.       proxy_buffering off;
    103.       proxy_request_buffering off;
    104.       proxy_send_timeout 900;
    105.       proxy_read_timeout 900;
    106.     }
    108.     location /service/ {
    109.       proxy_pass http://harbor-core:8080/service/;
    110.       proxy_set_header Host $http_host;
    111.       proxy_set_header X-Real-IP $remote_addr;
    112.       proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
    114.       # When setting up Harbor behind other proxy, such as an Nginx instance, remove the below line if the proxy already has similar settings.
    115.       proxy_set_header X-Forwarded-Proto $scheme;
    117.       proxy_cookie_path / "/; Secure";
    119.       proxy_buffering off;
    120.       proxy_request_buffering off;
    121.     }
    123.     location /service/notifications {
    124.       return 404;
    125.     }
    126. }

这里我使用的是 acme.sh 申请的泛解析 SSL 证书。

版权声明：本文为myzony原创文章，遵循 CC 4.0 BY-SA 版权协议，转载请附上原文出处链接和本声明。
本文链接：https://www.cnblogs.com/myzony/p/14229597.html