diff --git a/assets/admin-settings-authentication-basic.png b/assets/admin-settings-authentication-basic.png index 9eb3a1207f..d8e45ff9fb 100644 Binary files a/assets/admin-settings-authentication-basic.png and b/assets/admin-settings-authentication-basic.png differ diff --git a/assets/admin-settings-security.png b/assets/admin-settings-security.png index a33a0d1432..c172f440d5 100644 Binary files a/assets/admin-settings-security.png and b/assets/admin-settings-security.png differ diff --git a/assets/admin-settings-storage.png b/assets/admin-settings-storage.png index 96d640c9c1..72f4827006 100644 Binary files a/assets/admin-settings-storage.png and b/assets/admin-settings-storage.png differ diff --git a/assets/admin-settings.png b/assets/admin-settings.png index 486340ccf6..ed486788b6 100644 Binary files a/assets/admin-settings.png and b/assets/admin-settings.png differ diff --git a/configuration.md b/configuration.md index c5281bc116..a8bede00ac 100644 --- a/configuration.md +++ b/configuration.md @@ -1,4 +1,3 @@ - +++ title = "Configuration options" description = "Configuration instructions for Docker Trusted Registry" @@ -11,36 +10,46 @@ weight=5 # Configuring Docker Trusted Registry -## Overview - -Use this documentation to configure Docker Trusted Registry so it can +Use this documentation to configure Docker Trusted Registry so it can run in your environment. -Start with Docker Trusted Registry loaded in your browser and select "Settings" in the global nav -bar at the top of the page to view configuration options. You see menus -organizing the options for configuring: +## Overview + +To start, navigate to the Trusted Registry user interface (UI) > Settings to view configuration options. Configuring is grouped by the following: * General Settings (for example, ports and proxies) * Security settings * Storage settings -* Your Docker Trusted Registry license +* License * Authentication settings +* Garbage collection +* Updates -> **Note:** -> Saving changes you've made to settings may restart various services, as follows: -> * General settings: full Docker Trusted Registry restart -> * License change: full Docker Trusted Registry restart -> * SSL change: Nginx reload -> * Storage config: only registries restart -> * Authentication config: no restart + **Note**: + Saving changes you've made to settings may restart various services, as follows: + * General settings: full Docker Trusted Registry restart + * License change: full Docker Trusted Registry restart + * SSL change: Nginx reload + * Storage config: only registries restart + * Authentication config: no restart ## General Settings ![Domain and Ports page](assets/admin-settings.png) + Each setting on this page is explained in the Docker Trusted Registry UI. +* Domain Name*: **required** defaults to an empty string, the fully qualified domain name assigned to the Docker Trusted Registry host. +* HTTP Port*: defaults to 80, used as the entry point for the image storage service. To see load balancer status, you can query +http://<dtr-host>/load_balancer_status. +* HTTPS Port*: defaults to 443, used as the secure entry point for the image storage service. +* HTTP proxy*: defaults to an empty string, proxy server for HTTP requests. +* HTTPS proxy*: defaults to an empty string, proxy server for HTTPS requests. +* No proxy*: defaults to an empty string, proxy bypass for HTTP and HTTPS requests. +* Upgrade checking*: enables or disables automatic checking for Docker Trusted Registry software updates. + > **Note**: If you need Docker Trusted Registry to re-generate a self-signed certificate at some > point, you can change the domain name. Whenever the domain name does not match the current certificate, > a new self-signed certificate will be generated for the new domain. This also works with IP addresses. @@ -96,13 +105,13 @@ In order to run, Docker Trusted Registry requires encrypted communications via H If you are generating your own certificates, you can install them by following the instructions for [Adding your own registry certificates to Docker Trusted Registry](#adding-your-own-registry-certificates-to-dtr). -On the other hand, if you choose to use the Docker Trusted Registry-generated certificates, or the -certificates you generate yourself are not trusted by your client Docker hosts, -you will need to do one of the following: +However, if you choose to use the Trusted Registry-generated certificates, or +the certificates you generate yourself are not trusted by your client Docker +hosts, you will need to do one of the following: -* [Install a registry certificate on all of your client Docker daemons](#installing-registry-certificates-on-client-docker-daemons), +* [Install](#installing-registry-certificates-on-client-docker-daemons) a registry certificate on all of your client Docker daemons -* Set your [client Docker daemons to run with an unconfirmed connection to the registry](#if-you-can-t-install-the-certificates). +* Set your [client Docker daemons](#if-you-can-t-install-the-certificates) to run with an unconfirmed connection to the registry. ### Generating SSL certificates @@ -119,35 +128,36 @@ certificate. If your certificates are generated using a globally trusted Certificate Authority, you won't need to install them on all of your client Docker daemons. -3. Use the self-signed registry certificate generated by Docker Trusted Registry, and install it -onto the client Docker daemon hosts as shown below. +3. Use the self-signed registry certificate generated by Docker Trusted +Registry, and install it onto the client Docker daemon hosts as seen in the +following section. ### Adding your own Registry certificates to Docker Trusted Registry -Whichever method you use to generate certificates, once you have them -you can set up your Docker Trusted Registry server to use them by navigating to the "Settings" page, -going to "Security," and putting the SSL Certificate text (including all -intermediate Certificates, starting with the host) into the -"SSL Certificate" edit box, and the previously generated Private key into -the "SSL Private Key" edit box. +Whichever method you use to generate certificates, once you have them you can +set up your Docker Trusted Registry server to use them by navigating to the +"Settings" page, going to "Security," and putting the SSL Certificate text +(including all intermediate Certificates, starting with the host) into the "SSL +Certificate" edit box, and the previously generated Private key into the "SSL +Private Key" edit box. -Click the "Save" button, and then wait for the Docker Trusted Registry Admin site to restart and -reload. It should now be using the new certificate. +Click Save, and then wait for the Docker Trusted Registry Admin site to restart +and reload. It should now be using the new certificate. -Once the "Security" page has reloaded, it will show `#` hashes instead of the +Once the "Security" page has reloaded, it shows `#` hashes instead of the certificate text you pasted in. If your certificate is signed by a chain of Certificate Authorities that are -already trusted by your Docker daemon servers, you can skip the "Installing -registry certificates" step below. +already trusted by your Docker daemon servers, you can skip the following +"Installing registry certificates" step. ### Installing Registry certificates on client Docker daemons If your certificates do not have a trusted Certificate Authority, you will need to install them on each client Docker daemon host. -The procedure for installing the Docker Trusted Registry certificates on each Linux distribution has -slightly different steps, as shown below. +The procedure for installing the Docker Trusted Registry certificates on each +Linux distribution has slightly different steps. You can test this certificate using `curl`: @@ -306,16 +316,23 @@ API](http://docs.docker.com/registry/storagedrivers/#storage-driver-api). ![Storage settings page](assets/admin-settings-storage.png) -After you select the image storage method you would like to use from the drop-down menu -near the top of the page, the UI will change to reflect the configuration settings -appropriate to the selected method. +After you select the image storage method you would like to use from the +drop-down menu near the top of the page, the UI changes to reflect the +configuration settings appropriate to the selected method. You can either use +the storage specific input boxes to configure the most common settngs for local +filesystem, S3, or Azure storage backends, or use the full Yaml configuration +file upload to have more detailed control. -You can either use the storage specific input boxes to configure the most common settngs -for local filesystem, S3, or Azure storage backends, -or use the full Yaml configuration file upload to have more detailed control. -You can view the current `storage.yaml` file on your Docker Trusted Registry Docker host in the `/usr/local/etc/dtr/` -directory. +You can either use the storage specific input boxes to configure the most common +settngs for local filesystem, S3, or Azure storage backends, or use the full +Yaml configuration file upload to have more detailed control. + +**Note**: Changing your storage backend requires you to restart the Trusted Registry. + + +You can view the current `storage.yaml` file on your Docker Trusted Registry +Docker host in the `/usr/local/etc/dtr/` directory. ### Filesystem settings @@ -331,23 +348,26 @@ The [S3 storage backend](/registry/configuration/#s3) page allows you to set the ### Azure settings -The [Azure storage backend](/registry/configuration/#azure) page allows you to set -the "Account name", "Account key", "Container", and "Realm". +Set the "Account name", "Account key", "Container", and "Realm" on the [Azure storage backend](/registry/configuration/#azure) page. + +