2021-06-08 15:11:18 -05:00
|
|
|
package config
|
2019-06-20 18:36:40 -05:00
|
|
|
|
|
|
|
import (
|
2021-05-13 13:59:12 -05:00
|
|
|
"fmt"
|
|
|
|
|
2019-08-15 11:34:54 -05:00
|
|
|
"github.com/getlantern/deepcopy"
|
2021-05-21 15:47:28 -05:00
|
|
|
distspec "github.com/opencontainers/distribution-spec/specs-go"
|
2021-05-13 13:59:12 -05:00
|
|
|
"github.com/spf13/viper"
|
2021-12-03 22:50:58 -05:00
|
|
|
"zotregistry.io/zot/errors"
|
|
|
|
extconf "zotregistry.io/zot/pkg/extensions/config"
|
|
|
|
"zotregistry.io/zot/pkg/log"
|
2019-06-20 18:36:40 -05:00
|
|
|
)
|
|
|
|
|
2021-02-12 19:52:02 -05:00
|
|
|
var (
|
|
|
|
Commit string // nolint: gochecknoglobals
|
|
|
|
BinaryType string // nolint: gochecknoglobals
|
2021-10-15 10:05:00 -05:00
|
|
|
GoVersion string // nolint: gochecknoglobals
|
2021-02-12 19:52:02 -05:00
|
|
|
)
|
2019-09-16 13:01:59 -05:00
|
|
|
|
2019-06-20 18:36:40 -05:00
|
|
|
type StorageConfig struct {
|
|
|
|
RootDirectory string
|
2020-04-15 18:24:05 -05:00
|
|
|
GC bool
|
|
|
|
Dedupe bool
|
2021-07-16 22:53:05 -05:00
|
|
|
StorageDriver map[string]interface{} `mapstructure:",omitempty"`
|
2019-06-20 18:36:40 -05:00
|
|
|
}
|
|
|
|
|
|
|
|
type TLSConfig struct {
|
|
|
|
Cert string
|
|
|
|
Key string
|
|
|
|
CACert string
|
|
|
|
}
|
|
|
|
|
|
|
|
type AuthHTPasswd struct {
|
|
|
|
Path string
|
|
|
|
}
|
|
|
|
|
|
|
|
type AuthConfig struct {
|
|
|
|
FailDelay int
|
|
|
|
HTPasswd AuthHTPasswd
|
2019-08-15 11:34:54 -05:00
|
|
|
LDAP *LDAPConfig
|
2020-01-24 16:32:38 -05:00
|
|
|
Bearer *BearerConfig
|
|
|
|
}
|
|
|
|
|
|
|
|
type BearerConfig struct {
|
|
|
|
Realm string
|
|
|
|
Service string
|
|
|
|
Cert string
|
2019-06-20 18:36:40 -05:00
|
|
|
}
|
|
|
|
|
|
|
|
type HTTPConfig struct {
|
2021-05-13 13:59:12 -05:00
|
|
|
Address string
|
|
|
|
Port string
|
|
|
|
TLS *TLSConfig
|
|
|
|
Auth *AuthConfig
|
|
|
|
RawAccessControl map[string]interface{} `mapstructure:"accessControl,omitempty"`
|
|
|
|
Realm string
|
|
|
|
AllowReadAccess bool `mapstructure:",omitempty"`
|
|
|
|
ReadOnly bool `mapstructure:",omitempty"`
|
2019-06-20 18:36:40 -05:00
|
|
|
}
|
|
|
|
|
2019-08-15 11:34:54 -05:00
|
|
|
type LDAPConfig struct {
|
|
|
|
Port int
|
|
|
|
Insecure bool
|
|
|
|
StartTLS bool // if !Insecure, then StartTLS or LDAPs
|
|
|
|
SkipVerify bool
|
|
|
|
SubtreeSearch bool
|
|
|
|
Address string
|
|
|
|
BindDN string
|
|
|
|
BindPassword string
|
|
|
|
BaseDN string
|
|
|
|
UserAttribute string
|
|
|
|
CACert string
|
|
|
|
}
|
|
|
|
|
2019-06-20 18:36:40 -05:00
|
|
|
type LogConfig struct {
|
|
|
|
Level string
|
|
|
|
Output string
|
2021-05-25 03:38:21 -05:00
|
|
|
Audit string
|
2019-06-20 18:36:40 -05:00
|
|
|
}
|
|
|
|
|
2021-04-05 19:40:33 -05:00
|
|
|
type GlobalStorageConfig struct {
|
|
|
|
RootDirectory string
|
|
|
|
Dedupe bool
|
|
|
|
GC bool
|
2021-07-16 22:53:05 -05:00
|
|
|
StorageDriver map[string]interface{} `mapstructure:",omitempty"`
|
2021-04-05 19:40:33 -05:00
|
|
|
SubPaths map[string]StorageConfig
|
|
|
|
}
|
|
|
|
|
2021-06-08 15:11:18 -05:00
|
|
|
type AccessControlConfig struct {
|
|
|
|
Repositories Repositories
|
|
|
|
AdminPolicy Policy
|
|
|
|
}
|
|
|
|
|
|
|
|
type Repositories map[string]PolicyGroup
|
|
|
|
|
|
|
|
type PolicyGroup struct {
|
|
|
|
Policies []Policy
|
|
|
|
DefaultPolicy []string
|
|
|
|
}
|
|
|
|
|
|
|
|
type Policy struct {
|
|
|
|
Users []string
|
|
|
|
Actions []string
|
|
|
|
}
|
|
|
|
|
2019-06-20 18:36:40 -05:00
|
|
|
type Config struct {
|
2021-05-13 13:59:12 -05:00
|
|
|
Version string
|
2021-10-15 10:05:00 -05:00
|
|
|
GoVersion string
|
2021-05-13 13:59:12 -05:00
|
|
|
Commit string
|
|
|
|
BinaryType string
|
|
|
|
AccessControl *AccessControlConfig
|
|
|
|
Storage GlobalStorageConfig
|
|
|
|
HTTP HTTPConfig
|
|
|
|
Log *LogConfig
|
2021-06-08 15:11:18 -05:00
|
|
|
Extensions *extconf.ExtensionConfig
|
2019-06-20 18:36:40 -05:00
|
|
|
}
|
|
|
|
|
2021-06-08 15:11:18 -05:00
|
|
|
func New() *Config {
|
2019-06-20 18:36:40 -05:00
|
|
|
return &Config{
|
2021-05-21 15:47:28 -05:00
|
|
|
Version: distspec.Version,
|
2021-10-15 10:05:00 -05:00
|
|
|
GoVersion: GoVersion,
|
2021-02-12 19:52:02 -05:00
|
|
|
Commit: Commit,
|
|
|
|
BinaryType: BinaryType,
|
2021-04-05 19:40:33 -05:00
|
|
|
Storage: GlobalStorageConfig{GC: true, Dedupe: true},
|
2021-02-12 19:52:02 -05:00
|
|
|
HTTP: HTTPConfig{Address: "127.0.0.1", Port: "8080"},
|
|
|
|
Log: &LogConfig{Level: "debug"},
|
2019-08-15 11:34:54 -05:00
|
|
|
}
|
|
|
|
}
|
|
|
|
|
2020-05-11 17:13:24 -05:00
|
|
|
// Sanitize makes a sanitized copy of the config removing any secrets.
|
2019-08-15 11:34:54 -05:00
|
|
|
func (c *Config) Sanitize() *Config {
|
2021-12-13 14:23:31 -05:00
|
|
|
sanitizedConfig := &Config{}
|
|
|
|
if err := deepcopy.Copy(sanitizedConfig, c); err != nil {
|
2021-06-08 15:11:18 -05:00
|
|
|
panic(err)
|
|
|
|
}
|
2019-12-13 00:53:18 -05:00
|
|
|
|
2021-06-08 15:11:18 -05:00
|
|
|
if c.HTTP.Auth != nil && c.HTTP.Auth.LDAP != nil && c.HTTP.Auth.LDAP.BindPassword != "" {
|
2021-12-13 14:23:31 -05:00
|
|
|
sanitizedConfig.HTTP.Auth.LDAP = &LDAPConfig{}
|
2019-12-13 00:53:18 -05:00
|
|
|
|
2021-12-13 14:23:31 -05:00
|
|
|
if err := deepcopy.Copy(sanitizedConfig.HTTP.Auth.LDAP, c.HTTP.Auth.LDAP); err != nil {
|
2019-08-15 11:34:54 -05:00
|
|
|
panic(err)
|
|
|
|
}
|
2019-12-13 00:53:18 -05:00
|
|
|
|
2021-12-13 14:23:31 -05:00
|
|
|
sanitizedConfig.HTTP.Auth.LDAP.BindPassword = "******"
|
2019-08-15 11:34:54 -05:00
|
|
|
}
|
2019-12-13 00:53:18 -05:00
|
|
|
|
2021-12-13 14:23:31 -05:00
|
|
|
return sanitizedConfig
|
2019-08-15 11:34:54 -05:00
|
|
|
}
|
|
|
|
|
2019-11-25 17:33:58 -05:00
|
|
|
func (c *Config) Validate(log log.Logger) error {
|
2019-08-15 11:34:54 -05:00
|
|
|
// LDAP configuration
|
|
|
|
if c.HTTP.Auth != nil && c.HTTP.Auth.LDAP != nil {
|
|
|
|
l := c.HTTP.Auth.LDAP
|
|
|
|
if l.UserAttribute == "" {
|
|
|
|
log.Error().Str("userAttribute", l.UserAttribute).Msg("invalid LDAP configuration")
|
2021-12-13 14:23:31 -05:00
|
|
|
|
2019-08-15 11:34:54 -05:00
|
|
|
return errors.ErrLDAPConfig
|
|
|
|
}
|
2019-06-20 18:36:40 -05:00
|
|
|
}
|
2019-12-13 00:53:18 -05:00
|
|
|
|
2019-08-15 11:34:54 -05:00
|
|
|
return nil
|
2019-06-20 18:36:40 -05:00
|
|
|
}
|
2021-05-13 13:59:12 -05:00
|
|
|
|
|
|
|
// LoadAccessControlConfig populates config.AccessControl struct with values from config.
|
2021-09-10 10:23:26 -05:00
|
|
|
func (c *Config) LoadAccessControlConfig(viperInstance *viper.Viper) error {
|
2021-05-13 13:59:12 -05:00
|
|
|
if c.HTTP.RawAccessControl == nil {
|
|
|
|
return nil
|
|
|
|
}
|
|
|
|
|
|
|
|
c.AccessControl = &AccessControlConfig{}
|
|
|
|
c.AccessControl.Repositories = make(map[string]PolicyGroup)
|
|
|
|
|
2021-12-13 14:23:31 -05:00
|
|
|
for policy := range c.HTTP.RawAccessControl {
|
2021-05-13 13:59:12 -05:00
|
|
|
var policies []Policy
|
|
|
|
|
|
|
|
var policyGroup PolicyGroup
|
|
|
|
|
2021-12-13 14:23:31 -05:00
|
|
|
if policy == "adminpolicy" {
|
2021-09-10 10:23:26 -05:00
|
|
|
adminPolicy := viperInstance.GetStringMapStringSlice("http::accessControl::adminPolicy")
|
2021-05-13 13:59:12 -05:00
|
|
|
c.AccessControl.AdminPolicy.Actions = adminPolicy["actions"]
|
|
|
|
c.AccessControl.AdminPolicy.Users = adminPolicy["users"]
|
|
|
|
|
|
|
|
continue
|
|
|
|
}
|
|
|
|
|
2021-09-10 10:23:26 -05:00
|
|
|
err := viperInstance.UnmarshalKey(fmt.Sprintf("http::accessControl::%s::policies", policy), &policies)
|
2021-05-13 13:59:12 -05:00
|
|
|
if err != nil {
|
|
|
|
return err
|
|
|
|
}
|
|
|
|
|
2021-09-10 10:23:26 -05:00
|
|
|
defaultPolicy := viperInstance.GetStringSlice(fmt.Sprintf("http::accessControl::%s::defaultPolicy", policy))
|
2021-05-13 13:59:12 -05:00
|
|
|
policyGroup.Policies = policies
|
|
|
|
policyGroup.DefaultPolicy = defaultPolicy
|
2021-12-13 14:23:31 -05:00
|
|
|
c.AccessControl.Repositories[policy] = policyGroup
|
2021-05-13 13:59:12 -05:00
|
|
|
}
|
|
|
|
|
|
|
|
return nil
|
|
|
|
}
|