{"action":"created","issue":{"url":"https://api.github.com/repos/docker/distribution/issues/1897","repository_url":"https://api.github.com/repos/docker/distribution","labels_url":"https://api.github.com/repos/docker/distribution/issues/1897/labels{/name}","comments_url":"https://api.github.com/repos/docker/distribution/issues/1897/comments","events_url":"https://api.github.com/repos/docker/distribution/issues/1897/events","html_url":"https://github.com/docker/distribution/issues/1897","id":170540407,"number":1897,"title":"Support configuring registry as a reverse proxy for Notary","user":{"login":"vikstrous","id":482425,"avatar_url":"https://avatars.githubusercontent.com/u/482425?v=3","gravatar_id":"","url":"https://api.github.com/users/vikstrous","html_url":"https://github.com/vikstrous","followers_url":"https://api.github.com/users/vikstrous/followers","following_url":"https://api.github.com/users/vikstrous/following{/other_user}","gists_url":"https://api.github.com/users/vikstrous/gists{/gist_id}","starred_url":"https://api.github.com/users/vikstrous/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/vikstrous/subscriptions","organizations_url":"https://api.github.com/users/vikstrous/orgs","repos_url":"https://api.github.com/users/vikstrous/repos","events_url":"https://api.github.com/users/vikstrous/events{/privacy}","received_events_url":"https://api.github.com/users/vikstrous/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":2,"created_at":"2016-08-10T23:14:26Z","updated_at":"2016-08-15T22:58:11Z","closed_at":null,"body":"When using a private registry, by default Notary uses the same hostname to connect to Notary as the hostname of the registry. Alternatively the notary client/ docker client can be configured to use a different domain for the Notary server.\r\n\r\nTo simplify configuration and remove the need for an extra load balancer I would like to be able to configure registry to act as a proxy for Notary.\r\n\r\nThis would require the following configs:\r\n\r\n* URL\r\n* CA\r\n* insecure TLS option\r\n\r\nI imagine this looking something like this in the yaml config:\r\n\r\n```\r\nnotary-proxy:\r\n  url: https://example.com\r\n  ca-path: /place/with/certs/cert.pem\r\n  ca-cert: |\r\n    aaaaaaaaaaaaaaa\r\n    aaaaaaaaaaaaaaaa\r\n  insecure-tls: false\r\n```\r\n\r\nca-cert would take precedence over ca-path and insecure-tls would take precedence over both.\r\n\r\nI would prefer for a non https option to not be available since notary server itself does not support non-encrypted connections anyway.\r\n\r\nWhat do you guys think?"},"comment":{"url":"https://api.github.com/repos/docker/distribution/issues/comments/239954188","html_url":"https://github.com/docker/distribution/issues/1897#issuecomment-239954188","issue_url":"https://api.github.com/repos/docker/distribution/issues/1897","id":239954188,"user":{"login":"vikstrous","id":482425,"avatar_url":"https://avatars.githubusercontent.com/u/482425?v=3","gravatar_id":"","url":"https://api.github.com/users/vikstrous","html_url":"https://github.com/vikstrous","followers_url":"https://api.github.com/users/vikstrous/followers","following_url":"https://api.github.com/users/vikstrous/following{/other_user}","gists_url":"https://api.github.com/users/vikstrous/gists{/gist_id}","starred_url":"https://api.github.com/users/vikstrous/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/vikstrous/subscriptions","organizations_url":"https://api.github.com/users/vikstrous/orgs","repos_url":"https://api.github.com/users/vikstrous/repos","events_url":"https://api.github.com/users/vikstrous/events{/privacy}","received_events_url":"https://api.github.com/users/vikstrous/received_events","type":"User","site_admin":false},"created_at":"2016-08-15T22:58:11Z","updated_at":"2016-08-15T22:58:11Z","body":"1. I would prefer to error out and refuse to start if an http url is provided\r\n2. Insecure TLS is essential for dev workflows. It makes it faster to iterate on things and I don't need to build some system for copying certs around during dev."}}
{"actor":{"display_login":"vikstrous"}}