@@ -140,6 +140,14 @@ let
140140 port = 3807;
141141 };
142142 };
143+ registry = lib.optionalAttrs cfg.registry.enable {
144+ enabled = true;
145+ host = cfg.registry.externalAddress;
146+ port = cfg.registry.externalPort;
147+ key = cfg.registry.keyFile;
148+ api_url = "http://${config.services.dockerRegistry.listenAddress}:${toString config.services.dockerRegistry.port}/";
149+ issuer = "gitlab-issuer";
150+ };
143151 extra = {};
144152 uploads.storage_path = cfg.statePath;
145153 };
@@ -516,6 +524,58 @@ in {
516524 '';
517525 };
518526
527+ registry = {
528+ enable = mkOption {
529+ type = types.bool;
530+ default = false;
531+ description = "Enable GitLab container registry.";
532+ };
533+ host = mkOption {
534+ type = types.str;
535+ default = config.services.gitlab.host;
536+ description = "GitLab container registry host name.";
537+ };
538+ port = mkOption {
539+ type = types.int;
540+ default = 4567;
541+ description = "GitLab container registry port.";
542+ };
543+ certFile = mkOption {
544+ type = types.path;
545+ default = null;
546+ description = "Path to GitLab container registry certificate.";
547+ };
548+ keyFile = mkOption {
549+ type = types.path;
550+ default = null;
551+ description = "Path to GitLab container registry certificate-key.";
552+ };
553+ defaultForProjects = mkOption {
554+ type = types.bool;
555+ default = cfg.registry.enable;
556+ description = "If GitLab container registry should be enabled by default for projects.";
557+ };
558+ issuer = mkOption {
559+ type = types.str;
560+ default = "gitlab-issuer";
561+ description = "GitLab container registry issuer.";
562+ };
563+ serviceName = mkOption {
564+ type = types.str;
565+ default = "container_registry";
566+ description = "GitLab container registry service name.";
567+ };
568+ externalAddress = mkOption {
569+ type = types.str;
570+ default = "";
571+ description = "External address used to access registry from the internet";
572+ };
573+ externalPort = mkOption {
574+ type = types.int;
575+ description = "External port used to access registry from the internet";
576+ };
577+ };
578+
519579 smtp = {
520580 enable = mkOption {
521581 type = types.bool;
@@ -909,6 +969,44 @@ in {
909969 };
910970 };
911971
972+ systemd.services.gitlab-registry-cert = optionalAttrs cfg.registry.enable {
973+ path = with pkgs; [ openssl ];
974+
975+ script = ''
976+ mkdir -p $(dirname ${cfg.registry.keyFile})
977+ mkdir -p $(dirname ${cfg.registry.certFile})
978+ openssl req -nodes -newkey rsa:4096 -keyout ${cfg.registry.keyFile} -out /tmp/registry-auth.csr -subj "/CN=${cfg.registry.issuer}"
979+ openssl x509 -in /tmp/registry-auth.csr -out ${cfg.registry.certFile} -req -signkey ${cfg.registry.keyFile} -days 3650
980+ chown ${cfg.user}:${cfg.group} $(dirname ${cfg.registry.keyFile})
981+ chown ${cfg.user}:${cfg.group} $(dirname ${cfg.registry.certFile})
982+ chown ${cfg.user}:${cfg.group} ${cfg.registry.keyFile}
983+ chown ${cfg.user}:${cfg.group} ${cfg.registry.certFile}
984+ '';
985+
986+ serviceConfig = {
987+ ConditionPathExists = "!${cfg.registry.certFile}";
988+ };
989+ };
990+
991+ # Ensure Docker Registry launches after the certificate generation job
992+ systemd.services.docker-registry = optionalAttrs cfg.registry.enable {
993+ wants = [ "gitlab-registry-cert.service" ];
994+ };
995+
996+ # Enable Docker Registry, if GitLab-Container Registry is enabled
997+ services.dockerRegistry = optionalAttrs cfg.registry.enable {
998+ enable = true;
999+ enableDelete = true; # This must be true, otherwise GitLab won't manage it correctly
1000+ extraConfig = {
1001+ auth.token = {
1002+ realm = "http${if cfg.https == true then "s" else ""}://${cfg.host}/jwt/auth";
1003+ service = cfg.registry.serviceName;
1004+ issuer = cfg.registry.issuer;
1005+ rootcertbundle = cfg.registry.certFile;
1006+ };
1007+ };
1008+ };
1009+
9121010 # Use postfix to send out mails.
9131011 services.postfix.enable = mkDefault (cfg.smtp.enable && cfg.smtp.address == "localhost");
9141012