Nexus docker repository behind nginx reverse-proxy

Viewed 2844

I try to setup nexus docker repository behind nginx reverse-proxy (with a self-signed SSL certificate). I use this official docker-compose file:

https://github.com/sonatype-nexus-community/docker-nginx-nexus-repository

After installing docker-compose I eventually was able to launch the two containers: nexus3 and nginx with ./nexus.sh. It took me several attempts as I had to change nexus pasword to admin123 and add nexus.scripts.allowCreation=true inside of the docker-nginx-nexus-repository_nexus-repository_1 container (in /nexus-data/etc/nexus.properties) otherwise curl -v -u admin:admin123 --insecure --header 'Content-Type: application/json' 'https://localhost/service/rest/v1/script' -d @nexus-repository/create-docker-proxy.json would fail. At the end I had nexus with docker-proxy repository on http port 5000 pointing on DockerHub.

Furthermore on the host I added:

cat /etc/docker/daemon.json 
{
  "insecure-registries": ["10.97.7.95:5000"]
}

And:

cat /etc/systemd/system/docker.service.d/http-proxy.conf
[Service]
Environment="HTTPS_PROXY=https://10.97.7.95:5000/"

And restarted docker.

However once I try to pull some images while being on the host, I get follwoing errors:

# docker pull 10.97.7.95:5000/hello-world
Using default tag: latest
Error response from daemon: error parsing HTTP 400 response body: invalid character '<' looking for beginning of value: "<html>\r\n<head><title>400 The plain HTTP request was sent to HTTPS port</title></head>\r\n<body>\r\n<center><h1>400 Bad Request</h1></center>\r\n<center>The plain HTTP request was sent to HTTPS port</center>\r\n<hr><center>nginx/1.19.0</center>\r\n</body>\r\n</html>\r\n"

docker logs -f docker-nginx-nexus-repository_nginx-proxy_1 shows:

172.18.0.1 - - [05/Jul/2020:16:21:08 +0000] "CONNECT 10.97.7.95:5000 HTTP/1.1" 400 157 "-" "-"
172.18.0.1 - - [05/Jul/2020:16:21:08 +0000] "GET /v2/ HTTP/1.1" 400 255 "-" "docker/19.03.8 go/go1.12.17 git-commit/afacb8b7f0 kernel/4.19.0-6-amd64 os/linux arch/amd64 UpstreamClient(Docker-Client/19.03.8 \x5C(linux\x5C))"
172.18.0.1 - - [05/Jul/2020:16:21:08 +0000] "GET /v2/hello-world/manifests/latest HTTP/1.1" 400 255 "-" "docker/19.03.8 go/go1.12.17 git-commit/afacb8b7f0 kernel/4.19.0-6-amd64 os/linux arch/amd64 UpstreamClient(Docker-Client/19.03.8 \x5C(linux\x5C))"

also:

# docker login 10.97.7.95:5000
Username: admin
Password: 
Error response from daemon: login attempt to http://10.97.7.95:5000/v2/ failed with status: 400 Bad Request

What do I miss?

1 Answers

Your own docker-repository is running behind the reverse-proxy setup with nginx. That has ssl enabled, if you didn't change the nginx.conf from the Github repo you posted. It says in line 25:

ssl on;

nginx will respond with HTTP 400 - Bad Request if you try to access an HTTPS endpoint with plain HTTP.

Related