Switch from legacy, rootful registry to rootless CNCF distribution

2 files changed, 16 insertions, 23 deletions

diff --git a/meta-unit-core/dynamic-layers/virtualization-layer/recipes-core/systemd/systemd-regkeygen/regkeygen.service b/meta-unit-core/dynamic-layers/virtualization-layer/recipes-core/systemd/systemd-regkeygen/regkeygen.service
index 07c2b87..6f1eca2 100644
--- a/meta-unit-core/dynamic-layers/virtualization-layer/recipes-core/systemd/systemd-regkeygen/regkeygen.service
+++ b/meta-unit-core/dynamic-layers/virtualization-layer/recipes-core/systemd/systemd-regkeygen/regkeygen.service
@@ -1,13 +1,12 @@
 [Unit]
-Description=Generate registry TLS keys for device
-ConditionPathExists=!/etc/registry/domain.crt
-ConditionPathExists=!/etc/registry/domain.key
-After=time-sync.target
-Wants=time-sync.target systemd-time-wait-sync.service
+Description=Generate distribution TLS keys
+ConditionPathExists=!%h/.config/containers/distribution/certs/domain.crt
+ConditionPathExists=!%h/.config/containers/distribution/certs/domain.key
 
 [Service]
 Type=oneshot
-ExecStart=/usr/bin/regkeygen.sh
+Environment="XDG_CONFIG_HOME=%h/.config"
+ExecStart=%h/bin/regkeygen.sh
 
 [Install]
-WantedBy=multi-user.target
+WantedBy=default.target
diff --git a/meta-unit-core/dynamic-layers/virtualization-layer/recipes-core/systemd/systemd-regkeygen/regkeygen.sh b/meta-unit-core/dynamic-layers/virtualization-layer/recipes-core/systemd/systemd-regkeygen/regkeygen.sh
index 5edf519..e929194 100644
--- a/meta-unit-core/dynamic-layers/virtualization-layer/recipes-core/systemd/systemd-regkeygen/regkeygen.sh
+++ b/meta-unit-core/dynamic-layers/virtualization-layer/recipes-core/systemd/systemd-regkeygen/regkeygen.sh
@@ -2,32 +2,26 @@
 
 set -e
 
-echo "Generating TLS certificate and key for local registry..."
+echo "Generating TLS certificate and key for distribution..."
 
-mkdir -p /etc/registry
+mkdir -p "$XDG_CONFIG_HOME/containers/distribution/certs"
 openssl req -x509 -newkey ec \
     -pkeyopt ec_paramgen_curve:P-256 \
-    -keyout /etc/registry/domain.key \
-    -out /etc/registry/domain.crt \
+    -keyout "$XDG_CONFIG_HOME/containers/distribution/certs/domain.key" \
+    -out "$XDG_CONFIG_HOME/containers/distribution/certs/domain.crt" \
     -days 365 \
     -nodes \
-    -subj '/C=US/ST=Minnesota/L=St. Paul/O=Closed Circuit Consulting/OU=/CN=localhost/emailAddress=unitexe70@gmail.com' \
+    -subj '/C=US/ST=Minnesota/L=St. Paul/O=Closed Circuit Consulting/OU=R&D/CN=localhost/emailAddress=unitexe70@gmail.com' \
     -addext 'subjectAltName=DNS:localhost,IP:127.0.0.1,IP:::1'
 
 echo "Setting permissions on generated artifacts..."
 
-chmod 640 /etc/registry/domain.key
-chmod 644 /etc/registry/domain.crt
+chmod 644 "$XDG_CONFIG_HOME/containers/distribution/certs/domain.key"
+chmod 644 "$XDG_CONFIG_HOME/containers/distribution/certs/domain.crt"
 
-echo "Adding CA to system trust store..."
+echo "Adding CA to user containers trust store..."
 
-mkdir -p /usr/local/share/ca-certificates
-cp /etc/registry/domain.crt /usr/local/share/ca-certificates/registry.crt
-update-ca-certificates
-
-echo "Adding CA to containers trust store..."
-
-mkdir -p /etc/containers/certs.d/localhost:5000/
-cp /etc/registry/domain.crt /etc/containers/certs.d/localhost:5000/ca.crt
+mkdir -p "$XDG_CONFIG_HOME/containers/localhost:5000/"
+cp "$XDG_CONFIG_HOME/containers/distribution/certs/domain.crt" "$XDG_CONFIG_HOME/containers/localhost:5000/ca.crt"
 
 echo "Registry TLS configuration created and ready for use"