Installing Customizer Lite

System Requirements

For Customizer Lite (with a single Docker instance), a single virtual machine (4 CPU, 2.x GHZ, 8GB memory, and at least 100GB disk) with a x86_64 Linux OS. Use two (or more) of these virtual machines to configure for Customizer Lite HA deployment.

Customizer Lite has been validated to run on RHEL 7.6/CentOS 7.6 using: Docker 17.03.x configured with devicemapper storage Docker-Compose version 1.22.

Docker

yum-config-manager --setopt="docker-ce-stable.baseurl=https://download.docker.com/linux/centos/7/x86_64/stable" --save

Docker Registry

1. Create shared directories for TLS certificates.
   Run the following commands (adopt the paths to your directory) to create directories where the self-signed certificates for the Docker registry will be stored:

   Note: For Customizer Lite HA, choose a directory on an NFS share or similar to make the certificates in the directories available on all Docker servers.

   mkdir -p /opt/HCL-Shared/docker-registry
   mkdir /opt/HCL-Shared/docker-registry/{auth,certs,registry}

2. Encrypt the password for the Docker registry "admin" user using httpasswd:

   docker run --entrypoint htpasswd registry:2.7.0 -Bbn admin '[ADMIN USER PASSWORD]' > /opt/HCL-Shared/docker-registry/auth/htpasswd
   docker system prune -a

   Note: "registry:2.7.0" was the last Docker registry image version, where the httpasswd command was still included. Thus, we explicitly use this version to create the httpasswd file and delete that image afterwards.
3. Create self-signed certificates for the Docker registry:
   1. Create a working directory:

      mkdir -p /opt/INSTALL/docker-reg
      cd /opt/INSTALL/docker-reg

   2. Create self-signed certificates for the Docker registry that will be valid for 999 days by running the following commands:

      openssl genrsa -des3 -passout pass:[SECRET PASSPHRASE] -out docker-reg.keypair.key 4096

      openssl rsa -passin pass:[SECRET PASSPHRASE] -in docker-reg.keypair.key -out docker-reg.key

      openssl req -new -key docker-reg.key -out docker-reg.csr

      Country Name (2 letter code) [XX]:AT
      State or Province Name (full name) []:
      Locality Name (eg, city) [Default City]:Vienna
      Organization Name (eg, company) [Default Company Ltd]:Example Company
      Organizational Unit Name (eg, section) []:
      Common Name (eg, your name or your server's hostname) []:customizer.example.com
      ...

      openssl x509 -req -days 9999 -in docker-reg.csr -signkey docker-reg.key -out docker-reg.crt

      Questions when running the above command can be answered with the defaults.
   3. Copy certificates to shared directory:

      cp docker-reg.crt /opt/HCL-Shared/docker-registry/certs/
      cp docker-reg.key /opt/HCL-Shared/docker-registry/certs/

4. Add the newly created self-signed certificates to the Linux certificate trust store so that Docker can use them:

   cp /opt/HCL-Shared/docker-registry/certs/docker-reg.crt /etc/pki/ca-trust/source/anchors
   update-ca-trust 

   Note: For Customizer Lite HA, this step needs to be done for each Customizer Lite server.
5. Restart Docker so it accepts the new certificates:

   systemctl restart docker

6. Create and start the Docker registry using the following command. If you modified the paths in step 1, you need to change them for this command as well.
   If no Docker registry is installed, Docker will automatically pull the most recent version of "registry:2" from the Docker repositories.

   docker run -d -p 5000:5000 --restart=always --name registry -v /opt/HCL-Shared/docker-registry/auth:/auth -v /opt/HCL-Shared/docker-registry/certs:/certs -v /opt/HCL-Shared/docker-registry/registry:/var/lib/registry -e "REGISTRY_AUTH=htpasswd" -e "REGISTRY_AUTH_HTPASSWD_REALM=Registry Realm" -e "REGISTRY_AUTH_HTPASSWD_PATH=/auth/htpasswd" -e "REGISTRY_HTTP_TLS_CERTIFICATE=/certs/docker-reg.crt" -e "REGISTRY_HTTP_TLS_KEY=/certs/docker-reg.key" registry:2

7. Verify that the Docker registry is running using docker ps, as follows:

   docker ps
   CONTAINER ID        IMAGE               COMMAND                  CREATED             STATUS              PORTS                    NAMES
   8564329b0258        registry:2          "/entrypoint.sh /etc…"   5 seconds ago       Up 3 seconds        0.0.0.0:5000->5000/tcp   registry

Docker Compose

Setting up a reverse proxy

Customizer Lite HA requires the use of a reverse proxy. The following is an example using NGINX.

Refer to steps 4 through 10 in Configuring the NGINX proxy server for Customizer.