add registry setup

scripts/docker-prod-common.sh

@@ -5,13 +5,17 @@ set -euo pipefail
 ROOT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
 PROD_COMPOSE_FILE="${ROOT_DIR}/docker-compose.production.yml"
 PORTAINER_COMPOSE_FILE="${ROOT_DIR}/docker-compose.portainer.production.yml"
+REGISTRY_COMPOSE_FILE="${ROOT_DIR}/docker-compose.registry.production.yml"
 TRAEFIK_COMPOSE_FILE="${ROOT_DIR}/traefik.yaml"
 ENV_FILE="${ROOT_DIR}/.env.docker.production"
 PROJECT_NAME="${DOCKER_PROD_PROJECT_NAME:-rentaldrivego-prod}"
 PORTAINER_PROJECT_NAME="${DOCKER_PORTAINER_PROJECT_NAME:-rentaldrivego-portainer-prod}"
+REGISTRY_PROJECT_NAME="${DOCKER_REGISTRY_PROJECT_NAME:-rentaldrivego-registry-prod}"
 TRAEFIK_NETWORK="${DOCKER_PROD_TRAEFIK_NETWORK:-traefik-proxy}"
 VOLUME_BACKUP_IMAGE="${DOCKER_VOLUME_BACKUP_IMAGE:-postgres:16-alpine}"
 API_UPLOADS_VOLUME="${DOCKER_PROD_API_UPLOADS_VOLUME:-${PROJECT_NAME}_api_uploads}"
+REGISTRY_AUTH_DIR="${ROOT_DIR}/docker/registry/auth"
+REGISTRY_AUTH_FILE="${REGISTRY_AUTH_DIR}/htpasswd"
 
 ensure_env_file() {
   if [[ ! -f "${ENV_FILE}" ]]; then
@@ -43,6 +47,10 @@ portainer_compose() {
   docker compose -p "${PORTAINER_PROJECT_NAME}" --env-file "${ENV_FILE}" -f "${PORTAINER_COMPOSE_FILE}" "$@"
 }
 
+registry_compose() {
+  docker compose -p "${REGISTRY_PROJECT_NAME}" --env-file "${ENV_FILE}" -f "${REGISTRY_COMPOSE_FILE}" "$@"
+}
+
 traefik_compose() {
   docker compose --env-file "${ENV_FILE}" -f "${TRAEFIK_COMPOSE_FILE}" "$@"
 }
@@ -141,6 +149,30 @@ start_portainer() {
   portainer_compose up -d
 }
 
+ensure_registry_auth_file() {
+  mkdir -p "${REGISTRY_AUTH_DIR}"
+
+  if [[ -n "${REGISTRY_USER:-}" && -n "${REGISTRY_PASSWORD:-}" ]]; then
+    docker run --rm --entrypoint htpasswd httpd:2-alpine -Bbn "${REGISTRY_USER}" "${REGISTRY_PASSWORD}" > "${REGISTRY_AUTH_FILE}"
+    chmod 600 "${REGISTRY_AUTH_FILE}"
+    return 0
+  fi
+
+  if [[ -f "${REGISTRY_AUTH_FILE}" ]]; then
+    return 0
+  fi
+
+  echo "Set REGISTRY_USER and REGISTRY_PASSWORD in .env.docker.production or create ${REGISTRY_AUTH_FILE} manually." >&2
+  exit 1
+}
+
+start_registry() {
+  ensure_env_file
+  ensure_traefik_network
+  ensure_registry_auth_file
+  registry_compose up -d
+}
+
 start_traefik() {
   ensure_env_file
   ensure_traefik_network