Deploy a private container registry with OpenTofu

Stand up Harbor, an open-source container registry, on a single Quake AI instance using the validated OpenTofu template harbor-registry. You run it yourself; this is a self-hosted registry you operate, with projects, role-based access control, and Trivy vulnerability scanning by default.

Prerequisites#

You need:

• A Quake AI account with application credentials
• OpenTofu 1.6.0 or later (installation guide)
• OpenStack credentials sourced into the shell (source openrc.sh). See the OpenStack CLI guide.
• An existing SSH key pair in your project. See Add an SSH key.
• Docker installed on the client you push from, with permission to edit /etc/docker/certs.d
• A copy of the harbor-registry template from the template reference page
• Enough project quota for one s1a.large instance, a 40 GB boot volume, a 100 GB data volume, one router, one private network, and one floating IP

Step 1: Configure variables and apply#

Copy terraform.tfvars.example to terraform.tfvars and set:

key_name = "YOUR_KEY_NAME"

Leave domain commented out for a self-signed certificate on the floating IP. Defaults for flavor, Harbor version, and volume size are documented on the Harbor registry reference page.

From the template directory, run:

tofu init
tofu plan
tofu apply

Type yes when prompted. Provisioning takes several minutes while cloud-init installs Docker, generates the certificate and admin password, and starts the Harbor stack.

When the run finishes, record the outputs:

REGISTRY_URL=$(tofu output -raw registry_url)
HARBOR_HOST=$(tofu output -raw floating_ip)

Step 2: Retrieve the admin password and trust the certificate#

cloud-init takes several minutes after apply returns. Wait for it to finish and read the admin password:

ssh -i ~/.ssh/YOUR_KEY -o StrictHostKeyChecking=accept-new ubuntu@"$HARBOR_HOST" 'cloud-init status --wait'
ssh -i ~/.ssh/YOUR_KEY ubuntu@"$HARBOR_HOST" sudo cat /root/harbor-credentials

Harbor serves HTTPS with a self-signed certificate on first boot. Copy the certificate into Docker's per-registry trust directory on your client:

sudo mkdir -p /etc/docker/certs.d/"$HARBOR_HOST"
ssh -i ~/.ssh/YOUR_KEY ubuntu@"$HARBOR_HOST" sudo cat /data/certs/harbor.crt | \
  sudo tee /etc/docker/certs.d/"$HARBOR_HOST"/ca.crt > /dev/null

Step 3: Sign in and push an image#

Open registry_url in your browser and sign in as admin with the generated password. Create a private project named demo.

Sign the Docker client in to the registry:

docker login "$HARBOR_HOST"

Tag and push a test image:

docker pull hello-world:latest
docker tag hello-world:latest "$HARBOR_HOST"/demo/hello-world:latest
docker push "$HARBOR_HOST"/demo/hello-world:latest

Confirm the registry serves the image back:

docker rmi "$HARBOR_HOST"/demo/hello-world:latest hello-world:latest
docker pull "$HARBOR_HOST"/demo/hello-world:latest

With Trivy enabled, Harbor scans the pushed image and reports vulnerabilities on the artifact detail page in the portal.

Next steps#

• Harbor registry template
• Deploy a self-hosted git forge and CI
• CI/CD pipelines
• Kubernetes platforms
• Create a robot account scoped to a project for pipeline and cluster credentials instead of the admin password

Clean up#

Run tofu destroy from the project directory when finished. Type yes to confirm. Remove the certificate you added on the client if you no longer need it:

sudo rm -rf /etc/docker/certs.d/"$HARBOR_HOST"