Merge pull request #93 from sky22333/registry-alpha

shell OOM

.github/workflows/docker-ghcr.yml

@@ -52,9 +52,10 @@ jobs:
       - name: Build and push Docker image
         run: |
           docker buildx build --push \
-            --platform linux/amd64 \
+            --platform linux/amd64,linux/arm64 \
             --tag ghcr.io/${{ env.REPO_LOWER }}:${{ env.VERSION }} \
+            --tag ghcr.io/${{ env.REPO_LOWER }}:latest \
             --build-arg VERSION=${{ env.VERSION }} \
             -f Dockerfile .
         env:
-          GHCR_PUBLIC: true
+          GHCR_PUBLIC: true

src/config.toml

@@ -83,12 +83,6 @@ authHost = "registry.k8s.io"
 authType = "anonymous"
 enabled = true
 
-# Default Registry
-[defaultRegistry]
-upstream = "registry-1.docker.io"
-authHost = "auth.docker.io"
-enabled = true
-
 [tokenCache]
 # 是否启用缓存(同时控制Token和Manifest缓存)显著提升性能
 enabled = true

src/config/config.go

@@ -49,8 +49,6 @@ type AppConfig struct {
 	} `toml:"download"`
 
 	Registries map[string]RegistryMapping `toml:"registries"`
-	
-	DefaultRegistry RegistryMapping `toml:"defaultRegistry"`
 
 	TokenCache struct {
 		Enabled    bool   `toml:"enabled"`

src/handlers/docker.go

@@ -5,7 +5,6 @@ import (
 	"fmt"
 	"io"
 	"net/http"
-	"regexp"
 	"strings"
 	"time"
 
@@ -17,8 +16,6 @@ import (
 	"hubproxy/utils"
 )
 
-var realmRegex = regexp.MustCompile(`realm="(https?://)([^/"]+)(/?[^"]*)"`)
-
 // DockerProxy Docker代理配置
 type DockerProxy struct {
 	registry name.Registry
@@ -71,13 +68,7 @@ var registryDetector = &RegistryDetector{}
 
 // InitDockerProxy 初始化Docker代理
 func InitDockerProxy() {
-	cfg := config.GetConfig()
-	upstream := "registry-1.docker.io"
-	if cfg.DefaultRegistry.Upstream != "" {
-		upstream = cfg.DefaultRegistry.Upstream
-	}
-
-	registry, err := name.NewRegistry(upstream)
+	registry, err := name.NewRegistry("registry-1.docker.io")
 	if err != nil {
 		fmt.Printf("创建Docker registry失败: %v\n", err)
 		return
@@ -362,21 +353,17 @@ func (r *ResponseRecorder) Write(data []byte) (int, error) {
 }
 
 func proxyDockerAuthOriginal(c *gin.Context) {
-	cfg := config.GetConfig()
-
-	authHost := "auth.docker.io"
-	if cfg.DefaultRegistry.AuthHost != "" {
-		authHost = cfg.DefaultRegistry.AuthHost
-	}
-
+	var authURL string
 	if targetDomain, exists := c.Get("target_registry_domain"); exists {
 		if mapping, found := registryDetector.getRegistryMapping(targetDomain.(string)); found {
-			authHost = mapping.AuthHost
+			authURL = "https://" + mapping.AuthHost + c.Request.URL.Path
+		} else {
+			authURL = "https://auth.docker.io" + c.Request.URL.Path
 		}
+	} else {
+		authURL = "https://auth.docker.io" + c.Request.URL.Path
 	}
 
-	authURL := "https://" + authHost + c.Request.URL.Path
-
 	if c.Request.URL.RawQuery != "" {
 		authURL += "?" + c.Request.URL.RawQuery
 	}
@@ -419,15 +406,10 @@ func proxyDockerAuthOriginal(c *gin.Context) {
 		}
 	}
 
-	scheme := "http"
-	if c.Request.TLS != nil || c.GetHeader("X-Forwarded-Proto") == "https" {
-		scheme = "https"
-	}
-
 	for key, values := range resp.Header {
 		for _, value := range values {
 			if key == "Www-Authenticate" {
-				value = rewriteAuthHeader(value, scheme, proxyHost)
+				value = rewriteAuthHeader(value, proxyHost)
 			}
 			c.Header(key, value)
 		}
@@ -438,8 +420,13 @@ func proxyDockerAuthOriginal(c *gin.Context) {
 }
 
 // rewriteAuthHeader 重写认证头
-func rewriteAuthHeader(authHeader, scheme, proxyHost string) string {
-	return realmRegex.ReplaceAllString(authHeader, fmt.Sprintf(`realm="%s://%s$3"`, scheme, proxyHost))
+func rewriteAuthHeader(authHeader, proxyHost string) string {
+	authHeader = strings.ReplaceAll(authHeader, "https://auth.docker.io", "http://"+proxyHost)
+	authHeader = strings.ReplaceAll(authHeader, "https://ghcr.io", "http://"+proxyHost)
+	authHeader = strings.ReplaceAll(authHeader, "https://gcr.io", "http://"+proxyHost)
+	authHeader = strings.ReplaceAll(authHeader, "https://quay.io", "http://"+proxyHost)
+
+	return authHeader
 }
 
 // handleMultiRegistryRequest 处理多Registry请求
@@ -618,5 +605,12 @@ func createUpstreamOptions(mapping config.RegistryMapping) []remote.Option {
 		remote.WithTransport(utils.GetGlobalHTTPClient().Transport),
 	}
 
+	// 预留将来不同Registry的差异化认证逻辑扩展点
+	switch mapping.AuthType {
+	case "github":
+	case "google":
+	case "quay":
+	}
+
 	return options
 }