<commit_before>// Module included in the following assemblies:
//
// * installing/installing_restricted_networks/installing-restricted-networks-preparations.adoc

ifeval::["{context}" == "installing-restricted-networks-preparations"]
:restricted:
endif::[]

[id="installation-creating-mirror-registry_{context}"]
= Creating a mirror registry

Create a registry to host the mirrored content that you require for installing
{product-title}.
ifdef::restricted[]
For installation in a restricted network, you must place the mirror on your
bastion host.
endif::restricted[]

[NOTE]
====
The following procedure creates a simple registry that stores data in the
`/opt/registry` folder and runs in a `podman` container. You can use a different
registry solution, such as
link:https://access.redhat.com/documentation/en-us/red_hat_quay/3/html-single/manage_red_hat_quay/index#repo-mirroring-in-red-hat-quay[Red Hat Quay].
Review the following procedure to ensure that your registry functions
correctly.
====

.Prerequisites

* You have a Red Hat Enterprise Linux (RHEL) server on your network to use
as the registry host.
* The registry host can access the internet.

.Procedure

ifdef::restricted[]
On the bastion host, take the following actions:
endif::restricted[]

. Install the required packages:
+
----
# yum -y install podman httpd-tools
----
+
The `podman` package provides the container package that you run the registry
in. The `httpd-tools` package provides the `htpasswd` utility, which
you use to create users.

. Create folders for the registry:
+
----
# mkdir -p /opt/registry/{auth,certs,data}
----
+
These folders are mounted inside the registry container.

. Provide a certificate for the registry. If you do not have an existing, trusted
certificate authority, you can generate a self-signed certificate:
+
----
$ cd /opt/registry/certs
# openssl req -newkey rsa:4096 -nodes -sha256 -keyout domain.key -x509 -days 365 -out domain.crt
----
+
At the prompts, provide the required values for the certificate:
[horizontal]
Country Name (2 letter code):: Specify the two-letter ISO country code for your location.
See the link:https://www.iso.org/iso-3166-country-codes.html[ISO 3166 country codes]
standard.
State or Province Name (full name):: Enter the full name of your state or province.
Locality Name (eg, city):: Enter the name of your city.
Organization Name (eg, company):: Enter your company name.
Organizational Unit Name (eg, section):: Enter your department name.
Common Name (eg, your name or your server's hostname):: Enter the host name for
the registry host. Ensure that your hostname is in DNS and that it resolves to
the expected IP address.
Email Address:: Enter your email address.
For more information, see the
link:https://www.openssl.org/docs/man1.1.1/man1/req.html[req] description in the
OpenSSL documentation.

. Generate a user name and a password for your registry that uses the `bcrpt` format:
+
----
# htpasswd -bBc /opt/registry/auth/htpasswd <user_name> <password> <1>
----
<1> Replace `<user_name>` and `<password>` with a user name and a password.

. Create the `mirror-registry` container to host your registry:
+
----
# podman run --name mirror-registry -p <local_registry_host_port>:5000 \ <1>
     -v /opt/registry/data:/var/lib/registry:z \
     -v /opt/registry/auth:/auth:z \
     -e "REGISTRY_AUTH=htpasswd" \
     -e "REGISTRY_AUTH_HTPASSWD_REALM=Registry Realm" \
     -e REGISTRY_AUTH_HTPASSWD_PATH=/auth/htpasswd \
     -v /opt/registry/certs:/certs:z \
     -e REGISTRY_HTTP_TLS_CERTIFICATE=/certs/domain.crt \
     -e REGISTRY_HTTP_TLS_KEY=/certs/domain.key \
     docker.io/library/registry:2
----
<1> For `<local_registry_host_port>`, specify the port that your mirror registry
uses to serve content.

. Open the required ports for your registry:
+
----
# firewall-cmd --add-port=<local_registry_host_port>/tcp --zone=internal --permanent <1>
# firewall-cmd --add-port=<local_registry_host_port>/tcp --zone=public   --permanent <1>
# firewall-cmd --reload
----
<1> For `<local_registry_host_port>`, specify the port that your mirror registry
uses to serve content.

. Add the self-signed certificate to your list of trusted certificates:
+
----
# cp /opt/registry/certs/domain.crt /etc/pki/ca-trust/source/anchors/
# update-ca-trust
----
+
You must trust your certificate to log in to your registry during the mirror process.

. Confirm that the registry is available:
+
----
$ curl -u <user_name>:<password> -k https://<local_registry_host_name>:<local_registry_host_port>/v2/_catalog <1>

{"repositories":[]}
----
<1> For `<user_name>` and `<password>`, specify the user name and password<commit_msg>bug 1775938 editing podman command<commit_after>// Module included in the following assemblies:
//
// * installing/installing_restricted_networks/installing-restricted-networks-preparations.adoc

ifeval::["{context}" == "installing-restricted-networks-preparations"]
:restricted:
endif::[]

[id="installation-creating-mirror-registry_{context}"]
= Creating a mirror registry

Create a registry to host the mirrored content that you require for installing
{product-title}.
ifdef::restricted[]
For installation in a restricted network, you must place the mirror on your
bastion host.
endif::restricted[]

[NOTE]
====
The following procedure creates a simple registry that stores data in the
`/opt/registry` folder and runs in a `podman` container. You can use a different
registry solution, such as
link:https://access.redhat.com/documentation/en-us/red_hat_quay/3/html-single/manage_red_hat_quay/index#repo-mirroring-in-red-hat-quay[Red Hat Quay].
Review the following procedure to ensure that your registry functions
correctly.
====

.Prerequisites

* You have a Red Hat Enterprise Linux (RHEL) server on your network to use
as the registry host.
* The registry host can access the internet.

.Procedure

ifdef::restricted[]
On the bastion host, take the following actions:
endif::restricted[]

. Install the required packages:
+
----
# yum -y install podman httpd-tools
----
+
The `podman` package provides the container package that you run the registry
in. The `httpd-tools` package provides the `htpasswd` utility, which
you use to create users.

. Create folders for the registry:
+
----
# mkdir -p /opt/registry/{auth,certs,data}
----
+
These folders are mounted inside the registry container.

. Provide a certificate for the registry. If you do not have an existing, trusted
certificate authority, you can generate a self-signed certificate:
+
----
$ cd /opt/registry/certs
# openssl req -newkey rsa:4096 -nodes -sha256 -keyout domain.key -x509 -days 365 -out domain.crt
----
+
At the prompts, provide the required values for the certificate:
[horizontal]
Country Name (2 letter code):: Specify the two-letter ISO country code for your location.
See the link:https://www.iso.org/iso-3166-country-codes.html[ISO 3166 country codes]
standard.
State or Province Name (full name):: Enter the full name of your state or province.
Locality Name (eg, city):: Enter the name of your city.
Organization Name (eg, company):: Enter your company name.
Organizational Unit Name (eg, section):: Enter your department name.
Common Name (eg, your name or your server's hostname):: Enter the host name for
the registry host. Ensure that your hostname is in DNS and that it resolves to
the expected IP address.
Email Address:: Enter your email address.
For more information, see the
link:https://www.openssl.org/docs/man1.1.1/man1/req.html[req] description in the
OpenSSL documentation.

. Generate a user name and a password for your registry that uses the `bcrpt` format:
+
----
# htpasswd -bBc /opt/registry/auth/htpasswd <user_name> <password> <1>
----
<1> Replace `<user_name>` and `<password>` with a user name and a password.

. Create the `mirror-registry` container to host your registry:
+
----
# podman run --name mirror-registry -p <local_registry_host_port>:5000 \ <1>
     -v /opt/registry/data:/var/lib/registry:z \
     -v /opt/registry/auth:/auth:z \
     -e "REGISTRY_AUTH=htpasswd" \
     -e "REGISTRY_AUTH_HTPASSWD_REALM=Registry Realm" \
     -e REGISTRY_AUTH_HTPASSWD_PATH=/auth/htpasswd \
     -v /opt/registry/certs:/certs:z \
     -e REGISTRY_HTTP_TLS_CERTIFICATE=/certs/domain.crt \
     -e REGISTRY_HTTP_TLS_KEY=/certs/domain.key \
     -d docker.io/library/registry:2
----
<1> For `<local_registry_host_port>`, specify the port that your mirror registry
uses to serve content.

. Open the required ports for your registry:
+
----
# firewall-cmd --add-port=<local_registry_host_port>/tcp --zone=internal --permanent <1>
# firewall-cmd --add-port=<local_registry_host_port>/tcp --zone=public   --permanent <1>
# firewall-cmd --reload
----
<1> For `<local_registry_host_port>`, specify the port that your mirror registry
uses to serve content.

. Add the self-signed certificate to your list of trusted certificates:
+
----
# cp /opt/registry/certs/domain.crt /etc/pki/ca-trust/source/anchors/
# update-ca-trust
----
+
You must trust your certificate to log in to your registry during the mirror process.

. Confirm that the registry is available:
+
----
$ curl -u <user_name>:<password> -k https://<local_registry_host_name>:<local_registry_host_port>/v2/_catalog <1>

{"repositories":[]}
----
<1> For `<user_name>` and `<password>`, specify the user name and password
{'fraction_non_alphanumeric': 0.1150470890410959, 'fraction_numerical': 0.0097388698630137, 'mean_word_length': 4.120547945205479, 'pattern_counts': {'":': 2, '<': 51, '<?xml version=': 0, '>': 51, 'https://': 8, 'lorem ipsum': 0, 'www.': 4, 'xml': 0}, 'pii_count': 0, 'substrings_counts': 0, 'word_list_counts': {'cursed_substrings.json': 0, 'profanity_word_list.json': 0, 'sexual_word_list.json': 0, 'zh_pornsignals.json': 0}}
{'dir': 'git-commits-cleaned', 'id': '6339545', 'n_tokens_mistral': 2991, 'n_tokens_neox': 2835, 'n_words': 1018}