added notes

harbor_notes/README.md

@@ -0,0 +1,117 @@
+# Harbor
+
+Harbor is a self-hosted OCI container image registry with vulnerability scanning, image signing, replication, and RBAC — basically a private Docker Hub. Its compose file is generated by Harbor's own installer from `harbor.yml`, so a static `compose.yaml` in this repo would drift immediately (~10 tightly-coupled services: core, registry, database, redis, jobservice, portal, trivy, nginx, etc). Use the official installer instead of hand-rolling compose. See `container-requests.md` for the "will not be in the repo" rationale.
+
+- Project Repository: https://github.com/goharbor/harbor
+- Documentation: https://goharbor.io/docs/
+- Releases (installer download): https://github.com/goharbor/harbor/releases
+
+## Tutorial: Installing Harbor
+
+### 1. Prerequisites
+
+- Docker Engine 20.10.10+ and Docker Compose 2.0.0+ on the host
+- A domain name (or IP) that will be Harbor's registry hostname
+- A TLS certificate, or be prepared to run without HTTPS on a trusted internal network only (Docker refuses to talk to an insecure registry over plain HTTP unless explicitly configured)
+
+### 2. Download the offline installer
+
+```bash
+cd /opt
+wget https://github.com/goharbor/harbor/releases/download/v2.11.1/harbor-offline-installer-v2.11.1.tgz
+tar xzvf harbor-offline-installer-v2.11.1.tgz
+cd harbor
+```
+
+Check the [releases page](https://github.com/goharbor/harbor/releases) for the current version.
+
+### 3. Configure `harbor.yml`
+
+```bash
+cp harbor.yml.tmpl harbor.yml
+nano harbor.yml
+```
+
+Key fields to set:
+
+```yaml
+hostname: registry.example.com   # the domain or IP clients will use
+
+http:
+  port: 80
+
+https:
+  port: 443
+  certificate: /your/certificate/path
+  private_key: /your/private/key/path
+
+harbor_admin_password: ChangeThisPassword
+
+data_volume: /data/harbor
+
+database:
+  password: ChangeThisPassword
+```
+
+If you don't have a certificate yet, comment out the entire `https:` block and drop `https` from downstream instructions — but note Docker clients will then need `insecure-registries` configured to push/pull (see step 6).
+
+### 4. Run the installer
+
+```bash
+sudo ./install.sh
+```
+
+This generates `docker-compose.yml` from `harbor.yml` and brings the stack up. Optional flags:
+
+```bash
+sudo ./install.sh --with-trivy    # image vulnerability scanning
+sudo ./install.sh --with-chartmuseum   # Helm chart repository (deprecated upstream, skip for new installs)
+```
+
+### 5. Log in to the UI
+
+Open `https://registry.example.com` and log in as `admin` with the password set in `harbor_admin_password`. Immediately:
+
+1. Create a new project (e.g. `homelab`) — set it Private or Public
+2. Create additional users under Administration → Users, or configure LDAP/OIDC
+
+### 6. Push and pull images
+
+```bash
+docker login registry.example.com
+docker tag myapp:latest registry.example.com/homelab/myapp:latest
+docker push registry.example.com/homelab/myapp:latest
+
+# on another machine:
+docker pull registry.example.com/homelab/myapp:latest
+```
+
+If running without TLS, add the registry to `/etc/docker/daemon.json` on every client first:
+
+```json
+{
+  "insecure-registries": ["registry.example.com:80"]
+}
+```
+
+then `sudo systemctl restart docker`.
+
+### 7. Use it as a pull-through cache / replication target (optional)
+
+Administration → Registries lets you add Docker Hub (or another registry) as an endpoint, then Administration → Replications to mirror images in on a schedule — useful for caching frequently-pulled base images locally.
+
+### 8. Day-2 operations
+
+```bash
+cd /opt/harbor
+sudo docker compose down
+sudo ./install.sh          # re-run after editing harbor.yml to regenerate and restart
+```
+
+Back up `data_volume` (default `/data/harbor`) and the Postgres data inside it before any upgrade. Upgrades are major-version-specific — always read the [upgrade guide](https://goharbor.io/docs/edge/administration/upgrade/) for your version jump, don't just re-run the new installer over old data blindly.
+
+## Gotchas
+
+- Trivy's vulnerability database downloads on first scan and needs outbound internet access; air-gapped installs need `--with-trivy` plus manually seeding the DB.
+- The installer's generated `docker-compose.yml` is meant to be managed by `install.sh`, not edited by hand — re-running the installer after config changes is the supported workflow.
+- Harbor's own `database` and `redis` containers store state locally by default; point `harbor.yml` at external Postgres/Redis instead if you already run those services elsewhere.