Allowing artifacts.software-univention.de in firewalls and proxies

Knowledge Base Supported
1

Univention distributes container images (for example UCS App Center apps such
as Keycloak, and Nubus components) from the registry
artifacts.software-univention.de. When a client downloads an image layer, the
registry answers with an HTTP 307 redirect to its object-storage backend
s3.de-west-1.psmanaged.com.

If your firewall or HTTP proxy only allows artifacts.software-univention.de,
the image manifest can be read but the actual layers fail to download, so the
pull or app installation/upgrade fails.

You must allow both hosts:

Host Purpose Protocol / Port
artifacts.software-univention.de Registry API, authentication token, manifests HTTPS / 443
s3.de-west-1.psmanaged.com Object storage (image layers / blobs), served via 307 redirect HTTPS / 443

Background

artifacts.software-univention.de is a Harbor registry. For efficiency, Harbor
does not stream large image blobs itself; it issues a short-lived, pre-signed
redirect to the S3-compatible object storage where the data actually lives.
That storage is operated by Univention under
the domain s3.de-west-1.psmanaged.com.

A blob request therefore looks like this:

< HTTP/2 307
< location: https://s3.de-west-1.psmanaged.com/artifacts-software-univention-de/docker/registry/v2/blobs/sha256/.../data?X-Amz-Algorithm=...&X-Amz-Signature=...

The pre-signed URL contains the credentials and an expiry, so no separate
authentication against the storage host is required. The client must, however,
be allowed to follow the redirect to a different domain.

What to configure

  1. Firewall / proxy allowlist: permit outbound HTTPS (TCP 443) to both
    artifacts.software-univention.de and s3.de-west-1.psmanaged.com.
  2. HTTP proxies: ensure the proxy forwards (does not block) requests to
    s3.de-west-1.psmanaged.com and that it allows cross-host redirects.
  3. TLS-inspecting / MITM proxies: the redirect target uses pre-signed query
    parameters. Do not strip or rewrite query strings, and make sure the
    proxy’s CA handling does not break the connection to the storage host.

Verifying connectivity

Run the following from a host on the affected network. It fetches an
authentication token, reads a manifest, and downloads the first layer, which is
the request that gets redirected to the storage host. Replace the repository
and reference with one you are entitled to pull.

REGISTRY="https://artifacts.software-univention.de"
REPO="nubus/images/keycloak"          # test repository
REF="0.28.1"                          # tag

# 1. Get a pull token
TOKEN=$(curl -s "${REGISTRY}/service/token?service=harbor-registry&scope=repository:${REPO}:pull" | jq -r '.token')

# 2. Read the manifest and take the first layer digest
DIGEST=$(curl -s \
  -H "Authorization: Bearer ${TOKEN}" \
  -H "Accept: application/vnd.oci.image.manifest.v1+json" \
  "${REGISTRY}/v2/${REPO}/manifests/${REF}" | jq -r '.layers[0].digest')

# 3. Download the layer (this is the request that is redirected to S3)
curl -sS -L -o /dev/null -w "%{http_code}\n" \
  -H "Authorization: Bearer ${TOKEN}" \
  "${REGISTRY}/v2/${REPO}/blobs/${DIGEST}"
  • A final status of 200 means the redirect was followed and the layer
    downloaded successfully.
  • If the layer step hangs or fails while the manifest step (step 2) works,
    the redirect to s3.de-west-1.psmanaged.com is being blocked. Allow that
    host and retry.

You can inspect the redirect itself by adding -v and dropping -L; look for
the 307 response and its location header.

Affected scenarios

  • Installing or upgrading UCS App Center apps whose images are hosted on
    artifacts.software-univention.de (for example Keycloak).
  • Pulling Nubus / Nubus for Kubernetes container images.
  • Any direct docker pull / skopeo / crane against
    artifacts.software-univention.de.

Note on the previous registry

Older app versions referenced images on docker.software-univention.de.
Newer releases pull from artifacts.software-univention.de. If you previously
only allowed docker.software-univention.de, update your allowlist to the two
hosts in the table above before upgrading.

Related

1 Like